FortiOS 7.4.8 Port Forwarding Performance

[kehanopni]

Have a customer that self manages their Fortinet 200F. They recently upgraded to 7.4.8 and have a server plugged directly into one of the ports on the device. They do some lite web hosting on that server and it was super fast until they upgraded. After the upgrade the port 80 and 443 performance has gone into the tank. Fortigate support remoted in and did iperf tests on about traffic and got speeds as expected so they closed the case.

Anyone have any good tips/places they can look at to see why performance for inbound port forwarding and tanked?

[BillH_FTNT]

Hi @kehanopni 

I posted this on Reddit; 

I don’t see the configuration or logs before and after the upgrade in the ticket, and the ticket is closed. Could you please share the configuration with me via email at bhoang@fortinet.com?

Please include:

\- Configuration

\- System logs

In addition, please perform the following tests and collect the information:

1. Test 1: Disable NP acceleration and test (run commands in (4))

config firewall policy

edit <policy_id>

set np-acceleration disable

next

end

2. Test 2: Disable NPU under the policy and test (run commands in (4))

config firewall policy

edit <policy_id>

set auto-asic-offload disable

next

end

3. Test 3: If your policy is using Policy mode, please change it to Flow mode and test. Conversely, if it is in Flow mode, change it to Policy mode and test. (run commands in (4))

4. For all tests, please run the following commands to collect additional logs. Thank you.

#Run these commands multiple times

get sys per status

get sys status

dia sys session stat

diagnose npu np6 dce 0

diagnose npu np6 pdq 0

diagnose npu np6 hrx-drop 0

diagnose npu np6 anomaly-drop 0

diagnose npu np6 sse-stats 0

diagnose npu np6 xgmac-stats 0

diagnose npu np6 session-stats 0

diagnose npu np6 register 0

diagnose npu np6 register 1

diagnose npu np6 ipsec-stats

fnsysctl cat /proc/net/np6\_0/ipsec-engine

fnsysctl cat /proc/net/np6\_1/ipsec-engine

fnsysctl cat /proc/net/np6\_0/gige-stats

fnsysctl cat /proc/net/np6_1/gige-stats

# run this command only one time

dia sys session list

Bill