IPv6 and high CPU Usage

[sviusa]

Hello,

We've seen a strange behavior our our FG90d boxes (running 5.6.3 firmware) and isolate it.

If we launch an NFS/HTTP/CIFS transfert on IPv6 between two machines on two different interfaces, throughput is locked at 40MB/Sec on machines and firewall CPU go to 100% usage.

On the related policy we don't have AV, APP or whatever NG facility.

if we do the same under IPv4 no problem. no high cpu usage and throughput is at wirespeed (1Gb).

Can someone else have seen this pb ?

Thanks,

Regards,

[sviusa]

Well i will reply myself...

No Asic for IPv6. NP6 needed. FG90d is a SoC2. so IPv6 traffic is processed by CPU.

Maximum throughput under IPv6 that a FG90d can achieve : 280 Mbits/sec.

The link to :http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-hardware-acceleration/hardware_intro....

Does anyone know if SoC3 add IPv6 offloading capacity ?

Regards,

[neonbit]

Yes Soc3 chipsets come with NP6Lite ASICs. They can accelerate IPv6 traffic. The main things the lite versions can't accelerate over the full NP6's are CAPWAP traffic, Syn proxy & DNS session helper