Why could heavy load will cause TCP packets out of order?

[asda]

Hi every one

Is it because the first packet passes through the CPU and is confirmed, then the third packet begins to be sent to the NPU. When the traffic is low, it can be transmitted normally. Once more flow passes through, the NPU cannot receive the third packet when it is fully loaded, resulting in packet loss.

But at that time, my traffic was only 100 MB. Is the load on the NPU so low? Mine was an NP4.

Thank for your answer.

[amrit]

What Foritgate Model do you use?
In the case of NP7 and NP6 Platforms(Including lite versions) under heavy load situations, packet reordering problem can be handled by the following command 

config firewall policy

set delay-tcp-npu-session enable

Please read this: https://docs.fortinet.com/document/fortigate/7.4.3/hardware-acceleration/923009/preventing-packet-or...

In your case, you mentioned that the traffic was only 100 MB. What was the total number of sessions in the firewall? If it is internet-oriented traffic the reordering can happen due to network congestion and 0 TCP window size.

To verify if NPU is the problem, you can disable auto-asic offload on the policy

policy 
config firewall policy

edit <id>

set auto-asic-offload disable

end

end

If it is an Ipsec traffic, you can disable npu on phase1 and test it 
config vpn ipsec phase1-interface

edit <phase1 name>

set npu-offload disable

end

end

[asda]

Hi amrit

The model is 1000C and the OS is v5.4.10,and my environment is an internal network environment, did not connect internet.

And the full sessions were also small.

To verify if NPU is the problem, you can disable auto-asic offload on the policy

Did you mean that if i disable the auto-asic,the packet will all traffic will be processed from the CPU, not the NPU.So that i can see is there any packet loss caused by NPU issues.

I will disable the auto-asic and see what going on.

Thank you very much

[pminarik]

NP4 may be old, but it still has 20 Gbps throughput. 100 Mbps of generic traffic will definitely not be enough to choke it.

https://docs.fortinet.com/document/fortigate/6.0.18/hardware-acceleration/575471/network-processors-....