npu link

[suthomas1]

Good day everyone,

I will appreciate all feedback on understanding what is the main difference between npu Vdom link & only Vdom link.

They appear to be two seperate things. i read about acceleration but didn't quite grasp it. 

So when should one use npu vdom & normal vdom link?

only creating the vdom link from interfaces, can it be used or does it have issues.

[Toshi_Esumi · Accepted solution]

Below doc for non-npu vlink says "VDOM link does not support traffic offload. If you want to use traffic offload, use NPU-VDOM-LINK."

https://docs.fortinet.com...646/inter-vdom-routing

So, if an ingress port1 in vdom1 is handled by npu1 and an egress port2 in vdom2 is handled by npu1 as well, the entire processes from the ingress to the egress could be offloaded to npu1 IF you use an npu1 vlink between two vdoms. If a non-npu vlink (or different npu vlink like npu2), it needs to come out from npu1 once and the CPU needs to handle it before hand it over to vdom2.

[Toshi_Esumi · Accepted solution]

Yes, of course. Also make sure it goes through only one/same npu from ingress to egress in case your model has multiple npus. It might make significant difference in performance.

[Toshi_Esumi · Accepted solution]

Only difference in config is npu vlink is built-in. You don't need to create one. If npu0, it's like npu0_vlink0 and npu0_vlink1 for both ends. But in case you have many vdoms need to connect them together, you shold use vlans on the npu0_vlink. Like "VLAN100_0" in vdom1 on npu0_vlink0 and "VLAN100_1" in vdom2 on npu0_vlink1, and so on and on.

[Toshi_Esumi · Accepted solution]

https://docs.fortinet.com/document/fortigate/6.4.0/hardware-acceleration/327022/using-vlans-to-add-m...

This is an example. VLAN is of course not built-in. You can name it whatever you want.

[Toshi_Esumi · Accepted solution]

Below doc for non-npu vlink says "VDOM link does not support traffic offload. If you want to use traffic offload, use NPU-VDOM-LINK."

https://docs.fortinet.com...646/inter-vdom-routing

So, if an ingress port1 in vdom1 is handled by npu1 and an egress port2 in vdom2 is handled by npu1 as well, the entire processes from the ingress to the egress could be offloaded to npu1 IF you use an npu1 vlink between two vdoms. If a non-npu vlink (or different npu vlink like npu2), it needs to come out from npu1 once and the CPU needs to handle it before hand it over to vdom2.

[suthomas1]

Thank you Toshi.

Then, is it better to use npu here to avoid CPU/software processing and help with hardware acceleration?

Can the links between vdom be  both npu or non-npu ? how is it differentiated in configuration?

[Toshi_Esumi · Accepted solution]

Yes, of course. Also make sure it goes through only one/same npu from ingress to egress in case your model has multiple npus. It might make significant difference in performance.

[Toshi_Esumi · Accepted solution]

Only difference in config is npu vlink is built-in. You don't need to create one. If npu0, it's like npu0_vlink0 and npu0_vlink1 for both ends. But in case you have many vdoms need to connect them together, you shold use vlans on the npu0_vlink. Like "VLAN100_0" in vdom1 on npu0_vlink0 and "VLAN100_1" in vdom2 on npu0_vlink1, and so on and on.

[Toshi_Esumi · Accepted solution]

https://docs.fortinet.com/document/fortigate/6.4.0/hardware-acceleration/327022/using-vlans-to-add-m...

This is an example. VLAN is of course not built-in. You can name it whatever you want.

[suthomas1]

Thanks Toshi.

Pardon my questions, as i am quite new.we have multiple vdoms and want to create a vdom link between "subs" & "cubs" vdom. from global vdom link creation can be done from the interfaces which creates vdom link between these two..like subs-cubs-0 & subs-cubs-1. But i am confused if this is the actual npu vdom link? why does it give an option of creating vdom link under interfaces if it is not so?

Or do i have to create this subs-cubs new link within existing npu0-vlink's? 

[Toshi_Esumi · Accepted solution]

The npu vlink's names are reserved and they're already there inside of npus. For the vdom links you can create you might call them as CPU vlinks handled by the CPU.

I don't know exactly why CPU vlinks exist but it might be just historical reason, or config compatibility with models that don't have NPUs. I'm almost sure CPU vlinks were the first when they introduced VDOMs, then they added npu vlinks when they introduced NPU chips.  

[suthomas1]

So npu links may be the way to go.

[echo]

I was reading this and I didn't understand. When I start using a VDOM link then I specify the member VDOMs, say root and VD1. Now if I have VDOM's VD2 and VD3 then how can you use the same VDOM link to connect VD2 with root and VD3 with root? How can a VLAN help here when the VDOM link already specifies the VDOM's that are in use within that link? (I can't choose a third VDOM in the GUI.)

Asking it another way, can you please give the NEXT example in the example you gave, that is, for "and so on and on".

I have to say, I read this over and over again and I can't understand. If the thing should really work (somehow) then that would be very useful in my environment.

The information about this possibility is probably coming from this article: https://docs.fortinet.com/document/fortigate/6.0.0/hardware-acceleration/264634/using-vlans-to-add-m...

There is this text: "You can add VLAN interfaces to the NPU VDOM link interfaces to create inter-VDOM links between more VDOMs. For the links to work, the VLAN interfaces must be added to the same NPU VDOM link interface, must be on the same subnet, and must have the same VLAN ID."

But I have the same question. In the article, just ONE, THE FIRST example is given -- and no problem with that. How would the SECOND example look like? That is, connection between Marketing and some third VDOM. Is it that even though a particular npu0_vlink connects two VDOM's, it is possible to create another VLAN to it and put that VLAN into both root and a third VDOM? Confusing...

Another, different question would be: how much slower the traffic really is when the VDOM link is not made using NPU6?