FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
mmaubert
Staff
Staff
Article Id 194768

Description


This article explains a technical tip for correlating the counters of the ports connected to the integrated switch fabric with the different components of FortiGate NP6-based platforms.

Example:

The network interface card, the network processor unit, and the control processor unit.


Solution


On FortiOS, the '# diagnose hardware deviceinfo nic <port_number>' command allows displaying ports information including generic port description data, link status, and miscellaneous counters value.

On FortiGate NP6-based hardware platforms, in case this command is run on a port which is connected to the integrated switch fabric, the set of counters which are being displayed come from several sources.

Example:

the NIC, NPU, and CPU.


Below is a typical set of information recorded on a FGT-1500D running FortiOS 5.4.9 and collected on port23 using 'diagnose hardware deviceinfo nic port23':

 

# diagnose hardware deviceinfo nic port23

Description     :FortiASIC NP6 Adapter
Driver Name     :FortiASIC Unified NPU Driver
Name            :np6_0
PCI Slot        :09:00.0
irq             :34
Board           :FGT1500D
SN              :FG1K5D3I15801252
Major ID        :3
Minor ID        :0
lif id          :14
lif oid         :144
netdev oid      :144
netdev flags    :1203
Current_HWaddr  :08:5b:0e:e9:9a:c8
Permanent_HWaddr:08:5b:0e:e9:9a:c8
phy name        :port23
bank_id         :2
phy_addr        :0x67
lane            :2
flags           :4002
sw_port         :39
sw_np_port      :15
vid_phy[6]      :[0x10][0x47][0x00][0x00][0x00][0x00]
vid_fwd[6]      :[0x00][0x46][0x00][0x00][0x00][0x00]
oid_fwd[6]      :[0x00][0xba][0x00][0x00][0x00][0x00]
========== Link Status ==========
Admin           :up
netdev status   :up
autonego_setting:1
link_setting    :1
link_speed      :1000
link_duplex     :0
Speed           :1000
Duplex          :Full
link_status     :Up
rx_link_status  :0
int_phy_link    :0
local_fault     :0
local_warning   :0
remote_fault    :0
============ Counters ===========
sw_rx_error     :0
sw_rx_crc_error :0
sw_rx_carrier   :0
sw_rx_oversize  :0
sw_rx_undersize :0
sw_tx_collision :0
Rx Pkts         :20
Rx Bytes        :2560
Tx Pkts         :16
Tx Bytes        :2672
Host Rx Pkts    :20
Host Rx Bytes   :2200
Host Rx dropped :0
Host Tx Pkts    :16
Host Tx Bytes   :2608
Host Tx dropped :0
sw_rx_pkts      :20
sw_rx_bytes     :2560
sw_tx_pkts      :16
sw_tx_bytes     :2672
sw_rx_mc_pkts   :20
sw_rx_bc_pkts   :0
sw_in_drop_pkts :0
sw_out_drop_pkts:0
sw_np_rx_pkts   :32
sw_np_rx_bytes  :5472
sw_np_tx_pkts   :592
sw_np_tx_bytes  :78144
sw_np_rx_mc_pkts:32
sw_np_rx_bc_pkts:0
sw_np_in_drop_pkts:0
sw_np_out_drop_pkts:0

Using the port 23 data above, the ordering of counters based on the different sources will then be as per the following:

 

============ Counters ===========
rx_error        :0
rx_crc_error    :0
rx_carrier      :0
rx_oversize     :0
rx_undersize    :0
tx_collision    :0
Rx Pkts         :20
Rx Bytes        :2560
Tx Pkts         :16
Tx Bytes        :2672

Host Rx Pkts    :20
Host Rx Bytes   :2200
Host Rx dropped :0
Host Tx Pkts    :16
Host Tx Bytes   :2608
Host Tx dropped :0

sw_rx_pkts      :20
sw_rx_bytes     :2560
sw_tx_pkts      :16
sw_tx_bytes     :2672
sw_rx_mc_pkts   :20
sw_rx_bc_pkts   :0
sw_in_drop_pkts :0
sw_out_drop_pkts:0

sw_np_rx_pkts   :32
sw_np_rx_bytes  :5472
sw_np_tx_pkts   :592
sw_np_tx_bytes  :78144
sw_np_rx_mc_pkts:32
sw_np_rx_bc_pkts:0
sw_np_in_drop_pkts:0
sw_np_out_drop_pkts:0

1) Those counters correspond to NIC counters recorded and reported at the port level.

2) Those counters correspond to counters recorded and reported by the CPU.


3) Those counters are reported by the Integrated Switch Fabric and correspond to traffic coming from or going to the NIC.


4) Those counters are reported by the Integrated Switch Fabric and correspond to traffic coming from or going to the NPU.

Note:

Although the name and number of counters returned by the 'diagnose hardware deviceinfo nic <port_number>' command may slightly change depending on the different FortiOS releases being used, the counters grouping and categorization logic is globally kept.