Technical Tip: Best practices while deploying FortiGate models with NP7 Chip

sthampi_FTNT · ‎06-09-2023

Description

This article provides configuration and verification steps to optimize an NP7-based FortiGate.

Scope

FortiGate with Network Processor 7.

Solution

While deploying FortiGate which uses NP7, it is important to verify that the default queues are present in the configuration.

The default queues can be missing in certain cases such as:

- Incorrect migration of configuration file from older hardware to NP7 unit.

- Upgrading the NP7 FortiGate from older firmware (that does not have the queue feature) to the latest firmware.

Hence, it is important to double-check if the Fortigate is running with the default queues as mentioned in this document.

In addition to the above-mentioned default queues, customized queues can be utilized for specific user traffic as explained in this document.

Failure to enable the default queues:

- may result in all traffic going via the default queue.

- sub-optimal traffic processing by the FortiGate.

- in the worst-case scenario, this may result in the issue described in this article.

The queue utilization can be seen from the output of the following command (note: it needs to be run at least 5 to 10 times, over a fixed time interval) to get the best results.

1) When the default NP7 queue configuration is missing, it is possible to see that the majority of the traffic is processed by Queue_0:

config global

config system npu

<empty>

end

2) When the default NP7 queues are configured:

config system npu

config np-queues

config ethernet-type

edit "ARP"

set type 806

set queue 9

set type 8892

set queue 11

set type 8890

set queue 11

set type 8891

set queue 11

set type 8893

set queue 11

set type 8809

set queue 9

config ip-protocol

edit "OSPF"

set protocol 89

set queue 11

set protocol 2

set queue 11

set protocol 1

set queue 3

config ip-service

edit "IKE"

set protocol 17

set sport 500

set dport 500

set queue 11

set protocol 6

set sport 179

set dport 179

set queue 9

set protocol 17

set sport 3784

set dport 3784

set queue 11

set protocol 17

set sport 4784

set dport 4784

set queue 11

set protocol 17

set dport 720

set queue 11

set protocol 17

set sport 11133

set dport 11133

set queue 11

set protocol 17

set sport 65435

set dport 65435

set queue 11

end

It can display more queues being utilized, for example, Queue_3 and Queue_9, and Queue_11 in this case.