Troubleshooting Tip: Debug flow shows offloading-check failed with reason_code=3 for IPSec traffic

[jstan]

Description	This article explains the meaning of the error 'offloading-check failed, reason_code=3' as it appears in debug flow.
Scope	Any version of FortiOS.
Solution	Sometimes, the debug flow displays the following error: id=20085 trace_id=4 func=nipsec_set_ipsec_sa_enc line=1002 msg="IPSec encrypt SA (p1/p2/spi={phase1/phase2/0xbc3596b6}) offloading-check failed, reason_code=3. This error occurs because the NPU does not support the type of encryption algorithm used in the phase 2 configuration. To fix this issue, choose a new encryption algorithm. Refer to the FortiGate cookbook for a list of which encryption algorithms support NPU offloading: Encryption algorithms v6.2.10. Encryption algorithms v7.4.0.