Network security administrators frequently adjust hardware processing settings when diagnosing elusive network issues or monitoring traffic patterns on enterprise security appliances. Disabling hardware acceleration shifts packet processing tasks directly to the main system central processing unit instead of utilizing the dedicated network processor. This operational adjustment helps isolate packet anomalies, diagnose routing failures, or analyze specific security payloads during active troubleshooting phases.
Understanding NP7 Hardware Acceleration Architecture
Core Function of the NP7 Processor
The Fortinet network processor version seven is custom hardware engineered to accelerate high-speed packet flow across modern security architectures. This specialized ASIC offloads demanding networking tasks like firewall sessions, IPsec encryption, and content inspection away from the primary CPU. By handling millions of concurrent data streams in silicon, the chip sustains multi-gigabit throughput while keeping general system resource consumption remarkably low during normal enterprise operations.
Reasons for Bypassing Acceleration
Administrators occasionally need to bypass hardware acceleration to troubleshoot complex network anomalies or intermittent connectivity failures. Certain custom application protocols or rare packet formatting errors might interact unexpectedly with accelerated fastpath routines. Forcing specific traffic flows through the main system central processing unit allows diagnostic software and packet sniffers to inspect raw traffic headers accurately without interference from the hardware chip.
Policy-Level Control Mechanics
FortiOS manages NP7 hardware acceleration primarily through individual firewall policy configurations rather than global system switches. Engineers access specific IPv4 or IPv6 security rules via the command-line interface to modify specialized behavior attributes. According to the FortiGate Hardware Acceleration Guide, disabling the automatic offload toggle forces target flows directly to general processing cores. This granular approach ensures that only designated diagnostic traffic experiences the intended routing alteration.
Impact on System Resource Load
Shifting packet workloads away from dedicated silicon immediately increases utilization on the main central processing unit. On high-volume enterprise networks, disabling acceleration across broad rule sets can quickly saturate core processor capacity and raise overall latency. Administrators must carefully evaluate available system headroom before applying these adjustments in production environments. Monitoring real-time device load prevents accidental performance degradation while capturing necessary diagnostic data streams for network analysis.
Executing the Configuration Change
To disable hardware acceleration on an NP7-equipped FortiGate device, you must enter the command-line interface and edit the targeted firewall policy rule. Locate the exact policy identification number, enter the configuration block, and switch the automatic ASIC offload parameter to inactive mode. Reviewing the procedure on the FortiGate Technical Tip Community confirms that this change takes effect immediately upon saving the policy configuration.
| Processing Mode | Hardware Acceleration Status | Primary System Impact |
|---|---|---|
| Default Accelerated Mode | Active via NP7 Silicon Chip | Minimal central processing unit usage with maximum network throughput. |
| Disabled Policy Mode | Inactive for Designated Rule | Traffic routes through main processor to enable deep packet inspection. |
| IPsec VPN Tunnel Level | Configurable via Phase 1 Settings | Bypasses hardware encryption offload for specific secure tunnels. |
| Global System Override | Not Applicable to NP7 Chips | Requires individual policy adjustments rather than global system commands. |
Verification and Safety Checklist
- Identify the exact firewall policy number managing your target network traffic flow.
- Access the command-line interface and open the corresponding firewall policy configuration.
- Set the automatic ASIC offload parameter to the disabled state.
- Monitor central processing unit utilization closely to ensure system stability.
Frequently Asked Questions
Can NP7 offloading be disabled globally?
No, FortiOS does not support a global toggle to disable NP7 processors across the entire appliance. Administrators must disable acceleration individually on each targeted firewall policy or specific IPsec VPN phase configuration item.
What happens to CPU usage when disabled?
Central processing unit usage increases because the main processor handles packet forwarding tasks. High-bandwidth traffic flows previously managed by the application-specific integrated circuit will consume more general system compute cycles.
How do I re-enable the acceleration?
Navigate back into the specific firewall policy configuration menu using the command-line interface. Change the automatic ASIC offload parameter back to its active default state to restore silicon processing.
Conclusion
Adjusting hardware acceleration controls on FortiGate firewalls provides essential visibility for resolving tricky network communication challenges. Review your active firewall policies and test changes during scheduled maintenance periods to protect overall system stability.
