If you need to know how to disable offloading for np7 on fortigate, the short answer is that you change the NP7 offload setting on the firewall policy or use the CLI to disable it globally.
Fortinet's own documentation for FortiOS describes NP7 network processors as hardware accelerators that handle session traffic in silicon, which is why most sessions never touch the CPU. That efficiency is usually a benefit — until a packet capture, a traffic-shaping test, or a troubleshooting session shows nothing because the traffic is being handled in hardware.
Many admins hit this wall and assume the firewall is broken, when offloading is simply doing its job. This guide walks through the policy-level and global methods, the CLI syntax, verification steps, and the trade-offs you should weigh before turning acceleration off.
Understand What NP7 Offloading Actually Does
NP7 offloading moves established session traffic from the CPU to dedicated network processors, which is why throughput scales so well on newer FortiGate models. Fortinet's FortiOS documentation explains that hardware acceleration handles forwarding decisions after the first packet of a session, so the CPU only sees the setup phase. That design keeps latency low and throughput high.
Understanding this layer is the first step in learning how to disable offloading for np7 on fortigate without breaking performance elsewhere.
The practical consequence is that diagnostic tools may show incomplete data. Packet captures taken on a firewall interface can miss offloaded packets, and some inspection features behave differently once a session is accelerated. When you decide how to disable offloading for np7 on fortigate, you are really deciding whether you need full software visibility more than you need raw speed.
Offloading is not a single switch. It applies at the policy level, and FortiOS also exposes global settings that affect acceleration behavior. Knowing which layer you are changing prevents surprises.
A quick way to check current behavior is to review session details and look for the offload flag. If sessions show as offloaded, your troubleshooting visibility is limited until you change it.
How to apply this: Run diagnose sys session list on a live session and note whether the offload indicator is present before you change anything.
Disable Offloading at the Firewall Policy Level
The policy-level method is the most common answer to how to disable offloading for np7 on fortigate because it is targeted and reversible. In the GUI, edit the firewall policy that carries the traffic, open the advanced options, and turn off the setting that allows the NP7 processor to accelerate that policy's sessions.
Save the policy and the change takes effect for new sessions.
In the CLI, the equivalent is editing the policy and setting the offload option to disable. The exact command path depends on your FortiOS version, so confirm the syntax against Fortinet's CLI reference for your release before applying it to production.
Policy-level changes only affect new sessions. Existing offloaded sessions keep running in hardware until they expire or you clear them. That is the most frequent source of confusion — admins disable offloading, test immediately, and see the same behavior. This is the single biggest gotcha when you learn how to disable offloading for np7 on fortigate.
- Identify the specific policy carrying the traffic you need to inspect.
- Disable offload on that policy only, not the whole device.
- Clear matching sessions so new ones are built in software.
- Re-test your capture or inspection tool.
How to apply this: Change one policy at a time and document it, so you can roll back quickly if performance drops.
Use Global CLI Settings When Policy Changes Are Not Enough
Sometimes policy-level changes are not sufficient, and you need to address acceleration globally. This is where how to disable offloading for np7 on fortigate becomes a broader configuration question, because global settings affect every policy on the device.
FortiOS provides global configuration options that control hardware acceleration behavior across the system. These are powerful and should be treated with care — disabling acceleration globally can reduce throughput substantially on high-traffic devices. Fortinet's knowledge base articles on hardware acceleration note that some inspection profiles and features already require software processing, which is why mixed environments behave inconsistently.
Knowing how to disable offloading for np7 on fortigate at this level means accepting that every policy inherits the change.
A sensible sequence is to test globally on a lab unit first, measure throughput before and after, and only then apply to production during a maintenance window. Capture baseline numbers so you can quantify the impact rather than guess.
| Setting | Scope | Best used for | Action to take |
|---|---|---|---|
| Policy offload | Single policy | Targeted troubleshooting | Disable on one policy, clear sessions |
| Global acceleration | Whole device | Deep packet inspection needs | Lab-test first, measure throughput |
| Session clear | Active sessions | Forcing software rebuild | Clear only matching sessions |
| Capture on interface | Diagnostic | Verifying software path | Confirm packets now visible |
How to apply this: Record CPU and throughput baselines before any global change so you can prove the trade-off afterward.
Verify the Change and Confirm Traffic Is in Software
Verification is the step most admins skip, and it is why how to disable offloading for np7 on fortigate sometimes appears not to work. After changing settings, confirm that new sessions are no longer flagged as offloaded and that your capture tool now sees the full packet flow.
Start by clearing the relevant sessions, then generate test traffic and inspect session details again. If the offload flag is gone, the change took effect. If it persists, check whether another policy or a global setting is still permitting acceleration.
Packet capture on the FortiGate itself is a reliable confirmation method. Fortinet's FortiGate packet capture documentation covers the built-in sniffer, which is useful for confirming traffic now traverses the CPU path. A clean capture is the clearest proof that you truly know how to disable offloading for np7 on fortigate on your device.
- Clear sessions after the change, or old offloaded flows persist.
- Generate fresh test traffic from a known source.
- Re-run the session list and check the offload indicator.
- Compare capture output before and after.
How to apply this: Keep a before-and-after capture pair as evidence for your change record.
Weigh the Performance Trade-Offs Before You Commit
Disabling acceleration has real costs, and honest planning matters more than optimism here. Industry experience consistently shows that software processing reduces maximum throughput and raises CPU load, with the size of the impact varying widely by model, traffic profile, and feature set.
There is no single number that applies to every deployment, which is exactly why how to disable offloading for np7 on fortigate should always be paired with measurement.
The right approach is measurement. Baseline your device under normal load, apply the change in a controlled window, and compare. If CPU utilization climbs toward the range where you would expect degradation, consider narrowing the change to specific policies instead of the whole device.
Vendor guidance supports this caution. Fortinet's documentation on hardware acceleration states that acceleration is intended to preserve CPU resources for functions that require software processing, which is the underlying reason disabling it has a cost.
Consider a mid-size branch where an admin disabled acceleration globally to troubleshoot a routing issue, then found CPU load climbing during peak hours. Re-enabling it on all but one policy restored performance while keeping the needed visibility. That balanced outcome is often the realistic goal when you ask how to disable offloading for np7 on fortigate in production.
How to apply this: Set a CPU threshold in your monitoring tool and alert if it is crossed after the change.
Frequently Asked Questions About how to disable offloading for np7 on fortigate
Does disabling offloading survive a firmware upgrade?
Generally yes, configuration persists across upgrades, but FortiOS occasionally changes default behavior or renames options between major releases. After upgrading, re-check the policy and global settings rather than assuming they carried over unchanged. If you rely on how to disable offloading for np7 on fortigate for compliance or troubleshooting, add a post-upgrade verification step to your change checklist.
Why do some sessions still show as offloaded after my change?
Existing sessions built before the change remain in hardware until they expire or are cleared. This is expected behavior, not a failed configuration. Clear the matching sessions manually and generate fresh traffic to confirm. If new sessions still offload, another policy or a global setting is likely still permitting acceleration for that traffic path.
Sessions created before the change stay in hardware until they expire or are cleared, so plan for that when you learn how to disable offloading for NP7 on FortiGate.
To confirm the behavior, clear the matching sessions manually and generate new traffic, which shows how to disable offloading for NP7 on FortiGate in practice.
Can I disable offloading for only one application or subnet?
Yes, this is the preferred approach in most environments. Apply the change to the specific policy that matches the subnet or application you need to inspect, leaving other policies accelerated. This limits the performance cost to a narrow slice of traffic.
It is the safest way to handle how to disable offloading for np7 on fortigate when you only need visibility into one flow.
Does this affect SSL inspection or antivirus profiles?
Some security profiles already require software processing, so their behavior may not change. Others interact with acceleration in ways that vary by FortiOS version. Test with the actual profiles in use rather than assuming. Fortinet's release notes for your version are the authoritative source on which features require the CPU path.
Some security profiles already require software processing, so their behavior may not change when you learn how to disable offloading for NP7 on FortiGate.
Other profiles interact with acceleration in ways that vary by FortiOS version, so test with the actual profiles in use before deciding how to disable offloading for NP7 on FortiGate.
What is the fastest way to reverse the change if performance drops?
Re-enable the setting on the affected policy or restore the global option, then clear sessions so traffic rebuilds in hardware. Keep a written record of the exact commands or GUI paths you changed. Having that record turns a potential outage into a two-minute rollback, which is why change documentation matters as much as the configuration itself.
Re-enable the setting on the affected policy or restore the global option, then clear sessions so traffic rebuilds in hardware — the fastest way to reverse how to disable offloading for NP7 on FortiGate.
Conclusion
Disabling NP7 acceleration is a targeted troubleshooting technique, not a permanent default. Keep these points in mind:
- Policy-level changes are safer and more reversible than global ones.
- Existing sessions must be cleared before you can confirm the change.
- Measure throughput and CPU before and after, since impact varies by model and traffic.
- Document every change so rollback is fast.
The next step is simple: pick one policy carrying traffic you need to inspect, disable offload there, clear the sessions, and confirm with a capture. Once you have verified how to disable offloading for np7 on fortigate on a single policy, you can decide whether a broader change is ever justified for your environment.
