Using the diagnose sys session/session6 list command

Leave a reply

Using the diagnose sys session/session6 list command

The diagnose sys session list and diagnose sys session6 list commands list all of the current IPv4 or IPv6 sessions being processed by the FortiGate. For each session the command output includes an npu info line that displays NPx offloading information for the session. If a session is not offloaded the command output includes a no_ofld_reason line that indicates why the session was not offloaded.

 

Displaying NP6 offloading information for a session

The npu info line of the diagnose sys session list command includes information about the offloaded session that indicates the type of processor and whether its IPsec or regular traffic:

  • offload=1/1 for NP1(FA1) sessions. l  offload=2/2 for NP1(FA2) sessions. l  offload=3/3 for NP2 sessions.
  • offload=4/4 for NP4 sessions.
  • offload=5/5 for XLR sessions.
  • offload=6/6 for Nplite/NP4lite sessions.
  • offload=7/7 for XLP sessions.
  • offload=8/8 for NP6 sessions.
  • flag 0x81 means regular traffic.
  • flag 0x82 means IPsec traffic.

Example offloaded IPv4 NP6 session

The following session output by the diagnose sys session list command shows an offloaded session. The information in the npu info line shows this is a regular session (flag=0x81/0x81) that is offloaded by an NP6 processor (offload=8/8).

diagnose sys session list

session info: proto=6 proto_state=01 duration=4599 expire=2753 timeout=3600 flag- s=00000000 sockflag=00000000 sockport=0 av_idx=0 use=3

origin-shaper= reply-shaper= per_ip_shaper=

ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255 state=log may_dirty npu none log-start

statistic(bytes/packets/allow_err): org=1549/20/1 reply=1090/15/1 tuples=2 speed(Bps/kbps): 0/0

orgin->sink: org pre->post, reply pre->post dev=15->17/17->15 gwy=172.20.121.2/5.5.5.33

hook=post dir=org act=snat 5.5.5.33:60656->91.190.218.66:12350 (172.20.121.135:60656)

hook=pre dir=reply act=dnat 91.190.218.66:12350->172.20.121.135:60656 (5.5.5.33:60656)

pos/(before,after) 0/(0,0), 0/(0,0)

src_mac=98:90:96:af:89:b9

misc=0 policy_id=1 auth_info=0 chk_client_info=0 vd=0 serial=00058b9c tos=ff/ff app_list=0 app=0 url_cat=0

dd_type=0 dd_mode=0 npu_state=0x000c00

npu info: flag=0x81/0x81, offload=8/8, ips_offload=0/0, epid=140/138, ipid=138/140, vlan=0x0000/0x0000

vlifid=138/140, vtag_in=0x0000/0x0000 in_npu=1/1, out_npu=1/1, fwd_en=0/0, qid=0/2

 

Example IPv4 session that is not offloaded

The following session, output by the diagnose sys session list command includes the no_ofld_reason line that indicates that the session was not offloaded because it is a local-in session.

session info: proto=6 proto_state=01 duration=19 expire=3597 timeout=3600 flags=00000000 sockflag=00000000 sockport=0 av_idx=0 use=3

origin-shaper= reply-shaper= per_ip_shaper=

ha_id=0 policy_dir=0 tunnel=/ vlan_cos=8/8 state=local may_dirty

statistic(bytes/packets/allow_err): org=6338/15/1 reply=7129/12/1 tuples=2 speed(Bps/kbps): 680/5

orgin->sink: org pre->in, reply out->post dev=15->50/50->15 gwy=5.5.5.5/0.0.0.0 hook=pre dir=org act=noop 5.5.5.33:60567->5.5.5.5:443(0.0.0.0:0)

hook=post dir=reply act=noop 5.5.5.5:443->5.5.5.33:60567(0.0.0.0:0)

pos/(before,after) 0/(0,0), 0/(0,0)

src_mac=98:90:96:af:89:b9

misc=0 policy_id=0 auth_info=0 chk_client_info=0 vd=0 serial=000645d8 tos=ff/ff app_list=0 app=0 url_cat=0 dd_type=0 dd_mode=0

npu_state=00000000

no_ofld_reason:  local

 

Example IPv4 IPsec NP6 session

diagnose sys session list

session info: proto=6 proto_state=01 duration=34 expire=3565 timeout=3600 flag- s=00000000 sockflag=00000000 sockport=0 av_idx=0 use=3

origin-shaper= reply-shaper= per_ip_shaper=

ha_id=0 policy_dir=0 tunnel=/p1-vdom2 state=re may_dirty npu

statistic(bytes/packets/allow_err): org=112/2/1 reply=112/2/1 tuples=2 orgin->sink: org pre->post, reply pre->post dev=57->7/7->57 gwy- y=10.1.100.11/11.11.11.1

hook=pre dir=org act=noop 172.16.200.55:35254->10.1.100.11:80(0.0.0.0:0) hook=post dir=reply act=noop 10.1.100.11:80->172.16.200.55:35254(0.0.0.0:0) pos/(before,after) 0/(0,0), 0/(0,0)

misc=0 policy_id=1 id_policy_id=0 auth_info=0 chk_client_info=0 vd=4 serial=00002d29 tos=ff/ff ips_view=0 app_list=0 app=0

dd_type=0 dd_mode=0

per_ip_bandwidth meter: addr=172.16.200.55, bps=260 npu_state=00000000

npu info: flag=0x81/0x82, offload=8/8, ips_offload=0/0, epid=1/3, ipid=3/1, vlan- n=32779/0

 

Example IPv6 NP6 session

diagnose sys session6 list

session6 info: proto=6 proto_state=01 duration=2 expire=3597 timeout=3600 flag- s=00000000 sockport=0 sockflag=0 use=3

origin-shaper= reply-shaper= per_ip_shaper= ha_id=0

policy_dir=0 tunnel=/

state=may_dirty npu

statistic(bytes/packets/allow_err): org=152/2/0 reply=152/2/0 tuples=2 speed(Bps/kbps): 0/0

orgin->sink: org pre->post, reply pre->post dev=13->14/14->13

hook=pre dir=org act=noop 2000:172:16:200::55:59145 ->2000:10:1:100::11:80(:::0) hook=post dir=reply act=noop 2000:10:1:100::11:80 ->2000:172:16:200::55:59145 (:::0)

misc=0 policy_id=1 auth_info=0 chk_client_info=0 vd=0 serial=0000027a npu_state=0x000c00

npu info: flag=0x81/0x81, offload=8/8, ips_offload=0/0, epid=137/136, ipid- d=136/137, vlan=0/0

 

Example NAT46 NP6 session

diagnose sys session list

session info: proto=6 proto_state=01 duration=19 expire=3580 timeout=3600 flag- s=00000000 sockflag=00000000 sockport=0 av_idx=0 use=3

origin-shaper= reply-shaper= per_ip_shaper=

ha_id=0 policy_dir=0 tunnel=/

state=npu nlb

statistic(bytes/packets/allow_err): org=112/2/1 reply=112/2/1 tuples=2 speed(Bps/kbps): 0/0

orgin->sink: org nataf->post, reply pre->org dev=52->14/14->52 gwy- y=0.0.0.0/10.1.100.1

hook=5 dir=org act=noop 10.1.100.1:21937->10.1.100.11:80(0.0.0.0:0)

hook=6 dir=reply act=noop 10.1.100.11:80->10.1.100.1:21937(0.0.0.0:0)

hook=pre dir=org act=noop 2000:172:16:200::55:33945 ->64:ff9b::a01:640b:80(:::0) hook=post dir=reply act=noop 64:ff9b::a01:640b:80 ->2000:172:16:200::55:33945 (:::0)

pos/(before,after) 0/(0,0), 0/(0,0)

misc=0 policy_id=1 auth_info=0 chk_client_info=0 vd=0 serial=04051aae tos=ff/ff ips_view=0 app_list=0 app=0 dd_type=0 dd_mode=0

npu_state=00000000

npu info: flag=0x81/0x00, offload=0/8, ips_offload=0/0, epid=0/136, ipid=0/137, vlan=0/0

 

Example NAT64 NP6 session

diagnose sys session6 list

session6 info: proto=6 proto_state=01 duration=36 expire=3563 timeout=3600 flag- s=00000000 sockport=0 sockflag=0 use=3

origin-shaper= reply-shaper= per_ip_shaper= ha_id=0

policy_dir=0 tunnel=/

state=may_dirty npu nlb

statistic(bytes/packets/allow_err): org=72/1/0 reply=152/2/0 tuples=2 speed(Bps/kbps): 0/0

orgin->sink: org pre->org, reply nataf->post dev=13->14/14->13

hook=pre dir=org act=noop 2000:172:16:200::55:33945 ->64:ff9b::a01:640b:80(:::0) hook=post dir=reply act=noop 64:ff9b::a01:640b:80 ->2000:172:16:200::55:33945 (:::0)

hook=5 dir=org act=noop 10.1.100.1:21937->10.1.100.11:80(0.0.0.0:0) hook=6 dir=reply act=noop 10.1.100.11:80->10.1.100.1:21937(0.0.0.0:0) misc=0 policy_id=1 auth_info=0 chk_client_info=0 vd=0 serial=0000027b npu_state=00000000

npu info: flag=0x00/0x81, offload=8/0, ips_offload=0/0, epid=137/0, ipid=136/0, vlan=0/0

 

This entry was posted in FortiOS 5.4 Handbook and tagged , on by .

About Mike

Michael Pruett, CISSP has a wide range of cyber-security and network engineering expertise. The plethora of vendors that resell hardware but have zero engineering knowledge resulting in the wrong hardware or configuration being deployed is a major pet peeve of Michael's. This site was started in an effort to spread information while providing the option of quality consulting services at a much lower price than Fortinet Professional Services. Owns PacketLlama.Com (Fortinet Hardware Sales) and Office Of The CISO, LLC (Cybersecurity consulting firm).

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.