Hardware acceleration

NP6 diagnose commands and get command changes (288738)

You can use the get hardware npu np6 command to display information about the NP6 processors in your FortiGate and the sessions they are processing. This command contains a subset of the options available from the diagnose npu np6 command. The command syntax is:

get hardware npu np6 {dce <np6-id> | ipsec-stats | port-list | session-stats <np6-id> |

sse-stats <np6-id> | synproxy-stats}

<np6-id> identifies the NP6 processor. 0 is np6_0, 1 is np6_1 and so on. dce show NP6 non-zero sub-engine drop counters for the selected NP6. ipsec-stats show overall NP6 IPsec offloading statistics.

port-list show the mapping between the FortiGate’s physical ports and its NP6 processors.

session-stats show NP6 session offloading statistics counters for the selected NP6.

sse-stats show hardware session statistics counters.

synproxy-stats show overall NP6 synproxy statistics for TCP connections identified as being syn proxy DoS attacks.

 

NP6 session accounting enabled when traffic logging is enabled in a firewall policy (268426)

By default, on a FortiGate unit with NP6 processors, when you enable traffic logging in a firewall policy this also enables NP6 per-session accounting. If you disable traffic logging this also disables NP6 per-session accounting. This behavior can be changed using the following command:

config system np6 edit np6_0

set per-session-accounting {disable | all-enable | enable-by-log}

end

By default, per-session-accounting is set to enable-by-log, which results in per-session accounting being turned on when you enable traffic logging in a policy. You can disable per-session accounting or set all- enable to enable per-session accounting whether or not traffic logging is enabled. Note that this configuration is set separately for each NP6 processor.

When offloaded sessions appear on the FortiView All Sessions console they include an icon identifying them as

NP sessions:

You can hover over the NP icon to see some information about the offloaded sessions.

 

Determining why a session is not offloaded (245447)

You can use the diagnose sys session list command to get information about why a session has not been offloaded to an NP4 or NP6 processor.

If a session has not been offloaded the session information displayed by the command includes no_ofld_ reason followed by information to help you determine the cause. To take a simple example, an HTTPS session connecting to the GUI could have a field similar to no_ofld_reason: local. This means the session is a local session that is not offloaded.

The no_ofld_reason field only appears if the session is not offloaded and includes information to help determine why the session is not offloaded. For example,

no_ofld_reason: redir-to-av redir-to-ips non-npu-intf

Indicates that the session is not offloaded because it was redirected to virus scanning (redir-to-av), IPS (redir-to-ips), and so on.

IPsec pass-through traffic is now offloaded to NP6 processors (253221)

IPsec traffic that passes through a FortiGate without being unencrypted is now be offloaded to NP6 processors.

 

Disabling offloading IPsec Diffie-Hellman key exchange (269555)

You can use the following command to disable using ASIC offloading to accelerate IPsec Diffie-Hellman key exchange for IPsec ESP traffic. By default hardware offloading is used. For debugging purposes or other reasons you may want this function to be processed by software.

Use the following command to disable using ASIC offloading for IPsec Diffie Hellman key exchange:

config system global

set ipsec-asic-offload disable end

 

FortiGate–3700DX TP2 processors support GTP offloading (294212)

The FortiGate-3700DX contains two TP2 processors that provide GTP offloading. GTPu traffic is forwarded from NP6 processors to TP2 processors. The TP2 processors filter the encapsulated traffic and send the approved GTPu traffic back to the NP6.

 

FortiGate VM

You can reset FortiGate VMs to factory defaults without deleting the VM license (280471)

New command , execute factoryreset keepvmlicense, resets FortiGate VMs to factory defaults without deleting the VM license.

FortiGate VM Single Root I/O Virtualization (SR-IOV) support (275432)

SR-IOV is a specification that allows a PCIe device to be treated as multiple separate PCIe devices.This feature will enable better performance with Intel based servers across multiple VM platforms, including Citrix and AWS. In fact, AWS has optimized some instance types to take advantage of this feature.

 

VM License Check Time Extension (262494)

VM license check time has been extended from 24 hours to 5 days.

 

Integrate VMtools Into FortiGate-VM for VMware (248842)

The following VMtools sub set of features has been integrated into the FortiGate-VM for VMWare images:

• Start
• Stop
• Reboot
• IP state in vCenter

 

Firewall

 

Display change in Policy listing (284027)

Alias names for interfaces, if used now appear in the headings for the Interface Pair View or what used to be called the Section View.

 

RPC over HTTP traffic separate (288526)

How protocol options profiles and SSL inspection profiles handle RPC (Remote Procedure Calls) over HTTP traffic can now be configured separately from normal HTTP traffic.

 

CLI syntax changes

config firewall profile-protocol-options edit 0

set rpc-over-http {disable | enable}

end

 

config firewall ssl-ssh-profile edit deep-inspection

set rpc-over-http {disable | enable}

end

 

Disable Server Response Inspection supported (274458)

Disable Server Response Inspection (DSRI) option included in Firewall Policy (CLI only) to assist performance when only using URL filtering as it allows the system to ignore the http server responses.

CLI syntax for changing the status of the DSRI setting:

conf firewall policy|policy6 edit NNN

set dsri enable/disable end

conf firewall interface-policy|interface-policy6 edit NNN

set dsri enable/disable end

conf firewall sniffer edit NNN

set dsri enable/disable end

 

Policy counter improvements (277555 260743 172125)

• implicit deny policy counter added
• first-hit time tracked for each policy
• “Hit count” is tracked for each policy (total number of new sessions since last reset)
• Most counters now persist across reboots

 

Bidirectional Forwarding Detection (BFD) (247622)

Bidirectional Forwarding Detection (BFD) protocol support has been added to Protocol Independent Multicast (PIM), to detect failures between forwarding engines.

 

TCP sessions can be created without TCP syn flag checking (236078)

A Per-VDOM option is avaialble to enable or disable the creation of TCP sessions without TCP syn flag checking

 

Mirroring of traffic decrypted by SSL inspection (275458)

This feature sends a copy of traffic decrypted by SSL inspection to one or more FortiGate interfaces so that it can be collected by raw packet capture tool for archiving and analysis.

This feature is available if the inspection mode is set to flow-based. Use the following command to enable this feature in a policy. The following command sends all traffic decrypted by the policy to the FortiGate port1 and port2 interfaces.

conf firewall policy edit 1

set ssl-mirror enable/disable set ssl-mirror-intf port1 port2

next

 

Support for full cone NAT (269939)

Full cone NAT maps a public IP address and port to a LAN IP address and port. This means that a device on the Internet can send data to the internal LAN IP address and port number by directing it a the external IP address and port number. Sending to the correct IP address but a different port will cause the communication to fail. This type of NAT is also known as port forwarding.

Full cone NATing is configured only in the CLI. It is done by properly configuring an IP pool for the NATing of an external IP address. The two important settings are:

• set type – it must be set to port-block-allocation to use full cone
• set permit-any-host – enabling it is what enables full cone NAT An example fo the IP pool configuration would be:

config firewall ippool edit “full_cone-pool1”

set type port-block-allocation set startip 10.1.1.1

set endip 10.1.1.1

set permit-any-host enable end

 

Enable or disable inspecting IPv4 and IPv6 ICMP traffic (258734)

There is now a system setting that determines if ICMP traffic can pass through a Fortigate even if there is no existing sesson.

config sytem settings

set asymroute-icmp enable set asymroute6-imap enable

end

When feature enabled:

• Allows ICMP or ICMPv6 reply traffic can pass through firewall when there is no session existing – asmetric routing case.
• Prevents TCP ACK messages from passing through the firewall when there is no session existing.

 

When feature disabled:

Prevents ICMP or ICMPv6 replies from passing through firewall when there is no session existing.

Explicit web proxy

New explicit proxy firewall address types (284753)

New explicit proxy firewall address types improve granularity over header matching for explicit web proxy policies. You can enable this option using the Show in Address List button on the Address and Address Group New/Edit forms under Policy & Objects > Addresses.

The following new address types have been added:

• URL Pattern – destination address
• Host Regex Match – destination address
• URL Category – destination address (URL filtering)
• HTTP Method – source address
• User Agent – source address
• HTTP Header – source address
• Advanced (Source) – source address (combines User Agent, HTTP Method, and HTTP Header)
• Advanced (Destination) – destination address (combines Host Regex Match and URL Category)

 

Disclaimer messages can be added to explicit proxy policies (273208)

Disclaimer options are now available for each explicit proxy policy or split policy of ID-based policy. This feature allows you to create user exceptions for specific URL categories (including warning messages) based on user groups.

The Disclaimer Options are configured under Policy & Objects > Explicit Proxy Policy. You can also configure a disclaimer for each Authentication Rule by setting Action to Authenticate.