Fortinet FortiGate FortiGate-ASM-FB4 Instruction Manual

www.fortinet.com

FortiGate-ASM-FB4

Version 1.0

TECHNICAL NOTE

FortiGate-ASM-FB4 Technical Note

Version 1.0

2 October 2007

01-30005-0424-20071002

publication including text, examples, diagrams or illustrations may be

reproduced, transmitted, or translated in any form or by any means,

electronic, mechanical, manual, optical or otherwise, for any purpose,

without prior written permission of Fortinet, Inc.

Trademarks

Dynamic Threat Prevention System (DTPS), APSecure, FortiASIC,

FortiBIOS, FortiBridge, FortiClient, FortiGate, FortiGate Unified Threat

Management System, FortiGuard, FortiGuard-Antispam, FortiGuard-

Antivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiAnalyzer,

FortiManager, Fortinet, FortiOS, FortiPartner, FortiProtect, FortiReporter,

FortiResponse, FortiShield, FortiVoIP, and FortiWiFi are trademarks of

Fortinet, Inc. in the United States and/or other countries. The names of

actual companies and products mentioned herein may be the trademarks

of their respective owners.

Contents

FortiGate-ASM-FB4 Version 1.0 Technical Note

01-30005-0424-20071002 3

Contents

Introduction ........................................................................................ 5

About the FortiGate-ASM-FB4.......................................................................... 5

About this document......................................................................................... 5

Fortinet documentation .................................................................................... 6

Fortinet Tools and Documentation CD.......................................................... 6

Fortinet Knowledge Center .......................................................................... 6

Comments on Fortinet technical documentation .......................................... 6

Customer service and technical support ........................................................ 6

FortiGate-ASM-FB4 accelerated network processing .................... 7

Offloading requirements ................................................................................... 8

Exceptions to offloading requirements ........................................................... 9

IPSec offloading requirements ...................................................................... 9

HA active-active offloading requirements.................................................... 10

FortiGate-ASM-FB4 hardware ......................................................... 11

Installation and removal.................................................................................. 11

To install SFP transceivers .................................................................... 11

To install a FortiGate-ASM-FB4 module................................................ 11

To remove a FortiGate-ASM-FB4 module ............................................. 12

SFP network interfaces ................................................................................... 12

Specialized CLI settings .................................................................. 13

config system interface................................................................................... 13

Syntax ......................................................................................................... 13

Example ...................................................................................................... 15

config system npu ........................................................................................... 15

Syntax ......................................................................................................... 15

Example ...................................................................................................... 16

Examples .......................................................................................... 17

Accelerated tunnel mode IPSec ..................................................................... 18

To configure hardware accelerated tunnel mode IPSec........................ 18

Accelerated interface mode IPSec ................................................................. 19

To configure hardware accelerated interface mode IPSec.................... 19

Index.................................................................................................. 21

FortiGate-ASM-FB4 Version 1.0 Technical Note

401-30005-0424-20071002

Contents

Introduction About the FortiGate-ASM-FB4

FortiGate-ASM-FB4 Version 1.0 Technical Note

01-30005-0424-20071002 5

Introduction

This chapter introduces you to the FortiGate-ASM-FB4 and the following topics:

•About the FortiGate-ASM-FB4

•About this document

•Fortinet documentation

•Customer service and technical support

About the FortiGate-ASM-FB4

When installed in a compatible FortiGate unit’s AMC (Advanced Mezzanine Card)

slot, FortiGate-ASM-FB4 modules provide additional hardware accelerated

network processing for certain eligible traffic types passing through their SFP

(small form-factor pluggable) network interfaces. This additional processing

resource frees FortiGate units’ main processing resources for other tasks,

improving network performance.

FortiGate-ASM-FB4 modules can improve network throughput for:

• traffic with small packets, such as VoIP

• latency-sensitive traffic, such as streaming multimedia

• traffic with long session lifetimes, such as FTP

• IPSec VPN traffic

• active-active HA load-balanced traffic

• P2P traffic

Eligible traffic processing is offloaded to the FortiGate-ASM-FB4 module. This fast

path processing leverages the additional hardware acceleration resources

provided by the FortiGate-ASM-FB4 module.

Ineligible traffic processing is processed normally. Normal processing by the

FortiGate unit’s main processing resources (CPU, RAM, and FortiASIC content

processor) can include some FortiASIC hardware accelerated processing, but

does not utilize the additional hardware acceleration resources provided by the

FortiGate-ASM-FB4 module.

About this document

This document explains how to install and configure FortiGate-ASM-FB4

modules. It also contains example IPSec configurations involving a FortiGate unit

with a FortiGate-ASM-FB4 module.

This document contains the following chapters:

•FortiGate-ASM-FB4 accelerated network processing describes packet

processing differences for the FortiGate-ASM-FB4 accelerated network

processing path.

FortiGate-ASM-FB4 Version 1.0 Technical Note

601-30005-0424-20071002

Fortinet documentation Introduction

•FortiGate-ASM-FB4 hardware describes FortiGate-ASM-FB4 module features,

installation and removal.

•Specialized CLI settings describes configuration options in the CLI that

become available when a FortiGate-ASM-FB4 module is installed in a

FortiGate unit.

•Examples contains hardware accelerated sample configurations and network

topologies.

Fortinet documentation

The most up-to-date publications and previous releases of Fortinet product

documentation are available from the Fortinet Technical Documentation web site

at http://docs.forticare.com.

Fortinet Tools and Documentation CD

All Fortinet documentation is available on the Fortinet Tools and Documentation

CD shipped with your Fortinet product. The documents on this CD are current at

shipping time. For up-to-date versions of Fortinet documentation, see the Fortinet

Technical Documentation web site at http://docs.forticare.com.

Fortinet Knowledge Center

Additional Fortinet technical documentation is available from the Fortinet

Knowledge Center. The knowledge center contains troubleshooting and how-to

articles, FAQs, technical notes, and more. Visit the Fortinet Knowledge Center at

http://kc.forticare.com.

Comments on Fortinet technical documentation

Please send information about any errors or omissions in this document, or any

Fortinet technical documentation, to [email protected].

Customer service and technical support

Fortinet Technical Support provides services designed to make sure that your

Fortinet systems install quickly, configure easily, and operate reliably in your

network.

Please visit the Fortinet Technical Support web site at http://support.fortinet.com

to learn about the technical support services that Fortinet provides.

FortiGate-ASM-FB4 accelerated network processing

FortiGate-ASM-FB4 Version 1.0 Technical Note

01-30005-0424-20071002 7

FortiGate-ASM-FB4 accelerated

network processing

FortiGate units can offload some types of network traffic processing from main

processing resources to a FortiGate-ASM-FB4 module, which contains

specialized network processing hardware. If your network contains a significant

volume of traffic that is suitable for offloading, FortiGate-ASM-FB4 module

hardware acceleration can significantly improve your network throughput.

Hardware acceleration generally alters packet processing flow as follows:

1Packets initiating a session pass to the FortiGate unit’s main processing

resources.

2The FortiGate unit assesses whether the session matches fast path (offload)

requirements.

To be suitable for offloading, traffic must possess only characteristics processable

by the fast path. For a list of requirements, see “Offloading requirements” on

page 8.

If the traffic is categorized as fast path friendly, the FortiGate unit sends the

session key or IPSec security association (SA) and configured processing action

to the FortiGate-ASM-FB4 module.

3The FortiGate-ASM-FB4 module continuously matches packets arriving on its

network interfaces against the session keys and SAs it has received from the

FortiGate unit.

• If a FortiGate-ASM-FB4 module’s network interface is configured to perform

hardware accelerated anomaly checks, the FortiGate-ASM-FB4 module drops

or accepts packets which match the configured anomaly patterns. These

checks are separate from anomaly checks performed by IPS, which is not

compatible with FortiGate-ASM-FB4 module offloading. For details, see

“config system interface” on page 13.

• The FortiGate-ASM-FB4 module next checks for a matching session key or

SA. If a matching session key or SA is found, and if the packet meets packet

requirements, the FortiGate-ASM-FB4 module processes the packet

according to the configured action and then sends the resulting packet. Packet

processing is hardware accelerated.

• If a matching session key or SA is not found, or if the packet does not meet

packet requirements, the traffic cannot be offloaded. The FortiGate-ASM-FB4

module sends the data to the FortiGate unit’s main processing resources,

which process the packet. Packet processing is similar to normal network

interfaces (that is, packet processing is not hardware accelerated by the

FortiGate-ASM-FB4 module, and requires main processing resources). Packet

forwarding occurs at normal rates.

FortiGate-ASM-FB4 Version 1.0 Technical Note

801-30005-0424-20071002

Offloading requirements FortiGate-ASM-FB4 accelerated network processing

Some traffic processing can still be hardware accelerated, even though it does not

meet general offloading requirements. For example, some IPSec traffic originates

from the FortiGate unit itself and does not follow the offloading requirement of

ingress from a FortiGate-ASM-FB4 module network interface, but FortiGate units

can still utilize FortiGate-ASM-FB4 module encryption capabilities. For information

on exceptions, see “Exceptions to offloading requirements” on page 9.

Packet forwarding rates vary by the percentage of offloadable processing and the

type of network processing required by your configuration, but are independent of

frame size. For optimal traffic types, network throughput can equal wire speed.

This section includes the following topics:

•Offloading requirements

•Exceptions to offloading requirements

Offloading requirements

Offloading traffic to the FortiGate-ASM-FB4 module requires that the FortiGate

unit configuration and the traffic itself is suited to hardware acceleration.

Sessions must be fast path ready. Fast path ready session characteristics are:

• Layer 2 type/length must be 0x0800 (IEEE 802.1q VLAN specification is

supported); link aggregation between FortiGate-ASM-FB4 module network

interfaces may be used (IEEE 802.3ad specification is supported)

• Layer 3 protocol must beIPv4

• Layer 4 protocol must be UDP, TCP or ICMP

• Layer 3 / Layer 4 header or content modification must not require a session

helper (for example, SNAT, DNAT, and TTL reduction are supported, but

application layer content modification is not supported)

• FortiGate unit firewall policy must not require antivirus or IPS inspection

• origin must not be local host (the FortiGate unit)

• ingress and egress network interfaces are both located on the same FortiGate-

ASM-FB4 module

If a session is not fast path ready, the FortiGate unit will not send the session key

to the FortiGate-ASM-FB4 module. Without the session key, all session key

lookup for incoming packets of that session fails, causing all session packets to be

sent to the FortiGate unit’s main processing resources, and processed at normal

speeds.

If a session is fast path ready, the FortiGate unit will send the session key to the

FortiGate-ASM-FB4 module. Session key lookup then succeeds for subsequent

packets from the known session. Packets within the session must then also meet

packet requirements.

• Incoming packets must not be fragmented.

Note: If you disable anomaly checks by Intrusion Prevention (IPS), you can still enable

hardware accelerated anomaly checks. For details, see “config system interface” on

page 13.

FortiGate-ASM-FB4 accelerated network processing Exceptions to offloading requirements

FortiGate-ASM-FB4 Version 1.0 Technical Note

01-30005-0424-20071002 9

• Outgoing packets must not require fragmentation to a size less than 385 bytes.

Because of this requirement, the configured MTU for the FortiGate-ASM-FB4

module’s network interfaces must also meet or exceed the FortiGate-ASM-

FB4-supported minimum MTU of 385 bytes.

If packet requirements are not met, an individual packet will use FortiGate unit

main processing resources, regardless of whether other packets in the session

are offloaded to the FortiGate-ASM-FB4 module.

In some cases, due to these requirements, a protocol’s session(s) may receive a

mixture of offloaded and non-offloaded processing.

For example, FTP uses two connections: a control connection and a data

connection. The control connection requires a session helper, and cannot be

offloaded, but the data connection does not require a session helper, and can be

offloaded. Within the offloadable data session, fragmented packets will not be

offloaded, but other packets will be offloaded.

Exceptions to offloading requirements

Some traffic types differ from general offloading requirements, but still utilize

FortiGate-ASM-FB4 modules’ encryption and other capabilities. Exceptions

include IPSec traffic and active-active high availability (HA) load balanced traffic.

IPSec offloading requirements

FortiGate-ASM-FB4 modules contain features to improve IPSec tunnel

performance. For example, FortiGate-ASM-FB4 modules can encrypt and decrypt

packets, reducing cryptographic load on the FortiGate unit’s main processing

resources.

Requirements for hardware accelerated IPSec encryption or decryption are a

modification of general offloading requirements. Differing characteristics are:

• origin can be local host (the FortiGate unit)

• in Phase 1 configuration, Local Gateway IP must be specified as an IP

address of a network interface on the FortiGate-ASM-FB4 module

• SA must have been received by the FortiGate-ASM-FB4 module

• in Phase 2 configuration:

• encryption algorithm must be DES, 3DES, AES-128, AES-192, AES-256,

or null

• authentication must be MD5, SHA1, or null

• if encryption is null, authentication must not also be null

• if replay detection is enabled, enc-offload-antireplay must also be

enable in the CLI

Note: If replay detection is enabled in the Phase 2 configuration, you can enable or disable

IPSec encryption and decryption offloading from the CLI. Performance varies by those CLI

options and the percentage of packets requiring encryption or decryption. For details, see

“config system npu” on page 15.

FortiGate-ASM-FB4 Version 1.0 Technical Note

10 01-30005-0424-20071002

Exceptions to offloading requirements FortiGate-ASM-FB4 accelerated network processing

To apply hardware accelerated encryption and decryption, the FortiGate unit must

first perform Phase 1 negotiations to establish the security association (SA). The

SA includes cryptographic processing instructions required by the FortiGate-ASM-

FB4 module, such as which encryption algorithms must be applied to the tunnel.

After ISAKMP negotiations, the FortiGate unit sends the SA to the FortiGate-

ASM-FB4 module, enabling the FortiGate-ASM-FB4 module to apply the

negotiated hardware accelerated encryption or decryption to tunnel traffic.

Possible accelerated cryptographic paths are:

• IPSec decryption offload

• Ingress ESP packet > Offloaded decryption > Decrypted packet egress

(fast path)

• Ingress ESP packet > Offloaded decryption > Decrypted packet to

FortiGate unit

• IPSec encryption offload

• Ingress packet > Offloaded encryption > Encrypted (ESP) packet egress

(fast path)

• Packet from FortiGate unit > Offloaded encryption > Encrypted (ESP)

packet egress

HA active-active offloading requirements

FortiGate-ASM-FB4 modules can improve network performance in active-active

(load balancing) high availability (HA) configurations, even though traffic deviates

from general offloading patterns, involving more than one FortiGate-ASM-FB4

module, each in a separate FortiGate unit. No additional offloading requirements

apply.

Once the primary FortiGate unit sends a session key to its FortiGate-ASM-FB4

module, the FortiGate-ASM-FB4 module on the primary unit can redirect any

subsequent session traffic to other cluster members, reducing traffic redirection

load on the primary unit’s main processing resources.

As subordinate units receive redirected traffic, each FortiGate-ASM-FB4 module

in the cluster assesses and processes session offloading independently. Session

key states are not part of synchronization traffic between HA members.

For more information about active-active HA load balancing, see the FortiGate HA

Overview.

Other manuals for FortiGate FortiGate-ASM-FB4

Table of contents

Other Fortinet Network Hardware manuals

Fortinet

Fortinet FortiMonitor 100F User manual

Fortinet

Fortinet FortiBridge-2001F User manual

Fortinet

Fortinet FortiGate ASM-S08 User manual

Fortinet

Fortinet FortiGate-5000 Reference manual

Fortinet

Fortinet FortiAuthenticator 3000F User manual

Fortinet

Fortinet FortiDB-400B User manual

Fortinet

Fortinet FortiGate-7000F Series Parts list manual

Fortinet

Fortinet FortiGate 2600F-DC User manual

Fortinet

Fortinet FortiAP 431F User manual

Fortinet

Fortinet FortiLog-400 User manual

Fortinet

Fortinet FortiMail 3000F User manual

Fortinet

Fortinet FortiGate FortiGate-1000A User manual

Fortinet

Fortinet FortiGate 100F Series User manual

Fortinet

Fortinet FortiSwitch 224E Series User manual

Fortinet

Fortinet FortiRecorder 7.0.0 Instruction Manual

Fortinet

Fortinet 3000B User manual

Fortinet

Fortinet FortiGate 400F Series User manual

Fortinet

Fortinet FortiWeb High-End Series User manual

Fortinet

Fortinet FortiToken-400 User manual

Fortinet

Fortinet FortiNAC-CA-500F User manual

Fortinet

Fortinet FortiManager 1000C User manual

Fortinet

Fortinet FortiSIEM FSM-500G User manual

Fortinet

Fortinet FortiManager 400G User manual

Fortinet

Fortinet FortiLog-100 Instruction Manual

Popular Network Hardware manuals by other brands

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL product manual

B&B Electronics

B&B Electronics ZXT9-IO-222R2 product manual

Yudor

Yudor YDS-16 user manual

D-Link

D-Link ShareCenter DNS-320L datasheet

Samsung

Samsung ES1642dc Hardware user manual

Honeywell Home

Honeywell Home LTEM-PV Installation and setup guide

evertz

evertz 7700 Series manual

D-Link

D-Link ShareCenter DNS-343 Quick installation guide

Asante

Asante AsanteBridge 1012 user guide

FireBrick

FireBrick FB2700 user manual

Audiovox Electronics

Audiovox Electronics ARWH2T user manual

ADC

ADC DSX-1 Operational Procedures Guide

NetComm

NetComm NF2 user guide

Alcatel-Lucent

Alcatel-Lucent 5620 user guide

Dell EMC

Dell EMC XC6420 Series Solution guide

Lanner

Lanner NCA-1020A user manual

Allied Telesis

Allied Telesis AT-TN121-A Specifications

Arista

Arista CCA-ETM-Q12 quick start guide