Fortinet FortiGate FortiGate-ASM-FB4 Instruction Manual

www.fortinet.com
FortiGate-ASM-FB4
Version 1.0
TECHNICAL NOTE

FortiGate-ASM-FB4 Technical Note
Version 1.0
2 October 2007
01-30005-0424-20071002
© Copyright 2007 Fortinet, Inc. All rights reserved. No part of this
publication including text, examples, diagrams or illustrations may be
reproduced, transmitted, or translated in any form or by any means,
electronic, mechanical, manual, optical or otherwise, for any purpose,
without prior written permission of Fortinet, Inc.
Trademarks
Dynamic Threat Prevention System (DTPS), APSecure, FortiASIC,
FortiBIOS, FortiBridge, FortiClient, FortiGate, FortiGate Unified Threat
Management System, FortiGuard, FortiGuard-Antispam, FortiGuard-
Antivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiAnalyzer,
FortiManager, Fortinet, FortiOS, FortiPartner, FortiProtect, FortiReporter,
FortiResponse, FortiShield, FortiVoIP, and FortiWiFi are trademarks of
Fortinet, Inc. in the United States and/or other countries. The names of
actual companies and products mentioned herein may be the trademarks
of their respective owners.

Contents
FortiGate-ASM-FB4 Version 1.0 Technical Note
01-30005-0424-20071002 3
Contents
Introduction ........................................................................................ 5
About the FortiGate-ASM-FB4.......................................................................... 5
About this document......................................................................................... 5
Fortinet documentation .................................................................................... 6
Fortinet Tools and Documentation CD.......................................................... 6
Fortinet Knowledge Center .......................................................................... 6
Comments on Fortinet technical documentation .......................................... 6
Customer service and technical support ........................................................ 6
FortiGate-ASM-FB4 accelerated network processing .................... 7
Offloading requirements ................................................................................... 8
Exceptions to offloading requirements ........................................................... 9
IPSec offloading requirements ...................................................................... 9
HA active-active offloading requirements.................................................... 10
FortiGate-ASM-FB4 hardware ......................................................... 11
Installation and removal.................................................................................. 11
To install SFP transceivers .................................................................... 11
To install a FortiGate-ASM-FB4 module................................................ 11
To remove a FortiGate-ASM-FB4 module ............................................. 12
SFP network interfaces ................................................................................... 12
Specialized CLI settings .................................................................. 13
config system interface................................................................................... 13
Syntax ......................................................................................................... 13
Example ...................................................................................................... 15
config system npu ........................................................................................... 15
Syntax ......................................................................................................... 15
Example ...................................................................................................... 16
Examples .......................................................................................... 17
Accelerated tunnel mode IPSec ..................................................................... 18
To configure hardware accelerated tunnel mode IPSec........................ 18
Accelerated interface mode IPSec ................................................................. 19
To configure hardware accelerated interface mode IPSec.................... 19
Index.................................................................................................. 21

FortiGate-ASM-FB4 Version 1.0 Technical Note
401-30005-0424-20071002
Contents

Introduction About the FortiGate-ASM-FB4
FortiGate-ASM-FB4 Version 1.0 Technical Note
01-30005-0424-20071002 5
Introduction
This chapter introduces you to the FortiGate-ASM-FB4 and the following topics:
•About the FortiGate-ASM-FB4
•About this document
•Fortinet documentation
•Customer service and technical support
About the FortiGate-ASM-FB4
When installed in a compatible FortiGate unit’s AMC (Advanced Mezzanine Card)
slot, FortiGate-ASM-FB4 modules provide additional hardware accelerated
network processing for certain eligible traffic types passing through their SFP
(small form-factor pluggable) network interfaces. This additional processing
resource frees FortiGate units’ main processing resources for other tasks,
improving network performance.
FortiGate-ASM-FB4 modules can improve network throughput for:
• traffic with small packets, such as VoIP
• latency-sensitive traffic, such as streaming multimedia
• traffic with long session lifetimes, such as FTP
• IPSec VPN traffic
• active-active HA load-balanced traffic
• P2P traffic
Eligible traffic processing is offloaded to the FortiGate-ASM-FB4 module. This fast
path processing leverages the additional hardware acceleration resources
provided by the FortiGate-ASM-FB4 module.
Ineligible traffic processing is processed normally. Normal processing by the
FortiGate unit’s main processing resources (CPU, RAM, and FortiASIC content
processor) can include some FortiASIC hardware accelerated processing, but
does not utilize the additional hardware acceleration resources provided by the
FortiGate-ASM-FB4 module.
About this document
This document explains how to install and configure FortiGate-ASM-FB4
modules. It also contains example IPSec configurations involving a FortiGate unit
with a FortiGate-ASM-FB4 module.
This document contains the following chapters:
•FortiGate-ASM-FB4 accelerated network processing describes packet
processing differences for the FortiGate-ASM-FB4 accelerated network
processing path.

FortiGate-ASM-FB4 Version 1.0 Technical Note
601-30005-0424-20071002
Fortinet documentation Introduction
•FortiGate-ASM-FB4 hardware describes FortiGate-ASM-FB4 module features,
installation and removal.
•Specialized CLI settings describes configuration options in the CLI that
become available when a FortiGate-ASM-FB4 module is installed in a
FortiGate unit.
•Examples contains hardware accelerated sample configurations and network
topologies.
Fortinet documentation
The most up-to-date publications and previous releases of Fortinet product
documentation are available from the Fortinet Technical Documentation web site
at http://docs.forticare.com.
Fortinet Tools and Documentation CD
All Fortinet documentation is available on the Fortinet Tools and Documentation
CD shipped with your Fortinet product. The documents on this CD are current at
shipping time. For up-to-date versions of Fortinet documentation, see the Fortinet
Technical Documentation web site at http://docs.forticare.com.
Fortinet Knowledge Center
Additional Fortinet technical documentation is available from the Fortinet
Knowledge Center. The knowledge center contains troubleshooting and how-to
articles, FAQs, technical notes, and more. Visit the Fortinet Knowledge Center at
http://kc.forticare.com.
Comments on Fortinet technical documentation
Please send information about any errors or omissions in this document, or any
Fortinet technical documentation, to [email protected].
Customer service and technical support
Fortinet Technical Support provides services designed to make sure that your
Fortinet systems install quickly, configure easily, and operate reliably in your
network.
Please visit the Fortinet Technical Support web site at http://support.fortinet.com
to learn about the technical support services that Fortinet provides.

FortiGate-ASM-FB4 accelerated network processing
FortiGate-ASM-FB4 Version 1.0 Technical Note
01-30005-0424-20071002 7
FortiGate-ASM-FB4 accelerated
network processing
FortiGate units can offload some types of network traffic processing from main
processing resources to a FortiGate-ASM-FB4 module, which contains
specialized network processing hardware. If your network contains a significant
volume of traffic that is suitable for offloading, FortiGate-ASM-FB4 module
hardware acceleration can significantly improve your network throughput.
Hardware acceleration generally alters packet processing flow as follows:
1Packets initiating a session pass to the FortiGate unit’s main processing
resources.
2The FortiGate unit assesses whether the session matches fast path (offload)
requirements.
To be suitable for offloading, traffic must possess only characteristics processable
by the fast path. For a list of requirements, see “Offloading requirements” on
page 8.
If the traffic is categorized as fast path friendly, the FortiGate unit sends the
session key or IPSec security association (SA) and configured processing action
to the FortiGate-ASM-FB4 module.
3The FortiGate-ASM-FB4 module continuously matches packets arriving on its
network interfaces against the session keys and SAs it has received from the
FortiGate unit.
• If a FortiGate-ASM-FB4 module’s network interface is configured to perform
hardware accelerated anomaly checks, the FortiGate-ASM-FB4 module drops
or accepts packets which match the configured anomaly patterns. These
checks are separate from anomaly checks performed by IPS, which is not
compatible with FortiGate-ASM-FB4 module offloading. For details, see
“config system interface” on page 13.
• The FortiGate-ASM-FB4 module next checks for a matching session key or
SA. If a matching session key or SA is found, and if the packet meets packet
requirements, the FortiGate-ASM-FB4 module processes the packet
according to the configured action and then sends the resulting packet. Packet
processing is hardware accelerated.
• If a matching session key or SA is not found, or if the packet does not meet
packet requirements, the traffic cannot be offloaded. The FortiGate-ASM-FB4
module sends the data to the FortiGate unit’s main processing resources,
which process the packet. Packet processing is similar to normal network
interfaces (that is, packet processing is not hardware accelerated by the
FortiGate-ASM-FB4 module, and requires main processing resources). Packet
forwarding occurs at normal rates.

FortiGate-ASM-FB4 Version 1.0 Technical Note
801-30005-0424-20071002
Offloading requirements FortiGate-ASM-FB4 accelerated network processing
Some traffic processing can still be hardware accelerated, even though it does not
meet general offloading requirements. For example, some IPSec traffic originates
from the FortiGate unit itself and does not follow the offloading requirement of
ingress from a FortiGate-ASM-FB4 module network interface, but FortiGate units
can still utilize FortiGate-ASM-FB4 module encryption capabilities. For information
on exceptions, see “Exceptions to offloading requirements” on page 9.
Packet forwarding rates vary by the percentage of offloadable processing and the
type of network processing required by your configuration, but are independent of
frame size. For optimal traffic types, network throughput can equal wire speed.
This section includes the following topics:
•Offloading requirements
•Exceptions to offloading requirements
Offloading requirements
Offloading traffic to the FortiGate-ASM-FB4 module requires that the FortiGate
unit configuration and the traffic itself is suited to hardware acceleration.
Sessions must be fast path ready. Fast path ready session characteristics are:
• Layer 2 type/length must be 0x0800 (IEEE 802.1q VLAN specification is
supported); link aggregation between FortiGate-ASM-FB4 module network
interfaces may be used (IEEE 802.3ad specification is supported)
• Layer 3 protocol must beIPv4
• Layer 4 protocol must be UDP, TCP or ICMP
• Layer 3 / Layer 4 header or content modification must not require a session
helper (for example, SNAT, DNAT, and TTL reduction are supported, but
application layer content modification is not supported)
• FortiGate unit firewall policy must not require antivirus or IPS inspection
• origin must not be local host (the FortiGate unit)
• ingress and egress network interfaces are both located on the same FortiGate-
ASM-FB4 module
If a session is not fast path ready, the FortiGate unit will not send the session key
to the FortiGate-ASM-FB4 module. Without the session key, all session key
lookup for incoming packets of that session fails, causing all session packets to be
sent to the FortiGate unit’s main processing resources, and processed at normal
speeds.
If a session is fast path ready, the FortiGate unit will send the session key to the
FortiGate-ASM-FB4 module. Session key lookup then succeeds for subsequent
packets from the known session. Packets within the session must then also meet
packet requirements.
• Incoming packets must not be fragmented.
Note: If you disable anomaly checks by Intrusion Prevention (IPS), you can still enable
hardware accelerated anomaly checks. For details, see “config system interface” on
page 13.

FortiGate-ASM-FB4 accelerated network processing Exceptions to offloading requirements
FortiGate-ASM-FB4 Version 1.0 Technical Note
01-30005-0424-20071002 9
• Outgoing packets must not require fragmentation to a size less than 385 bytes.
Because of this requirement, the configured MTU for the FortiGate-ASM-FB4
module’s network interfaces must also meet or exceed the FortiGate-ASM-
FB4-supported minimum MTU of 385 bytes.
If packet requirements are not met, an individual packet will use FortiGate unit
main processing resources, regardless of whether other packets in the session
are offloaded to the FortiGate-ASM-FB4 module.
In some cases, due to these requirements, a protocol’s session(s) may receive a
mixture of offloaded and non-offloaded processing.
For example, FTP uses two connections: a control connection and a data
connection. The control connection requires a session helper, and cannot be
offloaded, but the data connection does not require a session helper, and can be
offloaded. Within the offloadable data session, fragmented packets will not be
offloaded, but other packets will be offloaded.
Exceptions to offloading requirements
Some traffic types differ from general offloading requirements, but still utilize
FortiGate-ASM-FB4 modules’ encryption and other capabilities. Exceptions
include IPSec traffic and active-active high availability (HA) load balanced traffic.
IPSec offloading requirements
FortiGate-ASM-FB4 modules contain features to improve IPSec tunnel
performance. For example, FortiGate-ASM-FB4 modules can encrypt and decrypt
packets, reducing cryptographic load on the FortiGate unit’s main processing
resources.
Requirements for hardware accelerated IPSec encryption or decryption are a
modification of general offloading requirements. Differing characteristics are:
• origin can be local host (the FortiGate unit)
• in Phase 1 configuration, Local Gateway IP must be specified as an IP
address of a network interface on the FortiGate-ASM-FB4 module
• SA must have been received by the FortiGate-ASM-FB4 module
• in Phase 2 configuration:
• encryption algorithm must be DES, 3DES, AES-128, AES-192, AES-256,
or null
• authentication must be MD5, SHA1, or null
• if encryption is null, authentication must not also be null
• if replay detection is enabled, enc-offload-antireplay must also be
enable in the CLI
Note: If replay detection is enabled in the Phase 2 configuration, you can enable or disable
IPSec encryption and decryption offloading from the CLI. Performance varies by those CLI
options and the percentage of packets requiring encryption or decryption. For details, see
“config system npu” on page 15.

FortiGate-ASM-FB4 Version 1.0 Technical Note
10 01-30005-0424-20071002
Exceptions to offloading requirements FortiGate-ASM-FB4 accelerated network processing
To apply hardware accelerated encryption and decryption, the FortiGate unit must
first perform Phase 1 negotiations to establish the security association (SA). The
SA includes cryptographic processing instructions required by the FortiGate-ASM-
FB4 module, such as which encryption algorithms must be applied to the tunnel.
After ISAKMP negotiations, the FortiGate unit sends the SA to the FortiGate-
ASM-FB4 module, enabling the FortiGate-ASM-FB4 module to apply the
negotiated hardware accelerated encryption or decryption to tunnel traffic.
Possible accelerated cryptographic paths are:
• IPSec decryption offload
• Ingress ESP packet > Offloaded decryption > Decrypted packet egress
(fast path)
• Ingress ESP packet > Offloaded decryption > Decrypted packet to
FortiGate unit
• IPSec encryption offload
• Ingress packet > Offloaded encryption > Encrypted (ESP) packet egress
(fast path)
• Packet from FortiGate unit > Offloaded encryption > Encrypted (ESP)
packet egress
HA active-active offloading requirements
FortiGate-ASM-FB4 modules can improve network performance in active-active
(load balancing) high availability (HA) configurations, even though traffic deviates
from general offloading patterns, involving more than one FortiGate-ASM-FB4
module, each in a separate FortiGate unit. No additional offloading requirements
apply.
Once the primary FortiGate unit sends a session key to its FortiGate-ASM-FB4
module, the FortiGate-ASM-FB4 module on the primary unit can redirect any
subsequent session traffic to other cluster members, reducing traffic redirection
load on the primary unit’s main processing resources.
As subordinate units receive redirected traffic, each FortiGate-ASM-FB4 module
in the cluster assesses and processes session offloading independently. Session
key states are not part of synchronization traffic between HA members.
For more information about active-active HA load balancing, see the FortiGate HA
Overview.