IPsec Phase 2 Rekey Drops Offloaded ESP Packets on NP6Lite / SOC4
Hardware-accelerated IPsec VPN tunnels on FortiGate desktop firewalls powered by NP6Lite / SoC4 ASICs suffer intermittent 5–15 second packet loss bursts during Phase 2 SA rekeying due to premature hardware Security Association invalidation in np6lite_ipsec_sa_install.
Technical Root Cause Analysis
On FortiGate platforms incorporating the NP6Lite network processor (including SoC4 desktop units such as FG-40F, FG-60F, and FG-80F), IPsec cryptographic processing is offloaded to hardware SPU engines to achieve line-rate encrypted throughput.
When an IPsec Phase 2 Security Association (SA) lifetime expires, the Internet Key Exchange (IKE) daemon negotiates a new inbound and outbound Security Parameter Index (SPI) pair. In affected FortiOS builds, the driver routine np6lite_ipsec_sa_install() invalidates the previous inbound SPI in the ASIC lookup table immediately upon programming the new outbound SA. However, because the remote VPN peer continues transmitting trailing ESP packets using the old SPI during the standard rekey grace margin, the NP6Lite hardware fails to map the arriving packets. The ASIC silently drops incoming ESP traffic with the hardware drop counter ipsec_sa_not_found, creating a 5 to 15 second blackhole for real-time applications.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.2 – 7.2.6 | 7.2.7+ | Disable npu-offload on phase2 or increase margin |
| FortiOS 7.4 | 7.4.0 – 7.4.1 | 7.4.2+ | Upgrade recommended for branch IPsec nodes |
| FortiOS 7.0 | Not Affected | 7.0 Branch Clean | Dual-SA overlapping lifetime supported in 7.0 |
Platform Impact: Affects NP6Lite and SoC4 hardware platforms (FG-40F, FG-60F, FG-61F, FG-80F, FG-81F, and FG-100E) running route-based or policy-based site-to-site IPsec tunnels.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands on the branch FortiGate to verify hardware offload status and check whether NP6Lite SA drop counters are incrementing during tunnel rekeys:
Diagnostic Commands
# 1. Query IPsec Phase 2 active SPI keys and hardware offload flags
diagnose vpn tunnel list name CORP_DC_VPN
# 2. Inspect NP6Lite cryptographic hardware processing statistics
diagnose npu np6lite ipsec-stats
# 3. Check ASIC hardware packet drop counters for unmapped SAs
diagnose npu np6lite drop
# 4. Monitor real-time IKE daemon Phase 2 negotiation status
diagnose vpn ike statusRemediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
When an IPsec Phase 2 Security Association (SA) lifetime expires, IKE negotiates a new SPI pair. On NP6Lite hardware, np6lite_ipsec_sa_install purges the old inbound SA from the hardware lookup table the instant the new outbound SA is installed, rather than keeping both active during the transition margin. In-flight ESP packets arriving from the remote peer with the previous SPI hit an unmapped SA in hardware and are silently dropped.
Appliances utilizing the NP6Lite ASIC or SoC4 architecture (FG-40F, FG-60F, FG-61F, FG-80F, FG-81F, and FG-100E) are vulnerable. Voice-over-IP (VoIP), database synchronizations, and real-time streaming sessions experience audio dropouts, session resets, or latency spikes every time the Phase 2 lifetime expires (typically once per hour).
Under 'config vpn ipsec phase2-interface', setting 'set npu-offload disable' routes encryption through the system kernel CPU, which correctly maintains overlapping SAs and eliminates drops until firmware upgrade.