FortiGate 200F NP6 Packet Drop on Fragmented UDP with DF Bit Cleared
FortiGate 200F and 201F appliances equipped with NP6 network processors silently discard non-initial fragmented UDP packets when the Don't Fragment (DF) bit is cleared (DF=0), failing large RADIUS authentications, DNSSEC lookups, and NFS transactions.
Technical Root Cause Analysis
The NP6 network processor ASIC utilizes specialized packet parse and classification microcode to offload IPv4 and IPv6 forwarding decisions from the host CPU. When an endpoint transmits a large UDP packet that exceeds the interface MTU with DF=0, the sender fragments the payload into an initial packet (containing IP + UDP headers, offset 0) and one or more subsequent fragments (containing only IP header + payload chunk, offset > 0).
In affected FortiOS builds on the FG-200F platform, the NP6 session lookup matches and offloads the initial UDP fragment because 4-tuple port information is parsed cleanly. However, when non-initial fragments arrive, the ASIC parser searches the hardware fast-path table without finding matching UDP ports. Rather than punting the non-initial fragments up to the Linux kernel IP reassembly subsystem, an internal microcode condition discards the fragments and increments the ASIC hardware drop counter frag-drop (or drop-ip-frag). The receiving endpoint experiences reassembly timeouts and silent packet loss.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.5 – 7.2.7 | 7.2.8+ | Disable auto-asic-offload on UDP policies |
| FortiOS 7.0 | 7.0.12 – 7.0.14 | 7.0.15+ | Bypass NPU for fragmented UDP traffic |
| FortiOS 7.4 | 7.4.0 – 7.4.1 | 7.4.2+ | NP6 fragment punt logic resolved in 7.4.2 |
Platform Impact: Affects FortiGate 200F and FortiGate 201F models powered by the NP6 network processor handling fragmented UDP traffic (DF=0). Models utilizing newer NP7 ASICs (e.g. 100F, 400F, 600F) use a different microcode reassembly pipeline.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands to determine whether the NP6 ASIC is actively dropping fragmented UDP packets in hardware:
Diagnostic Commands
# 1. Query NP6 ASIC hardware drop counters
diagnose npu np6 drop
# 2. Inspect NP6 IPsec and fast-path offload statistics
diagnose npu np6 ipsec-stats
diagnose npu np6 session-stats 0
# 3. Capture real-time fragmented packets traversing the firewall
diagnose sniffer packet any "udp and (ip[6:2] & 0x3fff != 0)" 4 0 l
# 4. Check NPU global configuration settings
diagnose npu np6 ssm-statsRemediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the interactive Ferrite platform:
Frequently Asked Questions
When UDP datagrams exceed the MTU and have the Don't Fragment (DF) bit set to 0, they are split into initial (offset 0) and non-initial fragments. The NP6 parser offloads the initial fragment because Layer 4 UDP port headers are present. However, subsequent fragments contain only the IP header without L4 port info. Due to a parser microcode defect, NP6 fails to match the existing session table entry and silently discards non-initial fragments instead of punting them to the CPU host stack.
Enterprise applications transmitting large UDP datagrams without path MTU discovery—such as RADIUS authentication with extensive attributes, DNSSEC responses over 1500 bytes, NFS over UDP, and fragmented IPsec tunnel packets—fail intermittently or time out completely.
This defect is permanently resolved in FortiOS 7.2.8, 7.0.15, and 7.4.2+, where NP6 microcode correctly punts non-initial IP fragments to the kernel slow-path for complete session reassembly.