FortiGate 90G SP5 Hardware Flow Table Collision on Jumbo MTU 9000 Frames
On FortiGate 90G and 91G appliances with 10GbE uplinks, high-throughput Jumbo MTU 9000 packet streams trigger hash collisions in the SP5 NPU flow table, revoking hardware offload and drowning the CPU in software interrupts.
Technical Root Cause Analysis
The FortiGate 90G and 91G are powered by Fortinet's fifth-generation Security Processing Unit (SP5 ASIC), integrating high-density hardware session offloading with dual 10GbE SFP+ interfaces. In high-performance enterprise storage (iSCSI, NFS, NVMe-oF) and backup networks, interfaces are configured with set mtu-override enable and set mtu 9000 to maximize Ethernet payload efficiency.
In early NPI builds of FortiOS 7.4.2 and 7.4.3, the SP5 microcode flow-hash generation engine incorporates Ethernet payload length into the 18-bit lookup key. When continuous streams of maximum-size jumbo packets traverse the NPU, the calculated hash indices experience severe distribution bias, clustering within a single Content Addressable Memory (CAM) bucket. Once a 4-way associative bucket overflows, the SP5 ASIC revokes hardware acceleration for the session (setting npu_offload=0) and diverts full 10Gbps traffic streams into the kernel SLOWPATH. The ARM CPU cores immediately peg at 100% software interrupt (sirq), resulting in massive ring buffer overruns, dropped frames, and broken storage replication.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.4 (NPI) | 7.4.2 NPI, 7.4.3 NPI | 7.4.4 GA+ | Tune SP5 flow-hash or clamp MSS |
| FortiOS 7.2 | Not Applicable | FG-90G requires 7.4+ | SP5 hardware not supported in 7.2 |
| FortiOS 7.6 | Not Affected | 7.6.0+ | Updated SP5 microcode included in base |
Platform Impact: Exclusively affects FortiGate 90G and 91G hardware models running 10GbE SFP+ uplinks configured with MTU 9000/9216 in high-throughput datacenter environments.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands to query the SP5 hardware session engine and detect offload revocations and CPU software interrupt saturation:
Diagnostic Commands
# 1. Inspect SP5 hardware session offload rates and collision drops
diagnose npu sp5 session-stat
# 2. Compare hardware vs. software session counts
diagnose sys session stat
# 3. Check SP5 Data Storage Engine (DSE) CAM bucket utilization
diagnose npu sp5 dse-stat
# 4. View hardware processor status and temperature
get hardware statusRemediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
No. Standard 1500-byte frames distribute across the SP5 CAM hash buckets evenly and achieve full wire-speed hardware offload without collision.
Disabling NPU offload with set auto-asic-offload disable forces all traffic through the CPU, which avoids CAM collisions but limits throughput to ~1.5 Gbps instead of 10 Gbps.
FortiOS 7.4.4 GA includes an updated SP5 microcode package (v5.10.42) that redesigns hash polynomial weights for jumbo frames.