FortiGate 400F NP7 ASIC Session Limiter Throttling Valid SIP VoIP RTP Audio
The NP7 network processor hardware session limiter and DoS policer incorrectly classifies symmetric bidirectional RTP audio streams as UDP flood attacks, silently discarding voice media packets and causing severe one-way audio on FG-400F, 401F, and 600F platforms.
Technical Root Cause Analysis
The Fortinet NP7 ASIC incorporates a hardware-based session limiter engine designed to protect host CPU cores from wire-speed TCP SYN and UDP floods. Under high-density VoIP environments (such as contact centers utilizing Cisco CUCM, Avaya Aura, Genesys, or Microsoft Teams Direct Routing SBCs), voice calls establish dynamic Real-time Transport Protocol (RTP) audio channels spanning UDP ports 10000–32768.
In FortiOS 7.2.2 through 7.2.6 on NP7 platforms, the ASIC microcode misclassifies high packet-per-second (PPS) symmetric UDP audio flows matching active SIP ALG or session-helper mappings as unauthorized floods. The hardware session limiter activates packet policers on the ingress NP7 port queues, incrementing ip_dos_drop counters and dropping RTP media packets directly in silicon. Because SIP signaling (ports 5060/5061) is unthrottled, calls connect cleanly, but users experience instantaneous one-way audio, clipped words, or robotic distortion.
Affected Hardware & Blast Radius Matrix
| Appliance Model | ASIC Generation | VoIP Traffic Impact | Status & Workaround |
|---|---|---|---|
| FortiGate 400F / 401F | NP7 (Single Engine) | High: Drops RTP at >200 concurrent calls | Bypass NP7 session limiter or upgrade 7.2.7+ |
| FortiGate 600F / 601F | NP7 (Dual Engine) | High: Intermittent one-way audio | Disable SIP ALG and increase policer limit |
| FortiGate 1000F+ | Multiple NP7 ASICs | Moderate: Higher default PPS threshold | Tune voice session-helper mappings |
| FortiGate 60F – 200F | SOC4 / NP6XLite | Unaffected: NP7 session limiter absent | Standard SIP inspection operates normally |
Software Scope: Vulnerable in FortiOS 7.2.2 through 7.2.6. Permanently resolved in FortiOS 7.2.7, FortiOS 7.4.2, and FortiOS 7.6.0 with RTP-aware hardware bypass.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands to inspect NP7 hardware drop counters, check active session limiter metrics, and filter active UDP 17 VoIP flows:
Diagnostic Commands
# 1. Dump NP7 ASIC hardware drop counters
diagnose npu np7 drop
# 2. Check active NP7 session-limiter operational thresholds
diagnose npu np7 session-limiter
# 3. Filter and inspect active UDP RTP sessions handled by VoIP helper
diagnose sys session filter proto 17
diagnose sys session list | grep -A 5 -B 2 "helper=sip"
# 4. Check system VoIP ALG active call statistics
diagnose test application voip 1Remediation & Workaround Steps (Teaser Preview)
Follow the non-disruptive remediation guide in the Ferrite interactive platform to restore clear bidirectional audio immediately:
Frequently Asked Questions
The NP7 hardware session limiter misidentifies high-frequency UDP RTP packets as DoS floods, discarding voice frames directly in ASIC hardware and causing one-way or garbled audio.
SIP ALG intercepts signaling and attempts to open pinhole filters in software. Disabling SIP ALG and unloading the session-helper allows the NP7 ASIC to handle RTP as standard stateless UDP flows without software inspection delays.
No. Microsoft Teams, Zoom, and Webex encrypt signaling over HTTPS/TLS and transmit SRTP, completely bypassing legacy SIP ALG inspection.