SSL Mirror Port Decrypted Traffic Truncation on High-Speed 10GE VDOMs
Decrypted plaintext traffic forked to security probes via SSL Mirror ports experiences silent packet truncation and frame drops over 10GE/25GE interfaces due to shallow NP6/NP7 hardware TX ring buffer exhaustion.
Technical Root Cause Analysis
The FortiOS SSL Mirror function permits enterprise network operations to decrypt TLS sessions using CP9/CP10 cryptographic processors and forward a clone of the unencrypted payload out a designated physical interface (such as a 10GE SFP+ port) connected to a Network Detection and Response (NDR) device or packet broker.
In FortiOS 7.2.0 through 7.2.5 running on NP6 and NP7 hardware-accelerated platforms, the DMA transmit queue allocated for the SSL mirror interface was restricted to a static depth of only 128 buffer descriptors. When high-bandwidth microbursts occurred across production VDOMs (e.g., automated cloud backups or heavy web traffic), the primary switching path forwarded traffic at wire speed, but the secondary mirror port queue immediately overflowed. Because the driver lacked adaptive pacing, the ASIC dropped excess frames or truncated frames past 256 bytes. Diagnostic counters in diagnose npu np7 drop registered rapid increments in qfull_drop, blinding downstream security sensors without generating any SNMP traps or syslog warnings.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.0 – 7.2.5 | 7.2.6+ | Expand ring buffer / Upgrade |
| FortiOS 7.4 | 7.4.0 | 7.4.1+ | 1024-descriptor DMA ring enabled |
| FortiOS 7.0 | 7.0.0 – 7.0.11 | 7.0.12+ | Limit mirror to critical subnets |
Platform Impact: High-performance enterprise FortiGates (FG-200F, FG-400F, FG-600F, FG-1000F) tapping decrypted TLS traffic to out-of-band security and compliance tools.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these commands to inspect hardware ASIC drop counters and check firewall policy mirror queues:
Diagnostic Commands
# 1. Check NP7/NP6 hardware ASIC packet drop and ring overflow counters
diagnose npu np7 drop
# 2. View firewall internal policy engine mirror error counters
diagnose firewall iprope error
# 3. Inspect interface queue drops and netlink driver statistics
diagnose netlink interface list port10
# 4. View active SSL-SSH profile mirror configurations
show firewall ssl-ssh-profile | grep -A 4 "ssl-mirror"Remediation & Workaround Steps (Teaser Preview)
Restore lossless decrypted packet delivery to your NDR and SIEM sensors:
Frequently Asked Questions
Production traffic utilizes hardware fast-path forwarding across primary NP7 ASIC switching fabrics with massive queue depth. In contrast, the ssl-mirror feature duplicates plaintext packets to a secondary software or dedicated TAP egress ring. In vulnerable builds, this secondary ring had a shallow buffer (128 descriptors), causing bursty decrypted packets to overflow and drop on the mirror interface while passing through the primary path untouched.
Yes. Network Detection and Response (NDR) tools and Zeek/Suricata sensors require full payload reassembly to inspect HTTP headers, API JSON bodies, and file transfers. Dropped or truncated packets trigger TCP out-of-order errors and cause deep protocol analyzers to fail detection.
FortiOS 7.2.6 and 7.4.1 overhauled the NPU mirror interface driver, expanding default TX descriptor depth to 1024 buffers and implementing adaptive hardware rate pacing.