During the maintenance window, an administrator must sniff all the traffic going through a specific firewall policy, which is handled by NP6 interfaces. The output of the sniffer trace provides just…

Question

Options

• AThe traffic corresponding to the firewall policy is encrypted.
• Bauto-asic-off load is set to enable in the firewall policy,
• Cinspection-mode is set to proxy in the firewall policy.
• DThe option npudbg is not added in the diagnose sniff packet command.

• A
  4% (2)
• B
  71% (39)
• C
  7% (4)
• D
  18% (10)

Explanation

FortiGate devices with NP6 (Network Processor 6) acceleration offload traffic directly to hardware, bypassing the CPU for improved performance. When auto-asic-offload is enabled in a firewall policy, most of the traffic does not reach the CPU, which means it won't be captured by the standard sniffer trace command. Since NP6-accelerated traffic is handled entirely in hardware, only a small portion of initial packets (such as session setup packets or exceptions) might be seen in the sniffer output. To capture all packets, the administrator must disable hardware offloading using: config firewall policy edit <policy_ID> set auto-asic-offload disable Disabling ASIC offload forces traffic to be processed by the CPU, allowing the sniffer tool to capture all packets.

No community discussion yet for this question.