Which statement about network processor (NP) offloading is true?

Question

Options

• AWhen NP acceleration is enabled, firewall sessions may not offload if proxy-based security
• BYou can disable the NP for each firewall policy using the command np-acceleration set to loose.
• CThe FortiGate CPU offloads all firewall sessions that require FortiOS session helper to the
• DFor UDP traffic, the FortiGate CPU offloads the first packet to identify it as fast-path traffic.

• A
  81% (35)
• B
  2% (1)
• C
  5% (2)
• D
  12% (5)

Explanation

Option A is correct because proxy-based security profiles (such as proxy-based antivirus, web filtering, or DLP) require deep application-layer inspection that must be handled by the FortiGate's main CPU - the NP chip only accelerates flows that don't need that level of processing, so those sessions stay on the CPU and cannot be offloaded even when NP acceleration is enabled.

Why the distractors are wrong:

• B is wrong because np-acceleration loose does not disable NP offloading - loose is a mode that relaxes NP offloading restrictions, not disables them; disable is the correct value to turn off NP acceleration for a policy.
• C is wrong because sessions requiring a FortiOS session helper (e.g., FTP, SIP) cannot be offloaded to the NP - helpers require CPU-level session tracking, making them the opposite of NP-eligible traffic.
• D is wrong because for UDP, it is the second packet (not the first) that triggers NP offloading after the CPU creates the initial session entry; the first packet is always handled by the CPU to establish the session.

Memory tip: Think of the NP chip as a "dumb fast lane" - anything requiring intelligence (proxy inspection, session helpers, first-packet decisions) stays in the CPU's "smart lane." If a policy needs to think, it can't be offloaded.

No community discussion yet for this question.