nerdexam
Fortinet

NSE4 · Question #384

For FortiGate devices equipped with Network Processor (NP) chips, which are true? (Choose three.)

The correct answer is A. For each new IP session, the first packet always goes to the CPU. C. Once offloaded, unless there are errors, the NP forwards all subsequent packets. The CPU D. When the last packet is sent or received, such as a TCP FIN or TCP RST signal, the NP. On FortiGate devices with NP chips, the CPU processes the first packet of every new session, then the NP offloads and forwards subsequent packets, and reports session termination (e.g., TCP FIN/RST) back to the CPU.

Submitted by hans_de· Apr 18, 2026FortiGate Deployment and System Configuration

Question

For FortiGate devices equipped with Network Processor (NP) chips, which are true? (Choose three.)

Options

  • AFor each new IP session, the first packet always goes to the CPU.
  • BThe kernel does not need to program the NPU. When the NPU sees the traffic, it determines
  • COnce offloaded, unless there are errors, the NP forwards all subsequent packets. The CPU
  • DWhen the last packet is sent or received, such as a TCP FIN or TCP RST signal, the NP
  • ESessions for policies that have a security profile enabled can be NP offloaded.

How the community answered

(29 responses)
  • A
    93% (27)
  • B
    3% (1)
  • E
    3% (1)

Why each option

On FortiGate devices with NP chips, the CPU processes the first packet of every new session, then the NP offloads and forwards subsequent packets, and reports session termination (e.g., TCP FIN/RST) back to the CPU.

AFor each new IP session, the first packet always goes to the CPU.Correct

For every new IP session, the initial packet must always be inspected by the FortiGate's main CPU to determine if it matches a security policy and if the session is eligible for hardware offloading to an NP chip.

BThe kernel does not need to program the NPU. When the NPU sees the traffic, it determines

The kernel (CPU) is responsible for programming the Network Processor Unit (NPU) by creating flow entries and offload instructions, directing the NPU on which sessions to accelerate and how to handle them; the NPU does not autonomously determine offload eligibility.

COnce offloaded, unless there are errors, the NP forwards all subsequent packets. The CPUCorrect

Once a session is offloaded to the NP, the NP chip efficiently handles all subsequent packets for that session in hardware, bypassing the main CPU for the data plane traffic, thereby significantly improving throughput and reducing latency, unless errors occur.

DWhen the last packet is sent or received, such as a TCP FIN or TCP RST signal, the NPCorrect

When an offloaded session concludes, for instance upon receiving a TCP FIN or RST signal, the NP chip processes this final packet, correctly terminates the session in hardware, and then informs the main CPU about the session's conclusion.

ESessions for policies that have a security profile enabled can be NP offloaded.

Sessions associated with policies that require deep inspection security profiles (e.g., proxy-based antivirus, web filtering) cannot be NP offloaded, as these advanced functions demand main CPU processing; only sessions with simpler or flow-based profiles might be eligible.

Concept tested: FortiGate NP chip session offloading

Source: https://docs.fortinet.com/document/fortigate/7.4.0/fortios-handbook/606558/np-and-cp-processors-offloading

Topics

#NP Offloading#Network Processors#FortiGate Architecture#Session Processing

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full NSE4 Practice