IPsec encryption offloading
Network processing unit (NPU) settings configure offloading behavior for IPsec VPNs. Configured behavior applies to all network processors contained by the FortiGate unit itself or any installed AMC modules.
If replay detection is not enabled (IPsec Phase 2 settings), encryption is always offloaded. NPU offloading is supported when the local gateway is a loopback interface.
To enable offloading of encryption even when replay detection is enabled
config system npu
set enc-offload-antireplay enable
set offload-ipsec-host enable
end
To enable offloading of decryption even when replay detection is enabled
config system npu
set dec-offload-antireplay enable
end