Based on the FortiGate Infrastructure 7.6 study guide and the Hardware Acceleration technical documentation, the diagnose vpn tunnel list command provides the status of IPsec tunnel offloading to the Network Processor (NPU).
In the provided exhibit, the specific value npu_flag=20 (which corresponds to 0x20 in hexadecimal) indicates that the IPsec Security Association (SA) cannot be offloaded to the NPU. While the NPU may have visibility of the gateway IPs (npu_rgwy and npu_lgwy), the flag itself serves as a diagnostic indicator that the traffic must be processed by the system CPU rather than the hardware accelerator.
This lack of offloading typically occurs when the tunnel configuration uses a cipher (encryption algorithm) or an HMAC (authentication algorithm) that is not supported by the specific NPU model installed in the FortiGate. For example, if a tunnel is configured with a legacy or highly complex algorithm that the NP6 or NP7 chip is not designed to process in hardware, the FortiOS kernel handles the encryption and decryption, resulting in the npu_flag=20 status. Therefore, despite the presence of NPU-related fields, the specific flag value confirms that hardware acceleration is not active for these SAs.

The issue occurs because FortiGate enforces the "do not fragment" (DF) bit in the packet, and the packet size exceeds the MTU of the network path. When the Windows PC1 (with an MTU of
1500 bytes) attempts to send a 1400-byte packet, the FortiGate interface (with an MTU of 1000 bytes) needs to fragment it. However, since the DF bit is set, FortiGate drops the packet instead of fragmenting it.
To resolve this, the user should adjust the ping packet size to fit within the path MTU. In this case, reducing the packet size to 972 bytes (1000 bytes MTU minus 28 bytes for the IP and ICMP headers) should allow successful transmission.

Configuring route-reflector-client lets a router act as a route reflector for its IBGP peers, which removes the need for a full-mesh IBGP design. This significantly improves scalability by reducing the number of IBGP sessions required and makes route distribution more efficient across the network.

When using IPsec VPNs and VXLAN, additional headers are added to packets, which can exceed the default 1500-byte MTU. This can lead to fragmentation issues, dropped packets, or degraded performance.
To resolve this, the MTU (Maximum Transmission Unit) should be adjusted only if all devices in the network path support it. Otherwise, some devices may still drop or fragment packets, leading to continued issues.
Why adjusting MTU helps:
VXLAN adds a 50-byte overhead to packets.
IPsec adds additional encapsulation (ESP, GRE, etc.), increasing the packet size. If packets exceed the MTU, they may be fragmented or dropped, causing intermittent connectivity issues.
Lowering the MTU on interfaces ensures packets stay within the supported size limit across all network devices.

Unlike IPS or antivirus databases, FortiGate does not store a full web filter database locally. Instead, FortiGate queries FortiGuard (or FortiManager, if configured) dynamically to classify and filter web content in real time.
Key points:
# Web filtering works on a cloud-based model:
# When a user requests a website, FortiGate queries FortiGuard servers to check its category and reputation.
# The response is then cached locally for faster lookups on repeated requests.
# No local web filter database version:
# Unlike IPS and antivirus, which download and store signature updates locally, web filtering relies on cloud- based queries.
# This is why no database version appears in the GUI.
# Flow mode vs Proxy mode:
# In proxy mode, FortiGate can cache some web filter data, improving performance.
# In flow mode, all queries happen dynamically, with no locally stored database.