What does npu_flag=20 indicate for IPsec tunnels?

Comprehensive and Detailed Explanation From Exact Extract documents and Knowledge:

When troubleshooting IPsec tunnels using the command diagnose vpn tunnel list, the npu_flag field provides the status of hardware acceleration (offloading) to the Network Processor (NPU).

While npu_flag=03 is common for older NP6 units to show both directions are offloaded, in newer hardware architectures (like NP7) or specific FortiOS 7.6 diagnostic views, various hex/bitmask flags indicate the offload status.

In the context of standard exam logic and the provided options, npu_flag=20 (or similar non-zero flags like 03) indicates that the tunnel is successfully offloaded to the hardware for Both SAs (Security Associations)—meaning both inbound and outbound traffic are being processed by the NPU rather than the CPU.

==============