Technical Tip: FortiGate blocks TCP-null packet

• TCP-Null packet series of TCP packets that contain a sequence number of 0 and no set flags. 
• FortiGate blocks TCP null packets by default.

Assume the network as below:

Client/Machine------> FortiGate------->Server

1. Generate TCP-null scan using Zenmap app from client machine to destination server.

2. Packet capture on FortiGate shows it receives the scan traffic but does not forward it to the server. A similar packet capture taken on the server end shows no scan traffic has been received. No Flag was seen on the TCP session.

3. Whereas debug flow shows it does not match any session as 'no session matched', and FortiGate silently blocks the traffic. No session will be created for this traffic. FortiGate considers it as illegitimate traffic since it does not have any Flag on the TCP session, hence dropping the packet.