Antireply when traffic enters and leaves the same interaface

Question

Hello Team,

I have been reviewing the below technical tip and I am concerned about the last point in the article talking about disabling anti-replay:

Technical Tip: Traffic handled by FortiGate for pa... - Fortinet Community

I believe that replay scenarios are like when a packet is received twice on different interfaces or when a packet with out-of-range sequence number is received while it belongs to an opened session, or the other scenarios described below:

Replay traffic scenario (fortinet.com)

Technical Note: How anti-replay works and sniffer ... - Fortinet Community

I have also testing configuring a scenario where traffic enters and leaves the Fortigate on the same interface, with a firewall policy to allow this traffic, and I did not have to disable anti-replay. So why it is mentioned here that traffic would be dropped unless anti-replay is disabled?

Technical Tip: Traffic handled by FortiGate for pa... - Fortinet Community

kaman · Answer

When the global anti-replay option is disabled, the FortiGate does not check TCP flags in packets. The per-policy anti-replay option overrides the global setting. This allows you to control whether or not TCP flags are checked per policy.

Please refer to the below documents for more detailed information:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Anti-replay-per-policy-when-FortiGate-is-in/ta-p/196391
https://community.fortinet.com/t5/FortiGate/Technical-Note-How-anti-replay-works-and-sniffer-usage-for/ta-p/194182
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Anti-Replay-option-support-per-policy/ta-p/191435

Sign up

Login with SSO

Login to the community

Login with SSO