Disabling Stateful Packet Inspection

Hello

I have a Fortigate 60B that needs to have SPI disabled as part of a test. Are these the right commands in CLI to make that happen:

config system settings set asymroute enable end

Also, If you enter this command, what kind of impact would it have on current traffic? Does the FW require a reboot?

Thanks

Jay

Best answer by Luiz_Alberto_Camilo

Hi,

To enable / disable the stateful function, just go to :

config system settings

set asymroute disable (or enable)

end

To see this working, use diag debug flow.

diag debug flow filter (do some filter for source or any other filter you'd like)

diag debug flow show console enable

diag debug flow show function-name enable

diag debug enable

diag debug flow trace start 200 <== to capture 200 packets

To better understand the output above, see "Life of a packet" documentation.

I hope it helps.

New Member

ANS

yes that's the command

and

No, you don't need to reboot

Explorer II

Jay,

Look for the "stateful inspection" function of a firewall ... you're disabling it.

This impact directly on the "reverse path check" of the routing process also.

If your firewall is in transparent mode, it'll impact also.

Do some research on the keywords above before taking your decision.

New Member

Thanks for the feedback. I am not in transparent mode. After our testing, if moving to stateless does not resolve our issue, I will revert back.

Sign up