Generating Evidence for PCI

Sounds like a joke. It's all in the datasheets and documentation. But if you need to demonstrate...

First, statefulness:

Actually the fact is so evident that it's not hard to prove: make a screenshot of the session table. In FortiOS v5.2 use the System > FortiView > All Sessions tab. Statefulness implies the concept of a session.

Anti-spoofing is deeply buried in FortiOS and sometimes the cause of very persistent connection troubles. This is one way to show that it is working, using the CLI (Console widget):

a) set up traceing the traffic on the internal port on the FGT, prepare to save the screen output

b) provoke unsolicited traffic in your LAN

For a):

diag debug enable

diag deb flow show console enable diag deb flow filter saddr <IP address of originating host> diag deb flow filter proto 1 # for ICMP or ping diag deb flow trace start 10 # record 10 events ... now create some unsolicited traffic from the specified host diag deb flow trace stop

One example of "fake IP" traffic would be to use a host which has a source IP address unknown within the LAN. Avoid public IPs though. Example would be 10.44.55.66 or 192.168.222.1 (if these are nowhere used on your LAN). Then "ping 8.8.8.8" from that host. The FGT will discard the traffic because of "reverse path check fail" which is a synonym for anti-spoofing.