Skip to main content
nanashi
nanashi
Explorer II
June 19, 2023
Question

How can we confirm that Fortigates have Statefull Inspection functions?

  • June 19, 2023
  • 1 reply
  • 6741 views

How can we confirm that Fortigates have the Statefull Inspection function?

Where can we have or see document or config?

1 reply

srajeswaran
Staff
srajeswaran
Staff
June 19, 2023

Stateful inspection is enabled by default on Fortigates, the only way to disable (partially) thiss is by enabling asymmetric route. Unfortunately, there is no specific command output specifying these functions are enabled, we may use session list (which shows packets are processed in stateful manner) or debug flow logs.

Ref: https://community.fortinet.com/t5/FortiGate/Technical-Note-Details-about-FortiOS-RPF-Reverse-Path-Forwarding/ta-p/190100?cmd=displayKC&externalId=FD30543

 

Ref: https://docs.fortinet.com/document/fortigate/6.0.0/cli-reference/726496/system-settings

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
June 19, 2023

Easiest way to confirm is

- take away the default route from the wan interface and set it to another interface like a LAN interface

- run flow debugging https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/54688/debugging-the-packet-flow against the source IP where you're going to send ping packets from on the internet.

- then ping the wan IP from the source.

 

You would see the packets dropped with "reverse path check fail" because of asymmetric routing.

 

Toshi

Terms & ConditionsAccessibility statement