Risk of enable TCP Session Without Syn

Forum|Forum|2 years ago
May 14, 2024
6 replies
3496 views

Hi,

I need to understand the risks of enabling tcp-session-without-syn for asymmetric environment. Can someone help to explain to me all the risks if I enable this?

Thank you

FortiGate

Best answer by ozkanaltas

Hello @arie_arie ,

Normally, a TCP session starts with a three-way handshake, beginning with a SYN (synchronize) packet. This ensures both sides are aware of the connection and establishes initial sequence numbers for data transmission.Enabling "tcp-session-without-syn" is risky because it bypasses the normal SYN packet handshake in TCP connections. This makes it easier for attackers to hijack sessions, perform replay attacks, confuse connection states, and bypass security measures, thereby compromising network security.

ozkanaltasAnswer

Valued Contributor III

Hello @arie_arie ,

Normally, a TCP session starts with a three-way handshake, beginning with a SYN (synchronize) packet. This ensures both sides are aware of the connection and establishes initial sequence numbers for data transmission.Enabling "tcp-session-without-syn" is risky because it bypasses the normal SYN packet handshake in TCP connections. This makes it easier for attackers to hijack sessions, perform replay attacks, confuse connection states, and bypass security measures, thereby compromising network security.

AEK

SuperUser

Hi Arie

In addition to Atlas' explanation, please check this two tech tips.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-the-FortiGate-behaves-when-asymmetric-routing/ta-p/198575

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Understanding-the-routing-decision-regarding-the/ta-p/298578

Also let me add, if you need to enable asymmetric routing this should mean that your design still needs improvement because you don't have full control on security.

At lease try use FGSP and/or auxiliary sessions that give more security control comparing with asymmetric sessions.

AEK

arie_arieAuthor

Explorer II

Hi,

How about the UTM inspection in FortiGate? does the UTM inspection still work when enabling tcp-session-without-syn?

Thank you

AEK

SuperUser

I don't think so. Without SYN there should be no UTM inspection for that sessions.

AEK

arie_arieAuthor

Explorer II

Hi,

Thank you for the insight about the feature risk.

If I have 1 FortiGate with 2 uplinks to ISP, where the traffic outgoing to ISP-1 and return traffic going to ISP-2, do I need to enable tcp-session-without-syn to prevent traffic drop of different interface in FortiGate?

Thank you