Description
This article explains that TCP out-of order packets cause security issues.
Scope
FortiGate.
Solution
FortiOS uses TCP sequence checking to ensure a packet is part of a TCP session.
By default, anti-replay protection is strict, which means that if a packet is received with sequence numbers that fall out of the expected range, FortiOS drops the packet.
The discarded packets may be logged with the following message in the Forward Traffic Log: ' replay packet(seq_check), suspicious'.
Strict anti-replay checking performs packet sequence checking and ICMP anti-replay checking with the following
criteria:
- The SYN, FIN, and RST bits cannot appear in the same packet.
- FortiOS does not allow more than 1 ICMP error packet to go through before it receives a normal TCP or UDP packet.
- If FortiOS receives an RST packet, FortiOS checks to determine if its sequence number in the RST is within the un-ACKed data and drops the packet if the sequence number is incorrect.
- For each new session, FortiOS checks to determine if the TCP sequence number in a SYN packet has been calculated correctly and started from the correct value.
