Technical Tip: Protocol header checking

[naveenk]

Description

This article describes how to select the level of checking performed on protocol headers in the config level.

Solution

It can be selected under the CLI only by using the following command:

config system global
    check-protocol-header {loose | strict}
end

• loose: The FortiGate performs basic header checking to verify that a packet is part of a session and should be processed.
  Basic header checking includes verifying that the layer-4 protocol header length, the IP header length, the IP version, the IP checksum, IP options are correct, etc.
  
• strict: The FortiGate does the same checking as above plus it verifies that ESP packets have the correct sequence number, SPI, and data length.
  If the packet fails header checking it is dropped by the FortiGate.
  
  

Related topic:

Technical Tip: Strict protocol header checking disables hardware acceleration