Description
This article gives the command to cause the FortiGate and apply strict header checking to verify that a packet is part of a session that can be processed.
Scope
FortiGate.
Solution
Strict header checking includes verifying the layer-4 protocol header length, the IP header length, the IP version, the IP checksum, and IP options, and verifying that ESP packets have the correct sequence number, SPI, and data length.
If the packet fails for the header check it will be dropped by the FortiGate .
config system global
set check-protocol-header strict
end
Enabling a strict header check will disable all hardware acceleration. This includes NP, SP, and CP processing.
Related topics:
Technical Tip: Protocol header checking
