FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article describes an issue where it is not possible to configure the anti-replay check to be applied per policy for a FortiGate operating in policy-based mode.
Scope
NGFW Policy-based mode.
Solution
When FortiGate is operating in the profile-based mode, it is possible to configure the anti-replay check in global settings as well as the per policy:
config system global set anti-replay ? disable Disable anti-replay check. loose Loose anti-replay check. strict Strict anti-replay check. end
Or:
config firewall policy edit <> set anti-replay ?
enable Enable anti-replay check.
disable Disable anti-replay check. end
However, for a FortiGate operating in policy-based mode, anti-replay checking is a global configuration only and cannot be applied per-policy, as this setting is unavailable within security-policies. As a workaround, anti-replay(strict) checks can be applied on a per-policy level by configuring the DoS policies to match traffic for specific security policies, to detect and mitigate SYN-flood and port scan protections.
