ANTI SPOOFING enabled ? FORTIGATE

[angie1996]

Hello,Our security auditor has asked that I generate screen shots proving that these firewalls use stateful inspection. They also want something showing uses anti-spoofing

I have a fortigate 500d v.5.6, how do I know that it has ANTI SPOOFING and STATEFUL INSPECTION enabled? Will there be any command to see it?

[Toshi_Esumi]

One of our customer had the same inquiry originated by their security auditor. Unless "asymroute" is enabled, stateful inspection is the base of all FW actions including the reverse path check on the FGTs as in the KB.

https://kb.fortinet.com/k....do?externalID=FD30543

[emnoc]

Don't know why they want that but 

       diag sys session list

       diag sys session stat

Ken Felix

[angie1996]

hello, what are those commands for?

[angie1996]

hello, what are those commands for?

[ede_pfau]

Stateful firewall have to maintain a table of active sessions - "state" refers to the state of a session, being opened, used, closed. If you show the current session table with the commands supplied by @emnoc, you do in fact prove that this firewall is stateful.

Proving that RPF is in place is more difficult. You can show that the FGT has a command to disable this feature, so indirectly show that the feature exists. Other than that, you can only demonstrate it by injecting traffic from an unknown IP source, which will be dropped silently by RPF.

Then again, it's all in the data sheet. I have no idea how I could *prove* that the engine in my car has 6 cylinders but it's in the description of the model (and no, no ignition cables to count as it's a Diesel engine).

[emnoc · Accepted solution]

I have no idea how I could *prove* that the engine in my car has 6 cylinders but it's in the description of the model (and no, no ignition cables to count as it's a Diesel engine).

In your case you have  diesel fuel line/rail .Just busting your chops :)

But ede bought up the point the datasheet and the fact that you do not have asymmetrical routing enabled should be good enough.

also to edit, if the auditor becomes pain, you can always make a configuration dump send it into tac and have them confirm 1> it's operating in stateful mode 2> and uRPF anti-spoof is enabled

I had to do just that for a PCI auditor for a similar audit where they didn't take the word of 4  local engineers that our firewalls was acting like a firewall, smh.

So they accepted the word of the TAC.

Ken Felix

[Yurisk]

On CLI/CLI Applet run this command:

show full system settings | grep  asym

If output looks like this it means Stateful firewall is NOT disabled, i.e. enabled:

set asymroute disable set asymroute-icmp disable

set asymroute6 disable

set asymroute6-icmp disable