How can we confirm that Fortigates have Statefull Inspection functions?

nanashi · ‎06-19-2023

How can we confirm that Fortigates have the Statefull Inspection function?

Where can we have or see document or config?

srajeswaran · ‎06-19-2023

Stateful inspection is enabled by default on Fortigates, the only way to disable (partially) thiss is by enabling asymmetric route. Unfortunately, there is no specific command output specifying these functions are enabled, we may use session list (which shows packets are processed in stateful manner) or debug flow logs.

Ref: https://community.fortinet.com/t5/FortiGate/Technical-Note-Details-about-FortiOS-RPF-Reverse-Path-Fo...

Ref: https://docs.fortinet.com/document/fortigate/6.0.0/cli-reference/726496/system-settings

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

Toshi_Esumi · ‎06-19-2023

Easiest way to confirm is

- take away the default route from the wan interface and set it to another interface like a LAN interface

- run flow debugging https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/54688/debugging-the-packet-flow against the source IP where you're going to send ping packets from on the internet.

- then ping the wan IP from the source.

You would see the packets dropped with "reverse path check fail" because of asymmetric routing.

Toshi