How can we confirm that Fortigates have Statefull Inspection functions?

[nanashi]

How can we confirm that Fortigates have the Statefull Inspection function?

Where can we have or see document or config?

[srajeswaran]

Stateful inspection is enabled by default on Fortigates, the only way to disable (partially) thiss is by enabling asymmetric route. Unfortunately, there is no specific command output specifying these functions are enabled, we may use session list (which shows packets are processed in stateful manner) or debug flow logs.

Ref: https://community.fortinet.com/t5/FortiGate/Technical-Note-Details-about-FortiOS-RPF-Reverse-Path-Fo...

Ref: https://docs.fortinet.com/document/fortigate/6.0.0/cli-reference/726496/system-settings

[Toshi_Esumi]

Easiest way to confirm is

- take away the default route from the wan interface and set it to another interface like a LAN interface

- run flow debugging https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/54688/debugging-the-packet-flow against the source IP where you're going to send ping packets from on the internet.

- then ping the wan IP from the source.

You would see the packets dropped with "reverse path check fail" because of asymmetric routing.

Toshi