Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
sonydarrel
New Contributor

TCP State Bypass for a source

Dears,

 

I want to disable tcp state by-pass for a particular source and destination as per below link of cisco, how we can do in fortigate.

 

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/11899...

 

Thanks

1 Solution
emnoc
Esteemed Contributor III

not doable by per src/dst but globally. 

 

config system settings  set asymroute en end

 

But now you have no statefull session tracking

 

Ken

PCNSE 

NSE 

StrongSwan  

View solution in original post

PCNSE NSE StrongSwan
4 REPLIES 4
EMES
Contributor

I am not sure but there are quite a few settings in the cli in #config firewall policy

when you edit a policy do a # show full

 

hope that helps

emnoc
Esteemed Contributor III

not doable by per src/dst but globally. 

 

config system settings  set asymroute en end

 

But now you have no statefull session tracking

 

Ken

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
sonydarrel

Thanks for the experts reply

 

once we enable that then the firewall will be like a router which is stateless for every session, so this means it is not doable in fortigate.

awaiting your confirmation to mark rating for the thread

jhouvenaghel_FTNT

You may use as well tcp-session-without-syn parameter under "config system settings" (Allow creation of tcp session without syn flag). I never used it so have no experience.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors