Description
This articles explains tha TCP out-of order packets causes the security issues.
Solution
FortiOS uses TCP sequence checking to ensure a packet is part of a TCP session.
By default, anti-replay protection is strict, which means that if a packet is received with sequence numbers that fall out of the expected range, FortiOS drops the packet.
Strict anti-replay checking performs packet sequence checking and ICMP anti-replay checking with the following
criteria:
- The SYN, FIN, and RST bit cannot appear in the same packet.
- FortiOS does not allow more than 1 ICMP error packet to go through before it receives a normal TCP or UDP packet.
- If FortiOS receives an RST packet, FortiOS checks to determine if its sequence number in the RST is within the un-ACKed data and drops the packet if the sequence number is incorrect.
- For each new session, FortiOS checks to determine if the TCP sequence number in a SYN packet has been
calculated correctly and started from the correct value.
