FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Description On the global config level, select the level of checking performed on protocol headers is possible.
This article describes how to select it.
Solution It can be selected under the CLI only by using the following command:
# config system global check-protocol-header {loose | strict} end
- loose: The FortiGate performs basic header checking to verify that a packet is part of a session and should be processed. Basic header checking includes verifying that the layer-4 protocol header length, the IP header length, the IP version, the IP checksum, IP options are correct, etc.
- strict: The FortiGate does the same checking as above plus it verifies that ESP packets have the correct sequence number, SPI, and data length. If the packet fails header checking it is dropped by the FortiGate.
