Fortigate Route ve Spoofing–Reverse path check

The AntiSpoofing mechanism (reverse path check or reverse path forward) in Fortigate allows you to check that the properties of a packet in other paths are received at one level in the correct interface.

It includes mechanisms to prevent IP Spoofing attacks that involve changing the source IP address of a packet that the Fortigate firewall receives from one of the interfaces that the source IP address would not expect.

reverse path forward

<span style="text-decoration: underline;">Interfaces :</span> 

LAN : 192.168.1.254/24

DMZ : 192.168.2.254/24 

<span style="text-decoration: underline;">Routage statique en place :</span> 

Route : 192.168.100.0/24 gw 192.168.1.254

Route : 0.0.0.0 gw defaut wan gateway

This protection mechanism ensures that a packet with the source 192.168.100.0/24 cannot be reached by the LAN interface. The only interface authorized to receive the Flows of this network is the DMZ (see the routing). If a packet with an IP source of 192.168.100.50 comes to the LAN interface, you will get the following error message.

reverse path check fail

This is an anti-spoofing protection that is enabled by default in Fortigate and also active at the VDOM level.

Disabling spoofing protection (reverse path check) In some cases it may be necessary to disable this feature, just type the following cli command.

config system settings
set asymroute enable
end

This has the effect of enabling asymmetric routing and thus disabling RPF.

Note that disabling this option is not recommended by Fortinet.