TCP State Identification Quiz

Protocol State and Flags

• UDP sessions have two session state values on FortiGate: 00 and 01.
• The 'local' session flag indicates that a session is originated from the FortiGate itself.
• Sessions are created and flagged as 'may_dirty' when the firewall policy configuration is changed.

Session Handling

• The 'bridge' session flag indicates that a session is being bridged.
• The default global session handling setting is 'check-all'.
• Packets matching a session with the 'block' flag are blocked.
• The 'auth' session flag indicates that a session is authenticated.
• The 'redir' session flag indicates that a session is redirected.
• The 'check-all' setting is the most resource-intensive behavior for FortiGate session handling after a policy change.
• The alternative option to 'check-all' is 'check-new'.
• The 'per-policy' setting allows you to modify FortiGate session handling on a per-policy level.
• The 'check-all' setting is the default option for FortiGate session handling after a policy change.
• The 'check-new' setting should be enabled if you have policies handling millions of sessions.

Session Handling Options

• The 'session-ttl' setting determines whether the system-level session handling setting is global or per-V-Dom.
• The CLI commands 'config system session' and 'config system vd' can be used to modify FortiGate session handling behavior after policy changes.
• The 'reset' option removes all policy information from sessions affected by a policy change.
• When new packets arrive after a policy change with the 'check-all' option enabled, FortiGate re-evaluates all sessions.
• The 'per-policy' setting is the most granular setting for modifying FortiGate session handling.

TCP State Values

• The TCP state FIN_WAIT is represented by the value 04.
• The TCP state CLOSE_WAIT is represented by the value 05.
• The first digit in the protocol state for TCP sessions subject to flow or proxy inspection is 1.
• When FortiGate receives the SYN-Ack packet, the second digit in the protocol state changes to 1.
• The state value for sessions that are closed by both sides and kept in the session table for a few seconds more is 06.
• The first digit in the protocol state for TCP sessions not subject to any inspection represents the TCP state.
• The second digit in the protocol state for TCP sessions when FortiGate receives the SYN packet is 0.
• The value associated with the TCP state LAST_Ack is 07.
• The value of the second digit in the protocol state after the three-way handshake for TCP sessions is 2.
• The value of the first digit in the protocol state for TCP sessions subject to proxy or flow inspection is 1.

Test your knowledge of server-side and client-side TCP states with this quiz. Identify the corresponding values for each state and challenge yourself to remember the correct digits.