TCP State Identification Quiz
30 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Which protocol has no state and always has a protocol state of 00?

  • ICMP (correct)
  • TCP
  • HTTP
  • UDP

    • What are the two session state values used by FortiGate for UDP traffic?

  • 10 and 11
  • 00 and 01 (correct)
  • 0 and 1
  • 1 and 2

    • What does the 'local' session flag indicate?

  • Session is to, and/or, from local stack
  • Session is checked by IPS anomaly
  • Session originated from FortiGate or terminates on FortiGate (correct)
  • Session is being logged

    • When are sessions created and flagged as may_dirty?

    <p>When the first packet for a new session is received</p> Signup and view all the answers

    What happens to sessions with the may_dirty flag when there is a change in the firewall policy configuration?

    <p>They are flagged as dirty</p> Signup and view all the answers

    Which session flag indicates that a session is being bridged?

    <p>br</p> Signup and view all the answers

    What is the default global session handling setting?

    <p>check-all</p> Signup and view all the answers

    What happens to packets matching a session with the block flag?

    <p>They are dropped</p> Signup and view all the answers

    What does the 'auth' session flag indicate?

    <p>Session requires (or required) authentication</p> Signup and view all the answers

    What does the 'redir' session flag indicate?

    <p>Session is being processed by an application layer proxy</p> Signup and view all the answers

    Which setting is the most resource-intensive behavior for FortiGate session handling after a policy change?

    <p>check-all</p> Signup and view all the answers

    What is the alternative option to 'check-all' for FortiGate session handling after a policy change?

    <p>check-new</p> Signup and view all the answers

    Which setting allows you to modify FortiGate session handling on a per-policy level?

    <p>check-policy-option</p> Signup and view all the answers

    What is the default option for FortiGate session handling after a policy change?

    <p>check-all</p> Signup and view all the answers

    Which setting should be enabled if you have policies handling millions of sessions?

    <p>check-new</p> Signup and view all the answers

    What determines whether the system-level session handling setting is global or per-V-Dom?

    <p>V-Doms</p> Signup and view all the answers

    What CLI commands can be used to modify FortiGate session handling behavior after policy changes?

    <p>config firewall-session-dirty</p> Signup and view all the answers

    Which option removes all policy information from sessions affected by a policy change?

    <p>check-all</p> Signup and view all the answers

    What does FortiGate do when new packets arrive after a policy change with the 'check-all' option enabled?

    <p>Reevaluates them</p> Signup and view all the answers

    What is the most granular setting for modifying FortiGate session handling?

    <p>check-policy-option</p> Signup and view all the answers

    Which value represents the TCP state FIN_WAIT?

    <p>4</p> Signup and view all the answers

    What value is associated with the TCP state CLOSE_WAIT?

    <p>6</p> Signup and view all the answers

    What is the first digit in the protocol state for TCP sessions subject to flow or proxy inspection?

    <p>1</p> Signup and view all the answers

    When FortiGate receives the SYN-Ack packet, what value does the second digit in the protocol state change to?

    <p>3</p> Signup and view all the answers

    What is the state value for sessions that are closed by both sides and kept in the session table for a few seconds more?

    <p>5</p> Signup and view all the answers

    What does the first digit in the protocol state represent for TCP sessions not subject to any inspection?

    <p>0</p> Signup and view all the answers

    What is the second digit in the protocol state for TCP sessions when FortiGate receives the SYN packet?

    <p>1</p> Signup and view all the answers

    What is the value associated with the TCP state LAST_Ack?

    <p>8</p> Signup and view all the answers

    What is the value of the second digit in the protocol state after the three-way handshake for TCP sessions?

    <p>1</p> Signup and view all the answers

    What is the value of the first digit in the protocol state for TCP sessions subject to proxy or flow inspection?

    <p>1</p> Signup and view all the answers

    Study Notes

    Protocol State and Flags

    • UDP sessions have two session state values on FortiGate: 00 and 01.
    • The 'local' session flag indicates that a session is originated from the FortiGate itself.
    • Sessions are created and flagged as 'may_dirty' when the firewall policy configuration is changed.

    Session Handling

    • The 'bridge' session flag indicates that a session is being bridged.
    • The default global session handling setting is 'check-all'.
    • Packets matching a session with the 'block' flag are blocked.
    • The 'auth' session flag indicates that a session is authenticated.
    • The 'redir' session flag indicates that a session is redirected.
    • The 'check-all' setting is the most resource-intensive behavior for FortiGate session handling after a policy change.
    • The alternative option to 'check-all' is 'check-new'.
    • The 'per-policy' setting allows you to modify FortiGate session handling on a per-policy level.
    • The 'check-all' setting is the default option for FortiGate session handling after a policy change.
    • The 'check-new' setting should be enabled if you have policies handling millions of sessions.

    Session Handling Options

    • The 'session-ttl' setting determines whether the system-level session handling setting is global or per-V-Dom.
    • The CLI commands 'config system session' and 'config system vd' can be used to modify FortiGate session handling behavior after policy changes.
    • The 'reset' option removes all policy information from sessions affected by a policy change.
    • When new packets arrive after a policy change with the 'check-all' option enabled, FortiGate re-evaluates all sessions.
    • The 'per-policy' setting is the most granular setting for modifying FortiGate session handling.

    TCP State Values

    • The TCP state FIN_WAIT is represented by the value 04.
    • The TCP state CLOSE_WAIT is represented by the value 05.
    • The first digit in the protocol state for TCP sessions subject to flow or proxy inspection is 1.
    • When FortiGate receives the SYN-Ack packet, the second digit in the protocol state changes to 1.
    • The state value for sessions that are closed by both sides and kept in the session table for a few seconds more is 06.
    • The first digit in the protocol state for TCP sessions not subject to any inspection represents the TCP state.
    • The second digit in the protocol state for TCP sessions when FortiGate receives the SYN packet is 0.
    • The value associated with the TCP state LAST_Ack is 07.
    • The value of the second digit in the protocol state after the three-way handshake for TCP sessions is 2.
    • The value of the first digit in the protocol state for TCP sessions subject to proxy or flow inspection is 1.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Description

    Test your knowledge of server-side and client-side TCP states with this quiz. Identify the corresponding values for each state and challenge yourself to remember the correct digits.

    More Like This

    TCP Protocol States Quiz
    30 questions

    TCP Protocol States Quiz

    VisionarySugilite avatar
    VisionarySugilite
    TCP Protocol States Quiz
    30 questions

    TCP Protocol States Quiz

    VisionarySugilite avatar
    VisionarySugilite
    ESTATS EN UNA CONNEXIÓ TCP
    8 questions

    ESTATS EN UNA CONNEXIÓ TCP

    OptimalGold avatar
    OptimalGold
    Réseaux informatiques: Architecture TCP/IP
    56 questions

    Réseaux informatiques: Architecture TCP/IP

    ProperMahoganyObsidian avatar
    ProperMahoganyObsidian
    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser