NSE4 · Question #414
Examine the network topology diagram in the exhibit; the workstation with the IP address 212.10.11.110 sends a TCP SYN packet to the workstation with the IP address 212.10.11.20. Which of the…
The correct answer is A. Packets is allowed if RPF is configured as loose. D. Packets is blocked if RPF is configured as strict. The Reverse Path Forwarding (RPF) check on the FortiGate will allow the packet if configured as loose RPF, but block it if configured as strict RPF in a scenario where the return path to the source is not strictly out of the ingress interface.
Question
Examine the network topology diagram in the exhibit; the workstation with the IP address 212.10.11.110 sends a TCP SYN packet to the workstation with the IP address 212.10.11.20. Which of the following sentences best describes the result of the reverse path forwarding (RFP) check executed by the FortiGate on the SYN packets? (Choose two).
Exhibit
Options
- APackets is allowed if RPF is configured as loose.
- BPackets is allowed if RPF is configured as strict.
- CPackets is blocked if RPF is configured as loose.
- DPackets is blocked if RPF is configured as strict.
How the community answered
(44 responses)- A70% (31)
- B20% (9)
- C9% (4)
Why each option
The Reverse Path Forwarding (RPF) check on the FortiGate will allow the packet if configured as loose RPF, but block it if configured as strict RPF in a scenario where the return path to the source is not strictly out of the ingress interface.
With loose RPF, a packet is allowed if any route to the source IP address exists in the FortiGate's routing table, even if the ingress interface is not the optimal return path.
If the network topology involves asymmetric routing where the best return path is not the ingress interface, strict RPF would block the packet, making 'allowed' incorrect.
Loose RPF generally allows packets as long as a route to the source exists in the routing table, regardless of the ingress interface, so it would not block a packet from a legitimate source under normal circumstances.
Strict RPF blocks the packet if the FortiGate's routing table indicates that the best return path to the source IP address is not out of the interface on which the packet arrived, which often occurs with asymmetric routing.
Concept tested: Reverse Path Forwarding (RPF) strict vs. loose
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/708428/reverse-path-forwarding-rpf-check
Topics
Community Discussion
No community discussion yet for this question.