nerdexam
Fortinet

NSE4 · Question #528

Which TCP states does the global setting `tcp-half-open-timer' applies to? (Choose two.)

The correct answer is A. SYN SENT D. TIME WAIT. The FortiGate global setting tcp-half-open-timer is designed to manage the timeout for TCP sessions that are in a half-open state, specifically applying to SYN_SENT and TIME_WAIT TCP states.

Submitted by jordan8· Apr 18, 2026FortiGate Deployment and System Configuration

Question

Which TCP states does the global setting `tcp-half-open-timer' applies to? (Choose two.)

Options

  • ASYN SENT
  • BSYN & SYN/ACK
  • CFIN WAIT
  • DTIME WAIT

How the community answered

(48 responses)
  • A
    88% (42)
  • B
    8% (4)
  • C
    4% (2)

Why each option

The FortiGate global setting `tcp-half-open-timer` is designed to manage the timeout for TCP sessions that are in a half-open state, specifically applying to SYN_SENT and TIME_WAIT TCP states.

ASYN SENTCorrect

The SYN_SENT state indicates a connection where a SYN packet has been sent but no SYN/ACK has been received, which is a classic half-open condition for which a timer is crucial to prevent resource exhaustion.

BSYN & SYN/ACK

SYN & SYN/ACK are part of the initial three-way handshake; the `tcp-half-open-timer` targets the client-side SYN_SENT state and server-side SYN_RECV (not listed) states to protect against SYN floods, but not SYN/ACK as a standalone state for half-open resource management.

CFIN WAIT

FIN_WAIT states occur during the graceful closure of a TCP connection and are managed by different timeout settings, not specifically the `tcp-half-open-timer` which focuses on initial connection establishment or specific post-closure scenarios.

DTIME WAITCorrect

The TIME_WAIT state, while typically occurring after connection closure, is also managed by `tcp-half-open-timer` on FortiGates to control resource usage by tracking lingering connections.

Concept tested: TCP half-open timer and states

Source: https://docs.fortinet.com/document/fortigate/7.4.0/cli-reference/169046/config-system-global

Topics

#TCP Session Management#FortiGate Global Settings#TCP States#Firewall Configuration

Community Discussion

No community discussion yet for this question.

Full NSE4 Practice