Which two statements describe how the RPF check is used? (Choose two.)

Reverse Path Forwarding (RPF) is a security mechanism primarily used to mitigate IP spoofing attacks. When a FortiGate receives the first packet of a new session, it performs an RPF check on the packet's source IP address. It consults its routing table to determine the egress interface it would use to send a reply packet back to that source IP. If the egress interface in the routing table does not match the ingress interface on which the packet was received, the RPF check fails, and the packet is dropped. This validation occurs only on the initial packet to establish a new session, ensuring the source is legitimate before any stateful entry is created.

B. The RPF check validates the source of the initiating packet to prevent spoofing; it is not performed on the reply packet from the destination.
C. The check is only performed on the first packet that initiates a session, not on both the sent and reply packets.

1. FortiOS 7.2 Administration Guide

Firewall > DoS policies and sensors > DoS anomalies

Page 1011: "Reverse Path Forwarding (RPF)

also called anti-spoofing

is a mechanism that protects the FortiGate unit and your network from IP spoofing attacks." This statement directly supports option D.

2. FortiOS 7.0 Handbook - Packet Flow and Security Features

Life of a Packet

Page 13: The packet flow diagram shows the "Reverse Path Forwarding check" as one of the initial steps for the first packet of a new session

occurring before a session is created in the session table. This confirms the check is performed on the first packet

supporting option A.

3. Fortinet Knowledge Base

Technical Tip: RPF (Reverse Path Forwarding) check or Anti Spoofing (FD33969): "The RPF is a mechanism that protects the FortiGate and the network from IP spoofing attacks... When a packet is received on an interface

the FortiGate will look at the source IP address of that packet and will perform a route lookup... If the outgoing interface in the route entry does not match the interface where the packet was received

the packet is dropped." This confirms the mechanism (D) and its application to incoming packets initiating a connection (A).