Which two statements describe how the RPF check is used? (Choose two.)

The Reverse Path Forwarding (RPF) check is a security feature designed to mitigate IP spoofing attacks. It works by verifying that the source IP address of an incoming packet is reachable through the same interface on which the packet was received. This check is performed by the FortiOS kernel on the first packet of any new session before a session is created in the session table. If the RPF check fails, the packet is dropped, preventing sessions from being established with a spoofed source IP.

B. The RPF check is performed only on the first packet that initiates a session, not on the reply packet. Once the session is established, the check is not repeated.

D. The RPF check is specifically for the initiating packet of a session to validate its source. The reply packet's path is already known and trusted within the established session.

1. Fortinet. (2023). FortiOS Administration Guide 7.2.4. Page 574. "Reverse Path Forwarding (RPF), also known as anti spoofing, is a mechanism that protects the FortiGate device and your network from IP spoofing attacks."

2. Fortinet. (2023). FortiGate Security 7.2 Study Guide. Page 10. "The RPF check is performed on the first packet of a session. If the check fails, FortiGate drops the packet."

3. Fortinet. (2023). FortiOS Handbook - Troubleshooting 7.2.4. Page 45. The debug flow shows the ipropeincheck() function, which includes the RPF check, is performed on the first packet during session creation.