Chapter 7 Firewall for FortiOS 5.0 : Network defense : Blocking external probes : Probes using IP traffic options : Configure packet replay and TCP sequence checking
  
Configure packet replay and TCP sequence checking
The anti-replay CLI command allows you to set the level of checking for packet replay and TCP sequence checking (or TCP Sequence (SYN) number checking). All TCP packets contain a Sequence Number (SYN) and an Acknowledgement Number (ACK). The TCP protocol uses these numbers for error free end-to-end communications. TCP sequence checking can also be used to validate individual packets.
FortiGate units use TCP sequence checking to make sure that a packet is part of a TCP session. By default, if a packet is received with sequence numbers that fall out of the expected range, the FortiGate unit drops the packet. This is normally a desired behavior, since it means that the packet is invalid. But in some cases you may want to configure different levels of anti-replay checking if some of your network equipment uses non-RFC methods when sending packets.
Configure the anti-replay CLI command:
config system global
set anti-replay {disable | loose | strict}
end
You can set anti-replay protection to the following settings:
disable — No anti-replay protection.
loose — Perform packet sequence checking and ICMP anti-replay checking with the following criteria:
The SYN, FIN, and RST bit can not appear in the same packet.
The FortiGate unit does not allow more than one ICMP error packet through before it receives a normal TCP or UDP packet.
If the FortiGate unit receives an RST packet, and check-reset-range is set to strict, the FortiGate unit checks to determine if its sequence number in the RST is within the un-ACKed data and drops the packet if the sequence number is incorrect.
strict — Performs all of the loose checking but for each new session also checks to determine of the TCP sequence number in a SYN packet has been calculated correctly and started from the correct value for each new session. Strict anti-replay checking can also help prevent SYN flooding.
If any packet fails a check it is dropped.