NP7 handling of ICMP checksum errors during anomaly checking

You can use the following command to configure NP7 processors to send ICMP packets with checksum errors to the CPU:

config system npu

config fp-anomaly

set icmp-csum-err trap-to-host

end

You might set up this configuration if you have configured a DoS firewall policy that includes ICMP DoS protection.

In addition to the above configuration, you must also use the following command (new to FortiOS 6.4.8) to block or allow NP7 processors to send ICMP packets with checksum errors to the CPU:

config system npu

set htx-icmp-csum-chk {drop | pass}

end

drop block ICMP packets with checksum errors. This is the default setting.

pass forward ICMP packets with checksum errors to the CPU.