The provided output from the FortiGate session table explicitly shows the session state as state=synsent and protostate=01. In the context of FortiOS TCP stateful inspection, this signifies that the firewall has received and processed the initial SYN packet from the client (10.0.0.21) destined for the server (172.16.1.200). However, the firewall has not yet seen the expected SYN/ACK reply from the server. This means the TCP three-way handshake (SYN, SYN/ACK, ACK) has not been successfully completed, and the connection is not yet established. The low expire=2 value further indicates the session is about to time out due to this incomplete state.

A. The final ACK from the client is a necessary part of the handshake, but it can only be sent after the server's SYN/ACK is received, which has not happened here.

B. While asymmetric routing can be a cause for an incomplete handshake (if the SYN/ACK returns via a different path), the session data itself only confirms the effect—that the handshake is incomplete. It does not definitively prove asymmetry is the cause.

C. The traffic is not fully allowed. A session has been created in a pending state, but until the handshake is complete, the connection is not established for data transfer.

1. Fortinet FortiOS Handbook - Troubleshooting (7.0.0)

Page 281: In the section describing the session table

it details the various protocol states. protostate=01 is identified as TCPSYNSENT

which means the initial SYN packet has been sent

but the SYN-ACK reply has not yet been seen by the FortiGate. This confirms the handshake is in an incomplete stage.

2. Fortinet Knowledge Base

Article ID: FD36100

"Technical Tip: FortiGate session table information": This article provides a detailed breakdown of the diagnose sys session list output. It explicitly maps protostate=01 to the TCPSYNSENT state

confirming that the handshake is pending the server's reply.

3. Fortinet Knowledge Base

Article ID: FD30090

"Troubleshooting Tool: Using the FortiGate session table": This guide explains how to interpret session table entries for troubleshooting. It states that a session in protostate=01 (SYNSENT) indicates "The initial SYN packet has been sent

but the SYN-ACK reply has not been seen yet." This directly supports the conclusion that the three-way handshake is not complete.