Reverse Path Forwarding (RPF) checking is a security mechanism to prevent IP spoofing. In topologies with asymmetric routing, RPF can incorrectly drop legitimate traffic. To accommodate this, RPF checks can be disabled either globally by enabling asymmetric routing (set asymroute enable) or on a specific ingress interface by disabling the source check (set src-check disable).

A. Anti-replay is a security feature within the IPsec protocol to prevent attackers from re-injecting captured packets; it is unrelated to RPF.

D. Disabling strict-src-check changes the RPF mode from strict (route must be the best one) to loose (any route on that interface is acceptable), but it does not disable RPF checking itself.

1. Fortinet. (2021). FortiGate Infrastructure Study Guide for FortiOS 7.0, p. 69. "If you have an asymmetric routing topology, you must disable RPF. You can disable RPF globally or per interface... To disable RPF globally, you must enable asymmetric routing... To disable RPF on an interface, you must disable the source check."

2. Fortinet. (2021). FortiOS CLI Reference 7.0.0, config system interface section. The set src-check disable command is documented to disable the source address check.

3. Fortinet. (2021). FortiOS CLI Reference 7.0.0, config system settings section. The set asymroute enable command is documented to enable asymmetric routing.