The RPF (Reverse Path Forwarding) check is used to prevent IP spoofing attacks by verifying that the source IP address of a received packet is reachable through the same interface it arrived on. If not, the packet is dropped, ensuring traffic legitimacy.
The RPF check runs on the first sent packet of any new session to validate that the route to the source IP is consistent with the interface it's received on. This helps FortiGate detect spoofed or asymmetric routing scenarios early in the session establishment.

Enabling Multiple Interface Policies allows you to select multiple interfaces (like port1 and port2) in a single firewall policy, consolidating access rules for both Sales and Engineering to the web server.

When flow-based inspection is used, FortiGate scans packets as they flow through, and if a virus is detected, the connection is reset immediately. Because the infected file is blocked mid-transfer, the user does not receive a block replacement message - only the last packet is dropped to terminate the connection.
Replacement messages are shown only in proxy-based inspection, where FortiGate can buffer and fully analyze the file before sending a response page.

NTurbo enhances flow-based inspection performance by creating a fast data path between the IPS engine and the ingress/egress interfaces. This allows traffic to be inspected efficiently without needing to pass through the slower, traditional packet path, thus reducing CPU load and improving throughput during flow-based security inspections.

SD-WAN rules are skipped if none of the SD-WAN members have a valid route to the destination.
SD-WAN rules take precedence over other route types.
SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member by default.