ANTI SPOOFING enabled ? FORTIGATE

One of our customer had the same inquiry originated by their security auditor. Unless "asymroute" is enabled, stateful inspection is the base of all FW actions including the reverse path check on the FGTs as in the KB.
https://kb.fortinet.com/k....do?externalID=FD30543

hello, what are those commands for?

Stateful firewall have to maintain a table of active sessions - "state" refers to the state of a session, being opened, used, closed. If you show the current session table with the commands supplied by @emnoc, you do in fact prove that this firewall is stateful.
Proving that RPF is in place is more difficult. You can show that the FGT has a command to disable this feature, so indirectly show that the feature exists. Other than that, you can only demonstrate it by injecting traffic from an unknown IP source, which will be dropped silently by RPF.
Then again, it's all in the data sheet. I have no idea how I could *prove* that the engine in my car has 6 cylinders but it's in the description of the model (and no, no ignition cables to count as it's a Diesel engine).

On CLI/CLI Applet run this command:
show full system settings | grep  asym
 
If output looks like this it means Stateful firewall is NOT disabled, i.e. enabled:
 
set asymroute disable
set asymroute-icmp disable
set asymroute6 disable
set asymroute6-icmp disable