Persistence based on source IP address or subnet.

Persistence based on a hash of source IP address.

Persistence based on a hash that includes source IP address and port.

Persistence is based on a hash of a cookie provided by client request.

Persistence based on RDP cookie sent by RDP clients in the initial connection request.

Persistence based on the SSL session ID.

Persistence based on the SIP call ID.

Timeout for an inactive persistence session table entry. The default is 300 seconds. The valid range is 1-86,400.

OFF (disabled) by default. Click the button to enable it.

If enabled, clients will continue to access the same backend server through different virtual servers for the duration of a session.

Note: The persistence rule with Match Across Virtual Servers enabled works only with L4 virtual servers or the L7 virtual server whose Profile is LB_PROF_RADIUS.

OFF (disabled) by default. Click the button to enable it.

If enabled, the IP selected from the IP pool will persist for the session.
Note: NAT Source Pool Persistence only works with L4 virtual servers.

Passive Cookie

Persistence is based on the cookie which generated from the server, including six options:

auto/PHPSESSID/JESSIONID/CFID+CFTOKEN/ASP.NET_SessionId/custom. When type is auto, PHPSESSID/JESSIONID/CFID+CFTOKEN/ASP.NET_SessionId can be all checked. When type is custom, user could define the cookie’s keyword at will.

Backend server cookie name.

Timeout for an inactive persistence session table entry. The default is 300 seconds. The valid range is 1-86,400.

Enable so clients continue to access the same backend server through different virtual servers for the duration of a session.

For example, a client session with a vSphere 6.0 Platform Services Controller (PSC) has connections on the following ports: 443, 389, 636, 2012, 2014, 2020. A FortiADC deployment to load balance a cluster of vSphere PSCs includes Layer 4 virtual server configurations for each of these ports. To ensure a client’s connections for a session go to the same backend real server:

1. Create a persistence object based on Source Address affinity and select the Match Across Servers option.
2. Select this persistence object in each of the Layer 4 virtual servers configured to load balance the vSphere PSC pool.
3. Select the same real server pool object in each of the Layer 4 virtual servers configured to load balance the vSphere PSC pool.

When these options are enabled, FortiADC dispatches the intial connection to a real server destination (for example, RS1) based on the virtual server’s load balancing method, and the persistence object is noted in the connection table. Subsequent connection attempts with the same source IP address to any FortiADC virtual server that has this persistence object and real server pool are dispatched to RS1, as long as the session is active.

Note: In the Layer 4 virtual server configuration, you specify a packet forwarding method. You can use Source Address persistence with Match Across Servers with any combination of Direct Routing, DNAT, and Full NAT packet forwarding methods. However, with NAT46 and NAT64 packet forwarding methods, the source address type is different from the real server address type. To use Match Across Servers with NAT46 or NAT64, all virtual servers for the application must be configured with the same packet forwarding method: all NAT46 or all NAT64.

Specifies the cookie name.

If the specified cookie keyword is a valid cookie name from which the cookie value can be extracted, it will be used to calculate the hash. Without the keyword, the hash will be calculated using the whole cookie. Otherwise, the default round robin method will be used.

Timeout for an inactive persistence session table entry. The default is 300 seconds. The valid range is 0-86,400.

If the timeout is set to 0 seconds, the persistence cookie will function as a session cookie, expiring at the end of the session.

Typically, when the timeout value is set to 1 or more seconds, a timestamp is applied to the cookie to track the timeout. When the timeout is set to 0, the cookie will not have a timestamp and instead will expire along with the session.

Enable/disable to add the "HTTPOnly" flag to cookies. The HttpOnly attribute limits the scope of the cookie to HTTP requests. In particular, the attribute instructs the user agent to omit the cookie when providing access to cookies via "non-HTTP" APIs (such as a web browser API that exposes cookies to scripts).

If the cookie attribute does not match or is not applicable, the user agent will ignore the cookie and will not enforce persistence.

Enable/disable to add the Secure flag to cookies. The Secure attribute limits the scope of the cookie to "secure" channels (where "secure" is defined by the user agent). When a cookie has the Secure attribute, the user agent will include the cookie in an HTTP request only if the request is transmitted over a secure channel (typically HTTP over Transport Layer Security (TLS)).

If the cookie attribute does not match or is not applicable, the user agent will ignore the cookie and will not enforce persistence.

Add a SameSite attribute to prevent the browser from sending cookies along with cross-site requests, to mitigate the risk of cross-origin information leakage. It provides Strict, Lax, and None values for this attribute:

• Nothing — Do not add Samesite attribute to cookies.
  The default value is Nothing.

• None — set the value as none if a cookie is required to be sent by cross origin.
  Note: If Secure is enabled, then Samesite should be set to None.

• Lax — any request from the third parties will not carry such cookies except for GET requests that navigate to the destination URL.

• Strict — any request from the third parties will not carry such cookies

If the cookie attribute does not match or is not applicable, the user agent will ignore the cookie and will not enforce persistence.

Enable to specify custom attributes.

When Custom Attribute is enabled, the following options become unavailable: Domain, Httponly, Secure, and Samesite.

The Custom Attribute Value option appears if Custom Attribute is enabled.

Specify the full cookie attributes, including any of the standard attributes and any of the custom attributes.

If the cookie attribute does not match or is not applicable, the user agent will ignore the cookie and will not enforce persistence.

Timeout for an inactive persistence session table entry. The default is 300 seconds. The valid range is 0-86,400.

If the timeout is set to 0 seconds, the insert cookie will function as a session cookie, expiring at the end of the session.

Typically, when the timeout value is set to 1 or more seconds, a timestamp is applied to the cookie to track the timeout. When the timeout is set to 0, the cookie will not have a timestamp and instead will expire along with the session.

Specifies the domain attribute of the cookie.

If the cookie attribute does not match or is not applicable, the user agent will ignore the cookie and will not enforce persistence.

Enable/disable to add the "HTTPOnly" flag to cookies. The HttpOnly attribute limits the scope of the cookie to HTTP requests. In particular, the attribute instructs the user agent to omit the cookie when providing access to cookies via "non-HTTP" APIs (such as a web browser API that exposes cookies to scripts).

If the cookie attribute does not match or is not applicable, the user agent will ignore the cookie and will not enforce persistence.

Enable/disable to add the Secure flag to cookies. The Secure attribute limits the scope of the cookie to "secure" channels (where "secure" is defined by the user agent). When a cookie has the Secure attribute, the user agent will include the cookie in an HTTP request only if the request is transmitted over a secure channel (typically HTTP over Transport Layer Security (TLS)).

If the cookie attribute does not match or is not applicable, the user agent will ignore the cookie and will not enforce persistence.

Add a SameSite attribute to prevent the browser from sending cookies along with cross-site requests, to mitigate the risk of cross-origin information leakage. It provides Strict, Lax, and None values for this attribute:

• Nothing — Do not add Samesite attribute to cookies.
  The default value is Nothing.

• None — set the value as none if a cookie is required to be sent by cross origin.
  Note: If Secure is enabled, then Samesite should be set to None.

• Lax — any request from the third parties will not carry such cookies except for GET requests that navigate to the destination URL.

• Strict — any request from the third parties will not carry such cookies

If the cookie attribute does not match or is not applicable, the user agent will ignore the cookie and will not enforce persistence.

Enable to specify custom attributes.

When Custom Attribute is enabled, the following options become unavailable: Domain, Httponly, Secure, and Samesite.

The Custom Attribute Value option appears if Custom Attribute is enabled.

Specify the full cookie attributes, including any of the standard attributes and any of the custom attributes.

If the cookie attribute does not match or is not applicable, the user agent will ignore the cookie and will not enforce persistence.

Persistence is based on the cookie provided in the backend server response.

Like Rewrite Cookie, the system checks the HTTP response for a Set-Cookie: value that matches the value specified by Keyword in the persistence configuration. However, it preserves the original value and adds the real server pool member Cookie value and a ~ (tilde) as a prefix.

For example, the value of Keyword is sessid. The real server pool member Cookie value is rs1. After an initial client request, the response from the server contains Set-Cookie: sessid=666, which the system changes to Set-Cookie: sessid=rs1~666. It uses this rewritten value to forward subsequent requests to the same backend server as the original request.

Select RADIUS Attribute.

Specify the timeout for an inactive persistence session table entry. The default is 300 seconds, and valid values range from 1 to 86,400.

OFF (disabled) by default. Click the button to enable it.

If enabled, clients will continue to access the same backend server through different virtual servers for the duration of a session.

Note: The persistence rule with Match Across Virtual Servers enabled works only with L4 virtual servers or the L7 virtual server whose Profile is LB_PROF_RADIUS.

OFF (disabled) by default, which means that when the connection limit is reached, new connections will still be persistently forwarded to the real server.

If enabled, new connections will be forwarded to another node (load-balancing) until all nodes are full.

RADIUS persistence rule supports multiple RADIUS settings, which can be either of the following relations:

• AND (Default) — The persistence condition is true if all RADIUS attributes are found.
• OR—The persistence condition is true if any of the attributes is found.

After you have saved the RADIUS-type persistence configuration object, you can open the Persistence configuration editor and add up to four (4) RADIUS attributes to it.

Note: If you choose to use the 26-Vendor-Specific attribute, you need to specify the Vendor ID and Vendor Type.

Timeout for an inactive persistence session table entry. The default is 300 seconds. The valid range is 1-86,400.

Timeout for an inactive persistence session table entry. The default is 300 seconds. The valid range is 1-86,400.

ISO8583 Bitmap

Timeout for an inactive persistence session table entry. The default is 300 seconds. The valid range is 1-86,400.

Relation among the bitmap type, be AND/OR. Default is OR.

Relation of keyvalue, be AND/OR. Default is AND.