New HA features and changes
FortiGate Session Life Support Protocol (FGSP) (also called standalone session sync) is supported. See FortiGate-7000 FGSP HA.
FGSP session synchronization changes
The following session synchronization options apply to FGSP HA:
config system ha
set session-pickup {disable | enable}
set session-pickup-connectionless {disable | enable}
set session-pickup-expectation {disable | enable}
set session-pickup-nat {disable | enable}
end
- Turning on session synchronization for TCP sessions by enabling
session-pickupalso turns on session synchronization for connectionless protocol sessions, such as ICMP and UDP, by enablingsession-pickup-connectionless. You can choose to reduce processing overhead by not synchronizing connectionless sessions if you don't need to. - The
session-pickup-expectationandsession-pickup-natoptions only apply to FGSP HA. FGCP HA synchronizes NAT sessions when you enablesession-pickup. - The
session-pickup-delayoption applies to TCP sessions only and does not apply to connectionless and SCTP sessions. - The
session-pickup-delayoption does not currently work for IPv6 TCP traffic. This known issue (553996) will be fixed in a future firmware version. -
The
session-pickup-delayoption should not be used in FGSP topologies where the traffic can take an asymmetric path (forward and reverse traffic going through different FortiGates).