Fortinet black logo

FortiGate-7000 Handbook

New HA features and changes

Copy Link
Copy Doc ID bf67d868-679e-11e9-81a4-00505692583a:142176
Download PDF

New HA features and changes

FortiGate Session Life Support Protocol (FGSP) (also called standalone session sync) is supported. See FortiGate-7000 FGSP HA.

FGSP session synchronization changes

The following session synchronization options apply to FGSP HA:

config system ha

set session-pickup {disable | enable}

set session-pickup-connectionless {disable | enable}

set session-pickup-expectation {disable | enable}

set session-pickup-nat {disable | enable}

end

  • Turning on session synchronization for TCP sessions by enabling session-pickup also turns on session synchronization for connectionless protocol sessions, such as ICMP and UDP, by enabling session-pickup-connectionless. You can choose to reduce processing overhead by not synchronizing connectionless sessions if you don't need to.
  • The session-pickup-expectation and session-pickup-nat options only apply to FGSP HA. FGCP HA synchronizes NAT sessions when you enable session-pickup.
  • The session-pickup-delay option applies to TCP sessions only and does not apply to connectionless and SCTP sessions.
  • The session-pickup-delay option does not currently work for IPv6 TCP traffic. This known issue (553996) will be fixed in a future firmware version.
  • The session-pickup-delay option should not be used in FGSP topologies where the traffic can take an asymmetric path (forward and reverse traffic going through different FortiGates).

New HA features and changes

FortiGate Session Life Support Protocol (FGSP) (also called standalone session sync) is supported. See FortiGate-7000 FGSP HA.

FGSP session synchronization changes

The following session synchronization options apply to FGSP HA:

config system ha

set session-pickup {disable | enable}

set session-pickup-connectionless {disable | enable}

set session-pickup-expectation {disable | enable}

set session-pickup-nat {disable | enable}

end

  • Turning on session synchronization for TCP sessions by enabling session-pickup also turns on session synchronization for connectionless protocol sessions, such as ICMP and UDP, by enabling session-pickup-connectionless. You can choose to reduce processing overhead by not synchronizing connectionless sessions if you don't need to.
  • The session-pickup-expectation and session-pickup-nat options only apply to FGSP HA. FGCP HA synchronizes NAT sessions when you enable session-pickup.
  • The session-pickup-delay option applies to TCP sessions only and does not apply to connectionless and SCTP sessions.
  • The session-pickup-delay option does not currently work for IPv6 TCP traffic. This known issue (553996) will be fixed in a future firmware version.
  • The session-pickup-delay option should not be used in FGSP topologies where the traffic can take an asymmetric path (forward and reverse traffic going through different FortiGates).