FortiGate-7000 PFCP load balancing

On a FortiGate-7000 system you can use the following command to enable or disable PFCP load balancing.

config load-balance setting

set pfcp-load-balance {disable | enable}

end

The following flow rule is also available to direct PFCP control plane traffic to the primary FPM.

config load-balance flow-rule

edit 17

set status disable

set ether-type ipv4

set src-addr-ipv4 0.0.0.0 0.0.0.0

set dst-addr-ipv4 0.0.0.0 0.0.0.0

set protocol udp

set src-l4port 0-0

set dst-l4port 8805-8805

set action forward

set forward-slot master

set priority 5

set comment "pfcp to primary blade"

next

end

By default, both of these configurations are disabled and PFCP control plane and user plane traffic is not load balanced. The FortiGate-7000E DP processor or FortiGate-7000F NP7 processor sends all PFCP control plane and user plane traffic to the primary FPM.

To load balance user plane traffic to multiple FPMs, you can set pfcp-load-balance to enable. This also enables the PFCP flow rule. PFCP user plane traffic is then load balanced across all FPMs while PFCP control plane traffic is still handled by the primary FPM. This is the recommended configuration for load balancing PFCP traffic.