Default flow rules for traffic that cannot be load balanced

The default configure load-balance flow-rule command contains the recommended default flow rules that control how the FortiGate 7000E handles traffic types that cannot be load balanced. All of the default flow rules identify the traffic type using the options available in the command and direct matching traffic to the primary FPM (action set to forward and forward-slot set to master). The default flow rules also include a comment that identifies the traffic type. Most of the flow rules in the default configuration are enabled and are intended to send common traffic types that cannot be load balanced to the primary FPM.

The default configuration also includes disabled flow rules for Kerberos and PPTP traffic. Normally, you would only need to enable these flow rules if you know that your FortiGate 7000E will be handling these types of traffic.

Finally, the default configuration disables IPsec VPN flow rules because, by default IPsec VPN load balancing is enabled using the following command:

config load-balance setting

set ipsec-load-balance enable

end

If you disable IP sec VPN load balancing by setting ipsec-load-balance to disable, the FortiGate 7000E automatically enables the IPsec VPN flow rules and sends all IPsec VPN traffic to the primary FPM.

You can find text files containing the FortiGate 7000E default flow rules in the same folders as firmware images on the Fortinet Support Download Firmware Images page.