Default FortiGate-6000 and 7000 configuration for traffic that cannot be load balanced

The default configure load-balance flow-rule command contains the recommended default flow rules that control how the FortiGate-6000 or 7000 handles traffic types that cannot be load balanced. Most of the flow rules in the default configuration are enabled and are intended to send common traffic types that cannot be load balanced to the primary FPC or FPM.

Starting with FortiOS 7.0.13, you can find text files containing the FortiGate 6000F, 7000E and 7000F default flow rules in the same folders as firmware images on the Fortinet Support Download Firmware Images page by selecting the FortiGate-6K7K product.

FortiGate-6000F, 7000E, and 7000F for FortiOS 7.0.16 have the same default flow rules with one exception.

The FortiGate- 7000E includes the following flow rule; which sends VRRP packets to all FPMs:

config load-balance flow-rule
    edit 20
        set status enable
        set vlan 0
        set ether-type ip
        set protocol vrrp
        set action forward
        set forward-slot all
        set priority 6
        set comment "vrrp to all blades"
    next
end

For the FortiGate-6000F and 7000F, the VRRP flow rule sends all VRRP packets to the primary FPC or FPM:

config load-balance flow-rule
    edit 20
        set status enable
        set vlan 0
        set ether-type ip
        set protocol vrrp
        set action forward
        set forward-slot master
        set priority 6
        set comment "vrrp to primary blade"
    next
end

All other default flow rules identify the traffic type using the options available in the command and direct matching traffic to the primary (or master) FPC or FPM (action set to forward and forward-slot set to master). Each default flow rule also includes a comment that identifies the traffic type.

The default configuration also includes disabled flow rules for Kerberos and PPTP traffic. Normally, you would only need to enable these flow rules if you know that your FortiGate will be handling these types of traffic.