Default flow rules for traffic that cannot be load balanced

The default configure load-balance flow-rule command contains the recommended default flow rules that control how the FortiGate 6000F handles traffic types that cannot be load balanced. All of the default flow rules identify the traffic type using the options available in the command and direct matching traffic to the primary FPC (action set to forward and forward-slot set to master). The default flow rules also include a comment that identifies the traffic type. Most of the flow rules in the default configuration are enabled and are intended to send common traffic types that cannot be load balanced to the primary FPC.

The default configuration also includes disabled flow rules for Kerberos and PPTP traffic. Normally, you would only need to enable these flow rules if you know that your FortiGate 6000F will be handling these types of traffic.

Finally, the default configuration disables IPsec VPN flow rules because, by default, IPsec VPN load balancing is enabled using the following command:

config load-balance setting

config ipsec-load-balance enable

end

If you disable IP sec VPN load balancing by setting ipsec-load-balance to disable, the FortiGate-6000 automatically enables the IPsec VPN flow rules and sends all IPsec VPN traffic to the primary FPC.

You can find text files containing the FortiGate 6000F default flow rules in the same folders as firmware images on the Fortinet Support Download Firmware Images page.