synchronise sessions between Fortigate devices in Azure in HA (active-passive)

[RJ1]

I have Fortigates in Azure deployed as per below scenario:

Active-passive with external and internal Azure load balancer (LB)

Can session synchronization happen between Fortigates? If YES how? If NO Why?

[JohnMcdo · Accepted solution]

Hi SJ,

Yes

Session sync is enabled by default when an HA A/P FortiGate pair is deployed using the Azure Markeplace or Fortinet Github Azure templates, https://github.com/fortinet/azure-templates/blob/main/FortiGate/Active-Passive-ELB-ILB/doc/config-provisioning.md

In the link above you'll see config sections for FortiGate A and FortiGate B, each FortiGate has a section for config system ha, similar to this

config system ha
  set group-name AzureHA
  set mode a-p
  set hbdev port3 100
  set session-pickup enable
  set session-pickup-connectionless enable
  set ha-mgmt-status enable
  config ha-mgmt-interfaces
    edit 1
      set interface port4
      set gateway 172.16.136.193
    next
  end
  set override disable
  set priority 255
  set unicast-hb enable
  set unicas

 Hope this helps.

[franzcisco · Accepted solution]

This is correct. As you stated, Azure Load Balancer is not capable of failing over after a failed probe, as documented here:
https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview#probe-down... 

as seen in this link for TCP sessions the Azure LB will continue to forward to the "unresponsive" endpoint, thus only new sessions will work.
For UDP session however existing sessions will be moved to the new node.

From the FortiOS point of view, the behaviour is the standard, where sessions are synchronized between the A/P nodes - if the load balancer (whatever load balancer) sends the traffic to the passive firewall it will be ready to process the session.

/franz

[avinash_v · Accepted solution]

This is a known issue for the Azure load balancer. Even though a health probe failed, it will not re-route the existing sessions.
This is by design, intended to offer the administrator the opportunity to gracefully shutdown from the application to avoid any unexpected and sudden termination of ongoing application workflow.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiGate-creates-a-new-session-on-a...

https://learn.microsoft.com/en-us/answers/questions/1692319/azure-loadbalancer-failover-sessions-not...

[RJ1]

The article (ID- 327740) shared by you explains for Active-Active cluster, does this also applies for Active-Passive also?

[avinash_v]

applies to both, active-active and active-passive