FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article intends to know which session is in sync with a slave FortiGate.
It is assumed that an HA cluster of FortiGates is being used, and that session-pickup is enabled:
config sys ha set session-pickup enable end
The synced sessions have the 'synced' flag. The command 'diag sys session list' can be used to see the sessions on the member, with the associated flags.
The number of sessions that are synced on each member can be seen by using the following:
diag sys session list | grep synced -c exec ha manage 1 diag sys session list | grep synced -c
This number may differ because not all sessions are synced. By default, no session is synced.
If session-pickup is enabled, only TCP and IPsec sessions are synced (with exceptions given in the "Session failover not supported for all sessions" section of the "FortiOS Handbook - High Availability").
session-pickup-connectionless can also be enabled in order to sync UDP and ICMP sessions.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.