Technical Tip: FortiGate HA A-P (Active-Passive) cluster: after a Failover, the Passive unit continue to process traffic

[Steff_FTNT]

Description	This article describes some technical considerations when FortiGate devices in an HA Cluster, Active-Passive mode, after a failover continue to load the secondary unit which previously was the primary.
Scope	FortiGate, H-A.
Solution	This is the description of the reason for this unexpected behavior that is not an issue. The following network diagram is used to illustrate this article :   The reason is linked to the firewall policy in proxy mode. The unit that starts the analysis needs to collect the entire file transported over the HTTPS session before giving a security verdict. For this reason, the unit needs to analyze the file till the end of the session, even after a failover. Once the session is finished its traffic is not processed anymore by the secondary unit. All the sessions started after the failover will be processed by the new primary unit. After a certain time, the secondary unit stops being loaded.   Session on both units:   Primary Secondary sync syn_ses synced speed(Bps/kbps) tx 1369/10 rx 101514/812 tx 493/3 rx 78584/628 offload offload=8/8 offload=0/0 no_ofld_reason:    redir-to-av The primary and the secondary comparisons show the details of this behavior. The unit that created the session when it was primarily marked it as 'synced', and the unit which received the session after a HA sync action reported it as 'syn_ses'. Both units report active traffic for the related flows. The actual primary forwards the packets without analyzing them and for this reason, it can offload the traffic. The secondary receives the packets and needs to send them to the antivirus profile, which is the reason why it cannot offload the traffic.