Created on 10-01-2007 12:00 AM Edited on 02-21-2024 06:26 AM By Jean-Philippe_P
Description
This article describes the session failover (session pickup) feature used on the FortiGate High Availability (HA) cluster.
Scope
FortiGate.
Solution
Session failover means that after the primary unit fails/reboots/power off, communications sessions resume on the new primary unit with minimal or no interruption.
With session failover (also called session pickup) enabled, the primary unit informs the subordinate units of changes to the primary unit connection and state tables, keeping the subordinate units up-to-date with the traffic currently being processed by the HA cluster.
This helps new primary units resume communication sessions with minimal loss of data, avoiding the need to restart active sessions.
All synchronization activity takes place over the HA heartbeat link using TCP/703 and UDP/703 packets.
Two categories of sessions need to be resumed after a failover:
CLI Command to change enable the session Pickup:
config system ha
set session-pickup enable
end
If the customer has VDOMs then this will be done from global VDOM:
config system global
config system ha
set session-pickup enable
end
Sessions pass through the cluster.
Session failover is supported for sessions scanned by flow-based security profiles; however, flow-based sessions that failover are not inspected after they fail over.
Session failover is not supported for sessions being scanned by proxy-based security profiles.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.