Technical Tip: How to see if a session is synced in HA

[tlegentil_FTNT]

Description

This article intends to know which session is in sync with a slave FortiGate.

Scope

FortiGate.

Solution

It is assumed that an HA cluster of FortiGates is being used, and that session-pickup is enabled:

config sys ha
    set session-pickup enable
end

The synced sessions have the 'synced' flag. The command 'diag sys session list' can be used to see the sessions on the member, with the associated flags.

The number of sessions that are synced on each member can be seen by using the following:

diag sys session list | grep synced -c
exec ha manage 1
diag sys session list | grep syn_ses -c

This number may differ because not all sessions are synced.  By default, no session is synced. 

If session-pickup is enabled, only TCP and IPsec sessions are synced (with exceptions given in the 'Session failover not supported for all sessions' section of the 'FortiOS Handbook - High Availability').

session-pickup-connectionless can also be enabled to sync UDP and ICMP sessions.