Troubleshooting Tip: Traffic getting denied after passing the load balancer in Azure in an HA Setup with FGSP

[odahy]

Description	This article describes how to fix traffic that gets denied after passing through the Azure load balancer towards FortiGate.
Scope	FortiGate Azure.
Solution	The setup is active-passive HA using unicast FortiGate Clustering Protocol (FGCP) HA with an external and internal Azure load balancer (LB). As the Azure load balancer will not perform a session persistence and streamline the session to only one FortiGate, it can send sessions to the second FortiGate, but not the one it was passing through originally. The second FortiGate will drop the session.  In order to resolve this issue, session persistence should be 'Client IP and protocol' and can be configured on the Azure Load balance side. The client IP and protocol (three-tuple: source IP, destination IP, and protocol type) specifies that successive requests from the same client IP address and protocol combination are handled by the same virtual machine. More on how to configure it on Azure can be found in this Microsoft article.