Refer to the exhibit, which shows the output of diagnose sys session list.
If the HA ID for the primary device is 0, what happens if the primary fails and the secondary becomes the primary?
A.
The secondary device has this session synchronized; however, because application control is applied, the session is marked dirty and has to be re-evaluated after failover.
B.
Traffic for this session continues to be permitted on the new primary device after failover, without requiring the client to restart the session with the server.
C.
The session will be removed from the session table of the secondary device because of the presence of allowed error packets, which will force the client to restart the session with the server.
D.
The session state is preserved but the kernel will need to re-evaluate the session because NAT was applied.
The decisive session-state flag is synced. Fortinet defines this flag as indicating that the session has been synchronized to the other HA members. The session was created on HA member 0, and a synchronized copy is available to the secondary device.
The FortiOS 7.6 Administrator Study Guide states: “When you enable session synchronization, the new primary can resume communication for sessions after a failover event.” It further explains that session pickup allows existing sessions to continue through the newly elected primary with minimal or no interruption. Therefore, the established TCP session remains usable, and the client does not need to establish a new connection.
The may_dirty flag does not mean that the session is currently dirty. It identifies an allowed session that can be marked dirty later if a firewall-policy, routing, or related configuration change requires re- evaluation. The output does not contain the separate dirty flag. Additionally, app_ntf represents block-notification handling; it does not prove that application control is inspecting the session. The fields app_list=0 and app=0 reinforce this.
The allow_err values are session statistics and do not cause session deletion. Although act=snat and act=dnat confirm NAT, the translation tuples are part of the synchronized session state and do not independently require re-evaluation after FGCP failover.
[References: High Availability – Cluster Synchronization and HA Failover, pages 456 and 463; Fortinet: HA session failover; Fortinet: Session-table information., , , ]
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit