99/219 Which statement about traffic flow in an active-active HA cluster is true?

In a FortiGate active-active High Availability (HA) cluster, all new sessions must be processed by the primary unit first. Even if the initial packet of a new session (such as a TCP SYN packet) physically arrives at a secondary unit's interface, that unit immediately forwards the packet over the HA heartbeat link to the primary unit. The primary unit is responsible for creating the session, adding it to the session table, and then using its load-balancing algorithm to decide which cluster member (itself or a secondary unit) will own and process the subsequent packets for that session. Therefore, the primary device is always the first to process the SYN packet to establish a new session.

B: The unit that owns the session (which could be a secondary device) sends the SYN/ACK reply directly to the next hop. It does not route the reply back through the primary device. C: Virtual MAC addresses are assigned to the traffic-forwarding interfaces, not the HA heartbeat interfaces. The heartbeat interfaces use their physical MAC addresses for inter-device communication. D: Incoming traffic from the client is destined for the virtual MAC address of the cluster interface, not the physical MAC address of the primary device.

1. Fortinet NSE 4 - FortiOS 7.0 Study Guide - FortiGate Infrastructure:

Page 252

"Active-Active" section: "When a packet for a new session arrives at a cluster member

the receiving device forwards the session's first packet to the primary device over the HA link. The primary device creates the session in its session table and then forwards the session information to all the secondary devices. The primary device also decides which cluster member processes the session." This directly supports that the primary device processes the first packet (SYN).

2. FortiOS 7.0.5 HA Administration Guide:

Page 40

"How a cluster forwards traffic" section: "If the packet is the first packet of a new session

the receiving FortiGate forwards the packet to the primary unit over the HA heartbeat link. The primary unit adds the session to its session table and

if the cluster is running in active-active mode

the primary unit load balances the session to a cluster unit." This confirms the role of the primary unit in handling the initial packet of any new session.

Page 39

"Virtual MAC addresses" section: This section explains that virtual MAC addresses are used on interfaces that connect to the network to ensure traffic is correctly forwarded to the cluster

contradicting options C and D.