What must you configure to enable proxy-based TCP session failover?

To ensure that stateful TCP sessions, including those inspected by a proxy, are maintained after a high availability (HA) failover, you must enable session synchronization. In FortiOS, this feature is called "session pickup." The command session-pickup-enable under config system ha specifically activates the synchronization of the TCP session table between the primary and secondary FortiGate units. By default, this feature is disabled to conserve system resources, as it introduces overhead. Enabling it allows the new primary unit to take over existing TCP connections seamlessly without requiring users to re-establish their sessions.

A. ha-configuration-sync ensures that the configuration files are synchronized between cluster members, not the active session tables required for failover.

B. Session failover is not enabled by default. It must be explicitly configured to prevent the performance overhead of continuous session table synchronization.

D. session-pickup-connectionless enables session failover for connectionless protocols like UDP and ICMP, not for connection-oriented TCP sessions.

1. Fortinet FortiOS 7.0.0 Administration Guide

Page 1618

"HA session failover (session pickup)". The guide states

"To enable session failover

you must enable session pickup. To enable session pickup for TCP sessions

enter the following CLI commands: config system ha set session-pickup enable end".

2. Fortinet FortiOS 7.0.0 CLI Reference

Page 2717

config system ha. This reference defines the session-pickup command as "Enable/disable session pickup (session failover)." and confirms its default setting is disable. It also distinguishes it from session-pickup-connectionless.