What must you configure to enable proxy-based TCP session failover?

To ensure that stateful TCP sessions, including those inspected by a proxy, are maintained after a high availability (HA) failover, you must enable session synchronization. In FortiOS, this feature is called "session pickup." The command session-pickup-enable under config system ha specifically activates the synchronization of the TCP session table between the primary and secondary FortiGate units. By default, this feature is disabled to conserve system resources, as it introduces overhead. Enabling it allows the new primary unit to take over existing TCP connections seamlessly without requiring users to re-establish their sessions.

A. ha-configuration-sync ensures that the configuration files are synchronized between cluster members, not the active session tables required for failover.
B. Session failover is not enabled by default. It must be explicitly configured to prevent the performance overhead of continuous session table synchronization.
D. session-pickup-connectionless enables session failover for connectionless protocols like UDP and ICMP, not for connection-oriented TCP sessions.

1. Fortinet FortiOS 7.0.0 Administration Guide, Page 1618, "HA session failover (session pickup)". The guide states, "To enable session failover, you must enable session pickup. To enable session pickup for TCP sessions, enter the following CLI commands: config system ha set session-pickup enable end".

2. Fortinet FortiOS 7.0.0 CLI Reference, Page 2717, config system ha. This reference defines the session-pickup command as "Enable/disable session pickup (session failover)." and confirms its default setting is disable. It also distinguishes it from session-pickup-connectionless.