For what three reasons must you deploy a set of Google Cloud passthrough network load balancers for an active-passive high-availability (HA)…

For a FortiGate active-passive HA cluster in Google Cloud, a passthrough network load balancer (NLB) is required over a proxy NLB for three primary reasons. First, the passthrough NLB preserves the original client source IP address, which is essential for the FortiGate to apply security policies and for accurate logging. Second, it can forward any IP protocol (such as TCP, UDP, ESP, ICMP), which is necessary for a firewall that must inspect all traffic types, including IPsec VPNs (ESP). Proxy load balancers are limited to specific protocols like TCP. Third, the active-passive HA architecture requires that traffic is directed to only a single active instance at any time. The passthrough NLB supports this model by using health checks to target the single healthy, active FortiGate VM in the backend pool or instance group.

A. This statement is true but incomplete. The more comprehensive reason is that passthrough NLBs support a wide range of IP protocols beyond just TCP and UDP, as stated in option D.

C. Session affinity is not a unique feature of passthrough NLBs. Google Cloud's proxy network load balancers also support session affinity, so this is not a distinguishing reason for the selection.

1. Google Cloud Documentation | External passthrough Network Load Balancer overview:

"These load balancers are not proxies. ... Packets are received by backend VMs with the packet's source and destination IP addresses, protocol, and... ports unchanged." This supports answer B (preserves source IP).

"You can load balance TCP, UDP, ESP, GRE, ICMP, and ICMPv6 traffic." This supports answer D (forwards any IP protocol).

2. Fortinet Document Library | FortiGate-VM on GCP deployment guide 7.4.1, Page 61:

In the section "Active-passive HA for FortiGate-VM on GCP", the guide specifies the architecture: "The external load balancer must be a TCP/UDP load balancer, not an HTTP(S) or SSL/TCP proxy load balancer." It further states, "The Network Load Balancer preserves the client’s IP address." This directly supports answer B.

3. Fortinet Document Library | FortiGate-VM on GCP deployment guide 7.4.1, Page 64:

The failover mechanism described involves a Cloud Function that "removes the failed primary FortiGate-VM from the instance group and adds the secondary FortiGate-VM to it." This confirms that the load balancer directs traffic to a single instance at a time, which is the core of the active-passive model, supporting answer E.