Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY 8.0.0
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
All Products
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Web Application Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • Web Application / API Protection
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions
    • All Products

    Administration Guide

    Home FortiGate / FortiOS 8.0.0 Administration Guide
    8.0.0
    8.0.0
    7.6.6
    7.6.5
    7.6.4
    7.6.3
    7.6.2
    7.6.1
    7.6.0
    7.4.11
    7.4.10
    7.4.9
    7.4.8
    7.4.7
    7.4.6
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.13
    7.2.12
    7.2.11
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.19
    7.0.18
    7.0.17
    7.0.16
    7.0.15
    7.0.14
    7.0.13
    7.0.12
    7.0.11
    7.0.10
    7.0.9
    7.0.8
    7.0.7
    7.0.6
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.4.0

    FGCP and FGSP synchronizes full-cone expectation sessions when session-pickup-expectation enabled

    FGCP and FGSP synchronizes full-cone expectation sessions when session-pickup-expectation enabled

    FGCP or FGSP HA configured to synchronize expectation sessions, now also synchronizes full cone NAT UDP expectation sessions. For information about full cone NAT, see Full cone NAT for fixed port range IP pools.

    HA configuration to synchronize UDP and expectation sessions:

    config system ha
    set session-pickup enable
    set session-pickup-connectionless enable
    set session-pickup-expectation enable
end

    Example configuration

    Example HA configuration with session-pickup, session-pickup-connectionless, and session-pickup-expectation enabled.

    config system ha
    set group-id 240
    set group-name FG_HA
    set mode a-p
    set password <password>
    set hbdev ha1 50 ha2 100
    set session-pickup enable
    set session-pickup-connectionless enable
    set session-pickup-expectation enable
    set override enable
    set priority 255
end

    Example Full cone NAT IP pool:

    config firewall ippool
    edit full_cone_nat
        set type fixed-port-range
        set startip 172.16.200.155
        set endip 172.16.200.165
        set startport 5000
        set endport 5087
        set source-startip 10.1.100.10
        set source-endip 10.1.100.23
        set port-per-user 32
        set permit-any-host enable
    end

    Example full cone NAT Firewall policy:

    config firewall policy
    edit 10
        set name FW
        set uuid a2efc630-015a-51f1-a27b-aa72f6406517
        set srcintf port1
        set dstintf wan1
        set action accept
        set srcaddr all
        set dstaddr all
        set schedule always
        set service ALL
        set auto-asic-offload disable
        set nat enable
        set ippool enable
        set poolname full_cone_nat
    end

    In the example, the server connects to Client2 and this opens up full cone NAT ports on the FortiGate cluster wan1 interface that allow CLient1 and Client2 to connect through the FortiGate to the server.

    When the server connects to Client2, the following session is created on the primary FortiGate in the HA cluster:

    diagnose sys session list

session info: proto=17 proto_state=00 duration=218 expire=179 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=5
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=may_dirty synced f16
statistic(bytes/packets/allow_err): org=29145088/19456/1 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 133569/1068 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=11->7/7->11 gwy=172.16.200.55/0.0.0.0
hook=post dir=org act=snat 10.1.100.11:5050->172.16.200.55:5001(172.16.200.155:5050)
hook=pre dir=reply act=dnat 172.16.200.55:5001->172.16.200.155:5050(10.1.100.11:5050)
misc=0 policy_id=10 pol_uuid_idx=667 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x000001 no_offload
no_ofld_reason:  disabled-by-policy
hrx info: valid=1/0, qid=7/0, npuid=1/0, sublink=0/0

    Because of full cone NAT, the following expectation sessions are also created on the primary FortiGate:

    diagnose sys session list expectation

session info: proto=17 proto_state=00 duration=251 expire=-221 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=2
origin-shaper=
reply-shaper=
per_ip_shaper=
master session: proto=17 10.1.100.11:5050->172.16.200.55:5001
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=255/255
state=new f31
statistic(bytes/packets/allow_err): org=0/0/0 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=11->7/7->11 gwy=0.0.0.0/0.0.0.0
hook=pre dir=org act=dnat 10.1.100.11:0->172.16.200.155:5050(10.1.100.11:0)
hook=pre dir=org act=noop 0.0.0.0:0->0.0.0.0:0(0.0.0.0:0)
misc=0 policy_id=10 pol_uuid_idx=0 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x4000000
no_ofld_reason:  new
hrx info: valid=0/0, qid=0/0, npuid=0/0, sublink=0/0

session info: proto=17 proto_state=00 duration=251 expire=-221 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=2
origin-shaper=
reply-shaper=
per_ip_shaper=
master session: proto=17 10.1.100.11:5050->172.16.200.55:5001
class_id=0 ha_id=0 policy_dir=1 tunnel=/ vlan_cos=255/255
state=new f31
statistic(bytes/packets/allow_err): org=0/0/0 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=0->11/11->0 gwy=0.0.0.0/0.0.0.0
hook=pre dir=org act=dnat 0.0.0.0:0->172.16.200.155:5050(10.1.100.11:5050)
hook=pre dir=org act=noop 0.0.0.0:0->0.0.0.0:0(0.0.0.0:0)
misc=0 policy_id=10 pol_uuid_idx=0 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x4000000
no_ofld_reason:  new
hrx info: valid=0/0, qid=0/0, npuid=0/0, sublink=0/0

    HA synchronizes the following session to the backup or secondary FortiGate:

    diagnose sys session list

session info: proto=17 proto_state=00 duration=338 expire=111 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=5
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=dirty may_dirty syn_ses
statistic(bytes/packets/allow_err): org=0/0/0 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=11->7/7->11 gwy=0.0.0.0/0.0.0.0
hook=post dir=org act=snat 10.1.100.11:5050->172.16.200.55:5001(172.16.200.155:5050)
hook=pre dir=reply act=dnat 172.16.200.55:5001->172.16.200.155:5050(10.1.100.11:5050)
misc=0 policy_id=10 pol_uuid_idx=0 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x4000000
no_ofld_reason:  npu-flag-off
hrx info: valid=0/0, qid=0/0, npuid=0/0, sublink=0/0

    As well, HA synchronizes the following expectation sessions to the backup or secondary FortiGate:

    diagnose sys session list expectation

session info: proto=17 proto_state=00 duration=107 expire=-77 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=2
origin-shaper=
reply-shaper=
per_ip_shaper=
master session: proto=17 10.1.100.11:5050->172.16.200.55:5001
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=255/255
state=new synced f31
statistic(bytes/packets/allow_err): org=0/0/0 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=11->7/7->11 gwy=0.0.0.0/0.0.0.0
hook=pre dir=org act=dnat 10.1.100.11:0->172.16.200.155:5050(10.1.100.11:0)
hook=pre dir=org act=noop 0.0.0.0:0->0.0.0.0:0(0.0.0.0:0)
misc=0 policy_id=10 pol_uuid_idx=665 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x000001 no_offload
no_ofld_reason:  new disabled-by-policy
hrx info: valid=0/0, qid=0/0, npuid=0/0, sublink=0/0

session info: proto=17 proto_state=00 duration=107 expire=-77 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=2
origin-shaper=
reply-shaper=
per_ip_shaper=
master session: proto=17 10.1.100.11:5050->172.16.200.55:5001
class_id=0 ha_id=0 policy_dir=1 tunnel=/ vlan_cos=255/255
state=new synced f31
statistic(bytes/packets/allow_err): org=0/0/0 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=0->11/11->0 gwy=0.0.0.0/0.0.0.0
hook=pre dir=org act=dnat 0.0.0.0:0->172.16.200.155:5050(10.1.100.11:5050)
hook=pre dir=org act=noop 0.0.0.0:0->0.0.0.0:0(0.0.0.0:0)
misc=0 policy_id=10 pol_uuid_idx=665 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x000001 no_offload
no_ofld_reason:  new disabled-by-policy
hrx info: valid=0/0, qid=0/0, npuid=0/0, sublink=0/0

    Full cone NAT also allows Client1 to connect to the server through the FortiGate cluster. After Client1 connects, the primary FortiGate includes the following sessions:

    diagnose sys session list

session info: proto=17 proto_state=00 duration=454 expire=1724 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=4
origin-shaper=
reply-shaper=
per_ip_shaper=
master session: proto=17 10.1.100.11:5050->172.16.200.55:5001
class_id=0 ha_id=0 policy_dir=1 tunnel=/ vlan_cos=255/255
state=synced intree
statistic(bytes/packets/allow_err): org=22717170/15165/1 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 55604/444 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=7->11/11->7 gwy=10.1.100.11/172.16.200.44
hook=pre dir=org act=dnat 172.16.200.44:5020->172.16.200.155:5050(10.1.100.11:5050)
hook=post dir=reply act=snat 10.1.100.11:5050->172.16.200.44:5020(172.16.200.155:5050)
misc=0 policy_id=10 pol_uuid_idx=665 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x000001 no_offload
no_ofld_reason:  disabled-by-policy
hrx info: valid=1/1, qid=4/6, npuid=1/1, sublink=0/0

session info: proto=17 proto_state=00 duration=454 expire=104 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=6
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=dirty may_dirty synced f16
statistic(bytes/packets/allow_err): org=263648/176/1 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=11->7/7->11 gwy=172.16.200.55/0.0.0.0
hook=post dir=org act=snat 10.1.100.11:5050->172.16.200.55:5001(172.16.200.155:5050)
hook=pre dir=reply act=dnat 172.16.200.55:5001->172.16.200.155:5050(10.1.100.11:5050)
misc=0 policy_id=10 pol_uuid_idx=665 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x000001 no_offload
no_ofld_reason:  disabled-by-policy
hrx info: valid=1/0, qid=7/0, npuid=1/0, sublink=0/0
total session: 2

    And these sessions are synchronized to the backup or secondary FortiGate:

    diag sys session list


session info: proto=17 proto_state=00 duration=443 expire=1463 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=4
origin-shaper=
reply-shaper=
per_ip_shaper=
master session: proto=17 10.1.100.11:5050->172.16.200.55:5001
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=255/255
state=syn_ses intree
statistic(bytes/packets/allow_err): org=0/0/0 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=7->11/11->7 gwy=0.0.0.0/0.0.0.0
hook=pre dir=org act=dnat 172.16.200.44:5020->172.16.200.155:5050(10.1.100.11:5050)
hook=post dir=reply act=snat 10.1.100.11:5050->172.16.200.44:5020(172.16.200.155:5050)
misc=0 policy_id=10 pol_uuid_idx=0 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x4000000
no_ofld_reason:  npu-flag-off
hrx info: valid=0/0, qid=0/0, npuid=0/0, sublink=0/0

session info: proto=17 proto_state=00 duration=443 expire=6 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=5
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=dirty may_dirty syn_ses
statistic(bytes/packets/allow_err): org=0/0/0 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=11->7/7->11 gwy=0.0.0.0/0.0.0.0
hook=post dir=org act=snat 10.1.100.11:5050->172.16.200.55:5001(172.16.200.155:5050)
hook=pre dir=reply act=dnat 172.16.200.55:5001->172.16.200.155:5050(10.1.100.11:5050)
misc=0 policy_id=10 pol_uuid_idx=0 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x4000000
no_ofld_reason:  npu-flag-off
hrx info: valid=0/0, qid=0/0, npuid=0/0, sublink=0/0
total session: 2

    Because these sessions are synchronized, after an HA failover, Client1 and Client2 can continue communicating with the server.

    Previous
    Next

    FGCP and FGSP synchronizes full-cone expectation sessions when session-pickup-expectation enabled

    FGCP and FGSP synchronizes full-cone expectation sessions when session-pickup-expectation enabled

    FGCP or FGSP HA configured to synchronize expectation sessions, now also synchronizes full cone NAT UDP expectation sessions. For information about full cone NAT, see Full cone NAT for fixed port range IP pools.

    HA configuration to synchronize UDP and expectation sessions:

    config system ha
    set session-pickup enable
    set session-pickup-connectionless enable
    set session-pickup-expectation enable
end

    Example configuration

    Example HA configuration with session-pickup, session-pickup-connectionless, and session-pickup-expectation enabled.

    config system ha
    set group-id 240
    set group-name FG_HA
    set mode a-p
    set password <password>
    set hbdev ha1 50 ha2 100
    set session-pickup enable
    set session-pickup-connectionless enable
    set session-pickup-expectation enable
    set override enable
    set priority 255
end

    Example Full cone NAT IP pool:

    config firewall ippool
    edit full_cone_nat
        set type fixed-port-range
        set startip 172.16.200.155
        set endip 172.16.200.165
        set startport 5000
        set endport 5087
        set source-startip 10.1.100.10
        set source-endip 10.1.100.23
        set port-per-user 32
        set permit-any-host enable
    end

    Example full cone NAT Firewall policy:

    config firewall policy
    edit 10
        set name FW
        set uuid a2efc630-015a-51f1-a27b-aa72f6406517
        set srcintf port1
        set dstintf wan1
        set action accept
        set srcaddr all
        set dstaddr all
        set schedule always
        set service ALL
        set auto-asic-offload disable
        set nat enable
        set ippool enable
        set poolname full_cone_nat
    end

    In the example, the server connects to Client2 and this opens up full cone NAT ports on the FortiGate cluster wan1 interface that allow CLient1 and Client2 to connect through the FortiGate to the server.

    When the server connects to Client2, the following session is created on the primary FortiGate in the HA cluster:

    diagnose sys session list

session info: proto=17 proto_state=00 duration=218 expire=179 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=5
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=may_dirty synced f16
statistic(bytes/packets/allow_err): org=29145088/19456/1 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 133569/1068 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=11->7/7->11 gwy=172.16.200.55/0.0.0.0
hook=post dir=org act=snat 10.1.100.11:5050->172.16.200.55:5001(172.16.200.155:5050)
hook=pre dir=reply act=dnat 172.16.200.55:5001->172.16.200.155:5050(10.1.100.11:5050)
misc=0 policy_id=10 pol_uuid_idx=667 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x000001 no_offload
no_ofld_reason:  disabled-by-policy
hrx info: valid=1/0, qid=7/0, npuid=1/0, sublink=0/0

    Because of full cone NAT, the following expectation sessions are also created on the primary FortiGate:

    diagnose sys session list expectation

session info: proto=17 proto_state=00 duration=251 expire=-221 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=2
origin-shaper=
reply-shaper=
per_ip_shaper=
master session: proto=17 10.1.100.11:5050->172.16.200.55:5001
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=255/255
state=new f31
statistic(bytes/packets/allow_err): org=0/0/0 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=11->7/7->11 gwy=0.0.0.0/0.0.0.0
hook=pre dir=org act=dnat 10.1.100.11:0->172.16.200.155:5050(10.1.100.11:0)
hook=pre dir=org act=noop 0.0.0.0:0->0.0.0.0:0(0.0.0.0:0)
misc=0 policy_id=10 pol_uuid_idx=0 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x4000000
no_ofld_reason:  new
hrx info: valid=0/0, qid=0/0, npuid=0/0, sublink=0/0

session info: proto=17 proto_state=00 duration=251 expire=-221 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=2
origin-shaper=
reply-shaper=
per_ip_shaper=
master session: proto=17 10.1.100.11:5050->172.16.200.55:5001
class_id=0 ha_id=0 policy_dir=1 tunnel=/ vlan_cos=255/255
state=new f31
statistic(bytes/packets/allow_err): org=0/0/0 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=0->11/11->0 gwy=0.0.0.0/0.0.0.0
hook=pre dir=org act=dnat 0.0.0.0:0->172.16.200.155:5050(10.1.100.11:5050)
hook=pre dir=org act=noop 0.0.0.0:0->0.0.0.0:0(0.0.0.0:0)
misc=0 policy_id=10 pol_uuid_idx=0 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x4000000
no_ofld_reason:  new
hrx info: valid=0/0, qid=0/0, npuid=0/0, sublink=0/0

    HA synchronizes the following session to the backup or secondary FortiGate:

    diagnose sys session list

session info: proto=17 proto_state=00 duration=338 expire=111 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=5
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=dirty may_dirty syn_ses
statistic(bytes/packets/allow_err): org=0/0/0 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=11->7/7->11 gwy=0.0.0.0/0.0.0.0
hook=post dir=org act=snat 10.1.100.11:5050->172.16.200.55:5001(172.16.200.155:5050)
hook=pre dir=reply act=dnat 172.16.200.55:5001->172.16.200.155:5050(10.1.100.11:5050)
misc=0 policy_id=10 pol_uuid_idx=0 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x4000000
no_ofld_reason:  npu-flag-off
hrx info: valid=0/0, qid=0/0, npuid=0/0, sublink=0/0

    As well, HA synchronizes the following expectation sessions to the backup or secondary FortiGate:

    diagnose sys session list expectation

session info: proto=17 proto_state=00 duration=107 expire=-77 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=2
origin-shaper=
reply-shaper=
per_ip_shaper=
master session: proto=17 10.1.100.11:5050->172.16.200.55:5001
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=255/255
state=new synced f31
statistic(bytes/packets/allow_err): org=0/0/0 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=11->7/7->11 gwy=0.0.0.0/0.0.0.0
hook=pre dir=org act=dnat 10.1.100.11:0->172.16.200.155:5050(10.1.100.11:0)
hook=pre dir=org act=noop 0.0.0.0:0->0.0.0.0:0(0.0.0.0:0)
misc=0 policy_id=10 pol_uuid_idx=665 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x000001 no_offload
no_ofld_reason:  new disabled-by-policy
hrx info: valid=0/0, qid=0/0, npuid=0/0, sublink=0/0

session info: proto=17 proto_state=00 duration=107 expire=-77 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=2
origin-shaper=
reply-shaper=
per_ip_shaper=
master session: proto=17 10.1.100.11:5050->172.16.200.55:5001
class_id=0 ha_id=0 policy_dir=1 tunnel=/ vlan_cos=255/255
state=new synced f31
statistic(bytes/packets/allow_err): org=0/0/0 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=0->11/11->0 gwy=0.0.0.0/0.0.0.0
hook=pre dir=org act=dnat 0.0.0.0:0->172.16.200.155:5050(10.1.100.11:5050)
hook=pre dir=org act=noop 0.0.0.0:0->0.0.0.0:0(0.0.0.0:0)
misc=0 policy_id=10 pol_uuid_idx=665 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x000001 no_offload
no_ofld_reason:  new disabled-by-policy
hrx info: valid=0/0, qid=0/0, npuid=0/0, sublink=0/0

    Full cone NAT also allows Client1 to connect to the server through the FortiGate cluster. After Client1 connects, the primary FortiGate includes the following sessions:

    diagnose sys session list

session info: proto=17 proto_state=00 duration=454 expire=1724 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=4
origin-shaper=
reply-shaper=
per_ip_shaper=
master session: proto=17 10.1.100.11:5050->172.16.200.55:5001
class_id=0 ha_id=0 policy_dir=1 tunnel=/ vlan_cos=255/255
state=synced intree
statistic(bytes/packets/allow_err): org=22717170/15165/1 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 55604/444 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=7->11/11->7 gwy=10.1.100.11/172.16.200.44
hook=pre dir=org act=dnat 172.16.200.44:5020->172.16.200.155:5050(10.1.100.11:5050)
hook=post dir=reply act=snat 10.1.100.11:5050->172.16.200.44:5020(172.16.200.155:5050)
misc=0 policy_id=10 pol_uuid_idx=665 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x000001 no_offload
no_ofld_reason:  disabled-by-policy
hrx info: valid=1/1, qid=4/6, npuid=1/1, sublink=0/0

session info: proto=17 proto_state=00 duration=454 expire=104 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=6
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=dirty may_dirty synced f16
statistic(bytes/packets/allow_err): org=263648/176/1 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=11->7/7->11 gwy=172.16.200.55/0.0.0.0
hook=post dir=org act=snat 10.1.100.11:5050->172.16.200.55:5001(172.16.200.155:5050)
hook=pre dir=reply act=dnat 172.16.200.55:5001->172.16.200.155:5050(10.1.100.11:5050)
misc=0 policy_id=10 pol_uuid_idx=665 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x000001 no_offload
no_ofld_reason:  disabled-by-policy
hrx info: valid=1/0, qid=7/0, npuid=1/0, sublink=0/0
total session: 2

    And these sessions are synchronized to the backup or secondary FortiGate:

    diag sys session list


session info: proto=17 proto_state=00 duration=443 expire=1463 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=4
origin-shaper=
reply-shaper=
per_ip_shaper=
master session: proto=17 10.1.100.11:5050->172.16.200.55:5001
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=255/255
state=syn_ses intree
statistic(bytes/packets/allow_err): org=0/0/0 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=7->11/11->7 gwy=0.0.0.0/0.0.0.0
hook=pre dir=org act=dnat 172.16.200.44:5020->172.16.200.155:5050(10.1.100.11:5050)
hook=post dir=reply act=snat 10.1.100.11:5050->172.16.200.44:5020(172.16.200.155:5050)
misc=0 policy_id=10 pol_uuid_idx=0 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x4000000
no_ofld_reason:  npu-flag-off
hrx info: valid=0/0, qid=0/0, npuid=0/0, sublink=0/0

session info: proto=17 proto_state=00 duration=443 expire=6 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=5
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=dirty may_dirty syn_ses
statistic(bytes/packets/allow_err): org=0/0/0 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=11->7/7->11 gwy=0.0.0.0/0.0.0.0
hook=post dir=org act=snat 10.1.100.11:5050->172.16.200.55:5001(172.16.200.155:5050)
hook=pre dir=reply act=dnat 172.16.200.55:5001->172.16.200.155:5050(10.1.100.11:5050)
misc=0 policy_id=10 pol_uuid_idx=0 auth_info=0 chk_client_info=0 vd=0
serial=000018fd tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfw_id=n/a duplicaton_id=0
npu_state=0x4000000
no_ofld_reason:  npu-flag-off
hrx info: valid=0/0, qid=0/0, npuid=0/0, sublink=0/0
total session: 2

    Because these sessions are synchronized, after an HA failover, Client1 and Client2 can continue communicating with the server.

    Previous
    Next