Session synchronization and failover
The FortiGate Clustering Protocol (FGCP) provides failover protection, meaning that a cluster can continue to provide FortiGate services even when one of the devices in the cluster encounters a problem that would result in the complete loss of connectivity for a stand-alone FortiGate unit. See Failover protection for more information.
To ensure this continuity extends to active user data and to enable Session Failover, the cluster relies on the session synchronization. It achieves this by synchronizing the session table from the primary to the secondary device. Session failover (also called session-pickup) is not enabled by default for FortiGate. See Session pickup for more information.
Session failover means that after a primary unit fails, communications sessions resume on the new primary unit with minimal or no interruption. Because the sessions were synchronized, the new primary unit recognizes the open sessions that were being handled by the cluster and continues to process them according to their last known state. See Session handling for more information.
Session-pickup has some limitations. For example, session failover is not supported for sessions being scanned by proxy-based security profiles. Session failover is supported for sessions being scanned by flow-based security profiles; however, flow-based sessions that fail over are not inspected after they fail over. For more limitations, see Pass-through sessions.
Additionally, using the session-sync-dev option, you can select one or more FortiGate interfaces to use for synchronizing sessions as required for session pickup. See Improving session sync performance for more information.
To understand the depth of session failover, consider these specific examples of what is preserved during a failover:
|
Topic |
Summary |
|---|---|
|
Security does not stop during a failover. The new primary is able to pick up the traffic and immediately resume IPS scanning on ICCP streams ensuring no malicious data slips through during the transition. |
|
|
Session synchronization during HA failover for ZTNA proxy sessions |
For ZTNA, the cluster synchronizes the proxy sessions. This means that users connected using ZTNA do not lose their verified trust status or connection when the primary device fails. |