What are the requirements for a cluster to maintain TCP connections after device or link failover? (Select all that apply.)

Session pick-up, or session synchronization, is crucial for maintaining active TCP connections during a failover event in a FortiGate HA cluster. It ensures that the session state is replicated between cluster members, allowing the new primary device to seamlessly resume existing connections.

Session pick-up is generally effective for flow-based sessions, but connections handled by a proxy often cannot be picked up because the proxy maintains a more complex, application-layer state specific to itself.

Session pick-up primarily applies to stateful protocols like TCP, which maintain an ongoing connection state. UDP and ICMP are connectionless protocols and do not rely on session pick-up in the same manner for continuity during failover.

For session pick-up to function correctly and maintain TCP connections across failover, the traffic must be handled in flow-based inspection mode. Connections processed in proxy mode (e.g., explicit web proxy, certain deep SSL inspection scenarios) typically cannot be picked up by another device in the cluster, leading to connection resets during failover.