NSE4 · Question #439
In a high availability cluster operating in active-active mode, which of the following correctly describes the path taken by the SYN packet of an HTTP session that is offloaded to a slave unit?
The correct answer is D. Client - > master FortiGate - >slave FortiGate - > web server. In a FortiGate active-active HA cluster, the initial SYN packet of a session offloaded to a slave unit first arrives at the master FortiGate, which then directs it to the appropriate slave unit for processing before it reaches the destination web server.
Question
In a high availability cluster operating in active-active mode, which of the following correctly describes the path taken by the SYN packet of an HTTP session that is offloaded to a slave unit?
Options
- AClient - > slave FortiGate - > master FortiGate - > web server.
- BClient - > slave FortiGate - > web server.
- CClient - > master FortiGate - > slave FortiGate - > master FortiGate - >web server.
- DClient - > master FortiGate - >slave FortiGate - > web server.
How the community answered
(45 responses)- A4% (2)
- B2% (1)
- C2% (1)
- D91% (41)
Why each option
In a FortiGate active-active HA cluster, the initial SYN packet of a session offloaded to a slave unit first arrives at the master FortiGate, which then directs it to the appropriate slave unit for processing before it reaches the destination web server.
Traffic does not typically flow back from the slave to the master after a session is offloaded for processing to the web server; the slave directly handles the session.
In active-active HA, the slave unit does not directly receive the *initial* client traffic for session establishment; the master acts as the initial point of contact for session distribution.
This path involves unnecessary multiple transfers between the master and slave units after the initial offload; once offloaded, the slave typically processes the session directly to the destination.
In an active-active FortiGate HA setup, all incoming traffic initially hits the master unit, which then performs session distribution or offloading to a slave unit that handles the session, meaning the SYN packet traverses from client to master, then to slave, then to the web server.
Concept tested: FortiGate HA active-active session offload
Source: https://docs.fortinet.com/document/fortigate/7.4.0/fortios-handbook/705701/session-load-balancing-in-active-active-ha
Topics
Community Discussion
No community discussion yet for this question.