nerdexam
Fortinet

NSE4 · Question #439

In a high availability cluster operating in active-active mode, which of the following correctly describes the path taken by the SYN packet of an HTTP session that is offloaded to a slave unit?

The correct answer is D. Client - > master FortiGate - >slave FortiGate - > web server. In a FortiGate active-active HA cluster, the initial SYN packet of a session offloaded to a slave unit first arrives at the master FortiGate, which then directs it to the appropriate slave unit for processing before it reaches the destination web server.

Submitted by chiamaka_o· Apr 18, 2026FortiGate Deployment and System Configuration

Question

In a high availability cluster operating in active-active mode, which of the following correctly describes the path taken by the SYN packet of an HTTP session that is offloaded to a slave unit?

Options

  • AClient - > slave FortiGate - > master FortiGate - > web server.
  • BClient - > slave FortiGate - > web server.
  • CClient - > master FortiGate - > slave FortiGate - > master FortiGate - >web server.
  • DClient - > master FortiGate - >slave FortiGate - > web server.

How the community answered

(45 responses)
  • A
    4% (2)
  • B
    2% (1)
  • C
    2% (1)
  • D
    91% (41)

Why each option

In a FortiGate active-active HA cluster, the initial SYN packet of a session offloaded to a slave unit first arrives at the master FortiGate, which then directs it to the appropriate slave unit for processing before it reaches the destination web server.

AClient - > slave FortiGate - > master FortiGate - > web server.

Traffic does not typically flow back from the slave to the master after a session is offloaded for processing to the web server; the slave directly handles the session.

BClient - > slave FortiGate - > web server.

In active-active HA, the slave unit does not directly receive the *initial* client traffic for session establishment; the master acts as the initial point of contact for session distribution.

CClient - > master FortiGate - > slave FortiGate - > master FortiGate - >web server.

This path involves unnecessary multiple transfers between the master and slave units after the initial offload; once offloaded, the slave typically processes the session directly to the destination.

DClient - > master FortiGate - >slave FortiGate - > web server.Correct

In an active-active FortiGate HA setup, all incoming traffic initially hits the master unit, which then performs session distribution or offloading to a slave unit that handles the session, meaning the SYN packet traverses from client to master, then to slave, then to the web server.

Concept tested: FortiGate HA active-active session offload

Source: https://docs.fortinet.com/document/fortigate/7.4.0/fortios-handbook/705701/session-load-balancing-in-active-active-ha

Topics

#High Availability (HA)#Active-Active HA#Session Offloading#Packet Flow

Community Discussion

No community discussion yet for this question.

Full NSE4 Practice