In a high availability (HA) cluster operating in active-active mode, which of the following correctly describes the path taken by the SYN packet of an HTTP session that is offloaded to a secondary…

This path suggests the secondary FortiGate returns the traffic to the primary before reaching the server, which is incorrect; the secondary handles the session directly after offload.

This path bypasses the primary FortiGate entirely, which is incorrect for initial SYN packet processing and session offload in active-active HA.

This path incorrectly suggests the secondary unit forwards to the primary before reaching the web server, contradicting the direct flow of the offloaded session.

In an active-active FortiGate HA cluster, all initial traffic, including the SYN packet, ingress through the primary (master) unit. If the session is designated for offloading, the primary unit processes the SYN and then forwards the session to a secondary FortiGate for security processing and connection establishment, with the secondary unit then sending the traffic directly to the web server.