A FortiGate cluster carries long-lived sessions for an internal application, and the administrator needs those existing connections to survive a failover without being re-established. The HA configuration currently has session pickup left at its default state. Which action best meets this requirement?
- AEnable session pickup so the primary continuously synchronises its session table to the secondary, letting sessions resume after failover. Correct
- BLeave session pickup disabled because the synchronised configuration alone is enough to preserve active sessions through a failover.
- CSwitch the cluster from active-passive to active-active, since active-active mode keeps both units holding identical session tables at all times.
- DIncrease the HA heartbeat interval so the secondary has more time to copy sessions before declaring the primary failed.
Why A is correct: Session pickup synchronises the kernel session table from primary to secondary, so when the secondary takes over it already holds the active sessions and established connections continue without re-establishment.
Why B is wrong: Tempting because configuration synchronisation runs continuously, but config sync does not copy the live session table; without session pickup, sessions are rebuilt after failover rather than preserved.
Why C is wrong: Plausible because active-active shares the inspection load, but session survival across failover depends on session pickup, not on the active-active mode, which still relies on session synchronisation to preserve connections.
Why D is wrong: This misreads heartbeat timing; a longer interval delays failure detection rather than improving session continuity, and session preservation comes from session pickup synchronising the table, not from heartbeat tuning.