Chapter 9 High Availability for FortiOS 5.0 : HA and load balancing : NAT/Route mode active-active cluster packet flow : Packet flow from web server to client
  
Packet flow from web server to client
1. When the web server responds to the client’s packet, the cluster external interface IP address (172.20.120.141) is recognized as the gateway to the internal network.
2. The web server issues an ARP request to 172.20.120.141.
3. The primary unit intercepts the ARP request, and responds with the external virtual MAC address (MAC_V_ext) which corresponds its IP address of 172.20.120.141.
4. The web server then sends response packets to the primary unit external interface.
 
IP address
MAC address
Source
172.20.120.130
MAC_Server
Destination
172.20.120.141
MAC_V_ext
5. The primary unit decides that the subordinate unit should handle this packet, and forwards it to the subordinate unit external interface. The source MAC address of the forwarded packet is changed to the actual MAC address of the primary unit external interface.
 
IP address
MAC address
Source
172.20.120.130
MAC_P_ext
Destination
172.20.120.141
MAC_S_ext
6. The subordinate unit recognizes that packet has been forwarded from the primary unit and processes it.
7. The subordinate unit forwards the packet from its internal interface to the client.
 
IP address
MAC address
Source
172.20.120.130
MAC_S_int
Destination
10.11.101.10
MAC_Client
8. The primary unit forwards further packets in the same session to the subordinate unit.
9. Packets for other sessions are load balanced by the primary unit and either sent to the subordinate unit or processed by the primary unit.