Chapter 9 High Availability for FortiOS 5.0 : HA and load balancing : Transparent mode active-active cluster packet flow : Packet flow from mail server to client
  
Packet flow from mail server to client
1. To respond to the client computer, the mail server issues an ARP request to 10.11.101.10.
2. The primary unit forwards the ARP request to the client computer.
3. The client computer responds with its MAC address (MAC_Client) which corresponds to its IP address of 10.11.101.10. The primary unit returns the ARP response to the mail server.
4. The mail server’s response packet reaches the primary unit external interface.
 
IP address
MAC address
Source
10.11.101.200
MAC_Server
Destination
10.11.101.10
MAC_Client
5. The primary unit decides that the subordinate unit should handle this packet, and forwards it to the subordinate unit external interface. The source MAC address of the forwarded packet is changed to the actual MAC address of the primary unit external interface.
 
IP address
MAC address
Source
10.11.101.200
MAC_P_ext
Destination
10.11.101.10
MAC_S_ext
6. The subordinate unit recognizes that packet has been forwarded from the primary unit and processes it.
7. The subordinate unit forwards the packet from its internal interface to the client.
 
IP address
MAC address
Source
10.11.101.200
MAC_S_int
Destination
10.11.101.10
MAC_Client
8. The primary unit forwards further packets in the same session to the subordinate unit.
9. Packets for other sessions are load balanced by the primary unit and either sent to the subordinate unit or processed by the primary unit.