UTM Flow-based Inspection and Asymmetric Traffic
UTM inspection (flow or proxy based) for a session is not expected to work properly if the traffic in the session is balanced across more than one FortiGate in either direction. Flow-based UTM should be used in FGSP deployments.
For an environment where traffic is symmetric, UTM can be used with the following limitations:
• No session synchronization for the sessions inspected using proxy-based UTM. Sessions will drop and need to be reestablished after data path failover.
• Sessions with flow-based UTM will failover; however, inspection of failed over sessions after the failover may not work.
A single FortiGate must see both the request and reply traffic for UTM inspection to function correctly. For environments where asymmetric traffic is expected, UTM inspection should not be used.