Which statement about traffic flow in an active-active HA cluster is true?

Which statement about traffic flow in an active-active HA cluster is true?

A. The SYN packet from the client always arrives at the primary device first.

B. The secondary device responds to the primary device with a SYN/ACK, and then the primary device forwards the SYN/ACK to the client.

C. All FortiGate devices are assigned the same virtual MAC addresses for the HA heartbeat interfaces to redistribute to the sessions.

D. The ACK from the client is received on the physical MAC address of the primary device.

Answer: A

Explanation:

The correct statement about traffic flow in an active-active High Availability (HA) cluster is:

A. The SYN packet from the client always arrives at the primary device first.

In an active-active HA cluster, the primary device typically handles the initial SYN packet from the client.

The primary device then determines how to distribute the traffic among the cluster members.

The other statements are not accurate:

B is incorrect because the secondary device does not respond to the primary device with a SYN/ACK.

The response is usually handled by the primary device.

C is incorrect because in an active-active HA cluster, each FortiGate device has its own unique virtual MAC addresses for the HA heartbeat interfaces.

D is incorrect because the ACK from the client is generally processed by the same device that received the initial SYN packet, which is typically the primary device.

So, the correct choice is A.