In a Google Cloud active-active High Availability (HA) deployment, FortiGate instances are placed behind load balancers. Asymmetrical routing occurs when a session's ingress and egress packets traverse different FortiGate instances, causing the stateful firewall to drop the return traffic.

To mitigate this, session affinity must be enabled on the external load balancer. This ensures that all packets for a specific client session are consistently sent to the same FortiGate instance.

For traffic originating from the internal network (egress), Source Network Address Translation (SNAT) must be enabled on the firewall policies. SNAT ensures that the return traffic is routed back to the same FortiGate that initiated the session, thereby maintaining session symmetry.

C. Configure FGSP (FortiGate Session Life Support Protocol).

FGSP synchronizes sessions for failover but does not correct the underlying cloud routing issue that causes asymmetry in a load-balanced active-active design.

D. Change the HA mode to active-passive.

This is a change in architecture, not a mitigation for an active-active deployment. It avoids the problem rather than solving it within the existing design.

1. Fortinet Document Library: FortiGate-VM on GCP Active-Active HA Deployment Guide 7.4.0.

Reference for Answer A (Session Affinity): Page 21, "Configuring the external TCP proxy load balancer", Step 6 states: "For Session affinity, select Client IP. This ensures that all requests from the same client are sent to the same backend." This directly addresses ingress traffic asymmetry.

Reference for Answer B (SNAT): Page 27, "Configuring firewall policies and static routes", Step 5 for the outbound policy states: "Enable NAT and select Use Outgoing Interface Address." The guide explains this is to ensure return traffic is correctly routed back to the originating FortiGate.