A. Configure session affinity on the external load balancer.
Session affinity on a load balancer only ensures that incoming traffic from a specific source is sent to the same FortiGate. It does not control the path of the return (egress) traffic.
B. Use GCP's built-in firewall rules to redirect traffic.
GCP firewall rules are used for permitting or denying traffic based on protocols, ports, and IP addresses. They do not perform traffic routing or redirection to enforce symmetric paths.
C. Enable FGSP (FortiGate Session Life Support Protocol) to synchronize sessions.
FGSP is designed to synchronize session tables between cluster members for stateful failover. It does not solve the root cause of asymmetric routing; rather, it is a mechanism to handle session continuity if a failure occurs.
References
1. Fortinet Document Library, "FortiGate-VM on GCP Active-Active HA deployment guide" (Version 7.4.0)
Section: Configuring the FortiGate instances > To configure the primary FortiGate-VM instance > Step 8
Content: The guide explicitly instructs the administrator to create a firewall policy for outbound traffic (e.g., from port2 to port1). In this policy's configuration, it states: "Enable NAT and select Use Outgoing Interface Address." This step directly implements SNAT to ensure symmetric routing for egress traffic.
2. Fortinet Document Library, "High Availability for FortiGate-VM on GCP"
Section: Architecture > Active-active HA
Content: This document describes the architecture where internal subnets have a default route pointing to an internal load balancer, which distributes traffic to the FortiGate instances. For this design to function correctly for stateful inspection of traffic going to the internet, the FortiGate must perform SNAT. The return traffic is then sent back to the public IP of the FortiGate that initiated the session, ensuring symmetry.
