When configuring a FortiGate in a multi-WAN setup, why would an administrator enable session preservation on an interface?

In a multi-WAN environment, routing changes (such as a link failover) can cause the FortiGate to re-evaluate active sessions and move them to a new, better path. This can break stateful connections like SSL VPNs, VoIP calls, or long-lived TCP sessions that are sensitive to changes in the egress interface or source IP address. Enabling session preservation (preserve-session-route) on an interface instructs the FortiGate to not re-evaluate existing sessions originating from or passing through that interface. This ensures that established connections, like SSL VPNs, are "stuck" to their original path for the duration of the session, preventing disruption and maintaining connectivity even when the routing table changes.

A. This describes the default behavior when session preservation is disabled. The feature is enabled specifically to prevent sessions from dynamically changing interfaces.

B. Session preservation is independent of whether source NAT is used and its purpose is to maintain the current path, not force sessions to a designated primary link.

C. This is the opposite of the feature's intent. Session preservation is used to prevent session breaks that would force users to re-authenticate.

1. FortiOS 7.6.0 CLI Reference:

Under the config system interface command context

the set preserve-session-route {enable | disable} option is defined. The purpose is to "Enable/disable preservation of session route." This command directly controls the behavior described. (p. 1139)

2. FortiOS Administration Guide 7.6:

In the "SD-WAN" chapter

section "Session failover"

the guide explains the default behavior: "When an SD-WAN member fails

sessions are redirected to the next available member." It then discusses scenarios where this is undesirable

such as for SIP calls. Session preservation is the mechanism to prevent this redirection for sensitive traffic.

3. Fortinet Certified Professional - Network Security 7.6 Study Guide:

In the "Routing" chapter

the concept of session handling during route changes is discussed. It clarifies that by default

FortiGate is route-based

and if a route changes

the session is re-evaluated. It highlights that for services like SSL VPN

this can cause disconnection

and features like session preservation are used to maintain the original session path.