A closely related routing principle from the guide is:
“For each session, FortiGate performs two route lookups... After completing these two lookups, FortiGate writes the routing information to its session table. Subsequent packets are routed according to the session table, not the routing table.”
Also, the guide notes an HA limitation that helps explain the same design principle for FortiGate-terminated sessions:
“Enabling session pickup allows active sessions to be seamlessly handed picked up by the new primary in the event of an HA failover... Note that there are some limitations to this – for example, any sessions that terminate at the FortiGate itself ( e.g. SSL VPN, proxy sessions ) cannot be handed off to another FortiGate and must be restarted on the new primary.”
Technical Deep Dive:
The correct answer is D .
In multi-WAN environments, session preservation is used so that traffic for sessions that are tightly bound to the FortiGate interface they terminate on—most notably SSL VPN and other FortiGate-terminated flows—does not suddenly switch to another egress interface just because the routing table changes. Those sessions are sensitive to interface consistency. If replies start leaving through a different WAN after a route recalculation, the remote peer may see an address/interface mismatch and the session can break.
That means:
A is the opposite of session preservation. Preservation is meant to avoid moving active sessions around.
B is not the purpose of the feature.
C is unrelated.
D correctly describes why an administrator would enable it.
Operationally, this matters most for SSL VPN , management-plane flows, and other sessions that terminate on the FortiGate itself , not just ordinary transit traffic. Transit sessions are generally tracked in the session table and can often survive normal routing behavior more gracefully, but FortiGate-terminated sessions are much more sensitive to WAN/interface changes.
