Session preservation keeps active sessions, such as SSL VPNs, tied to the original interface to prevent disruption when WAN routes change.

The server FortiGate requires a CA certificate to verify the client FortiGate certificate.
When configuring an SSL VPN tunnel between two FortiGates, the server FortiGate must verify the authenticity of the connecting client's certificate. This is done using a CA certificate installed on the server to ensure the client certificate is trusted.
The client FortiGate requires a client certificate signed by the CA on the server FortiGate.
The client FortiGate uses this client certificate to authenticate itself to the server during SSL VPN negotiation. The certificate must be signed by the same CA trusted by the server to establish a secure, validated SSL VPN connection.

The VIP object maps the external IP 100.65.0.200:443 to the internal server 10.0.11.50:4443.
Since NAT is disabled on the firewall policy, the source IP is preserved.
So, when host 100.65.1.111 connects to 100.65.0.200:443:
- The source remains 100.65.1.111.
- The destination IP is translated to 10.0.11.50.
- The destination port is translated to 4443.

Lowest Cost (SLA) without load balancing → This is a valid strategy, selecting the path with the lowest cost that meets SLA requirements.
Lowest Cost (SLA) with load balancing → Also valid; it distributes sessions across the lowest-cost links that satisfy the SLA.
Best Quality with load balancing → Valid; it chooses the best-performing link based on SLA metrics such as latency, jitter, and packet loss, while also distributing sessions.

Flow-based antivirus buffers the entire file while simultaneously transmitting data to the client to minimize latency.
Flow-based inspection combines multiple scanning techniques from proxy-based modes for efficient detection.
Flow-based inspection provides better performance by processing traffic on the fly without full proxy overhead.