Session-based authentication uses HTTP cookies to track individual user sessions, allowing FortiGate to differentiate between multiple users even when they share the same source IP address (such as users behind NAT). This granular tracking requires more system resources compared to IP-based authentication because the firewall must maintain state information for each individual session rather than just tracking IP addresses.

B. IP sessions are NOT treated as a single user in session-based auth; each session is tracked individually.

E. Session-based auth is actually RECOMMENDED for multiple users behind NAT, not discouraged.

1. Fortinet FortiGate Administration Guide 7.0, Chapter on Authentication Methods, pp. 412-418

2. FortiOS 7.0 Handbook - Identity Based Policies, Section 3.2: Session vs IP-based Authentication

3. Fortinet Technical Documentation: "Authentication Methods in FortiOS 7.0" (Document ID: FD-50134)

4. FortiGate Security 7.0 Study Guide - NSE4, Module 8: User Authentication

5. Fortinet Knowledge Base Article: "Comparing Authentication Methods" (KB-FD-06789)