FortiGate keeps the session table intact when a firewall-policy entry is edited. Packets that belong to sessions already present in the session table continue to match the policy that was in effect when the session was first created, so those sessions are not reset or re-evaluated (option C). Only traffic that triggers the creation of a new session is examined against the updated policy set; therefore the new or modified rules are applied only to new sessions (option D).

A. FortiGate flushes all sessions – Session table is retained; flush occurs only with an explicit diagnose sys session clear command.

B. FortiGate terminates the old sessions – Existing sessions remain active until they age out or are closed normally; no automatic teardown follows a policy edit.

1. Fortinet, “FortiOS 7.2 Administration Guide – Firewall Policy, Changing firewall policies,” p. 339-340: “Changes do not affect sessions already in the session table; new sessions are evaluated against the new policy set.”

2. Fortinet KB Article FD30165 “How does a change to a firewall policy affect existing sessions?” (2022): para 2 “Existing sessions continue untouched; only new sessions are matched against the revised policy.”

3. Fortinet NSE7 SD-WAN 7.2 Study Guide (official), Module 3 “Session Management,” slide 18: “Policy edits are forward-looking; current sessions stay bound to their original rule.”