The page directive's session attribute controls whether session is enabled in a JSP. E.g., the following turns session off:
<%@ page session="false" %>
By default it is "true", i.e., session is enabled.
You don't need to "create" a session. The session object is already available for the JSP, and it can be accessed using the session implicit objects. (See JSP - Implicit Objects
on implicit objects.) See JSP - Session Tracking
for a usage example.
See also Servlet Session Tracking
on using the session object via a servlet.