FortiGate SSL VPN Migration

FortiGate SSL VPN tunnel mode is removed.
Migrate to IPsec or ZTNA — planned, piloted, documented.

If your staff connect from home through FortiClient SSL VPN, the next FortiGate firmware upgrade can switch that off: FortiOS 7.6.3 removed SSL VPN tunnel mode from every FortiGate, and the upgrade does not carry those settings over. We move your remote users to IPsec IKEv2 (the replacement VPN), Agentless VPN (browser-only access), or ZTNA (per-app access that checks who and what device) — with SAML single sign-on and MFA intact and a side-by-side pilot, planned to avoid Monday-morning lockouts. The work is quoted after a short review of your users, rules and applications; inside a firewall migration it is part of the migration scope. One senior engineer with deep FortiGate experience is your point of contact from the first call to the final handover. On site in Sacramento and the Bay Area, remote across California.

Schedule a conversation Request a quote

What Fortinet Changed

FortiGate SSL VPN deprecated, removed, or end of life? Version by version.

Reviewed October 21, 2026 against Fortinet’s release notes. If you search “SSL VPN removed 7.4,” this is the part to read carefully.

2024 · 7.4.4

Fortinet published its first SSL VPN to IPsec VPN migration guide. SSL VPN itself stayed in 7.4 on almost every model.

2024 · 7.6.0 / 7.6.1

7.6.0 removed SSL VPN tunnel and web mode from 2 GB-RAM models: 40F family, 60F/61F, FGR-60F. 7.6.1 removed it from the 90G/91G as well.

2025 · 7.4.8

SSL VPN not available on entry-level G-series (50G, 70G, 90G and variants) from 7.4.8; on the 7.2 branch the 90G/91G lost it in 7.2.12. The 30G and 50G never supported it.

2025 · 7.6.3

SSL VPN tunnel mode removed on all models. Web mode survives on mid-range and larger models as Agentless VPN. Tunnel settings do not upgrade — migrate first.

Why Move Now

Why SSL VPN is worth retiring now.

Internet-facing SSL VPN has produced several critical, actively exploited FortiGate vulnerabilities. Replacing it shrinks the attack surface instead of waiting for the next advisory.

Repeated critical CVEs

CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762 were all SSL VPN flaws listed in CISA’s Known Exploited Vulnerabilities catalog.

Persistence after patching

In 2025 Fortinet disclosed that attackers who had exploited older flaws left a foothold in the SSL VPN file area that survived patching. Devices with SSL VPN disabled were not affected.

Forced by the upgrade path

Staying current on FortiOS 7.6.3 or later means losing tunnel mode anyway. Planning the move beats discovering it after a firmware update.

Better options exist

IPsec IKEv2 with FortiClient is Fortinet’s primary replacement and can run over TCP 443; ZTNA adds per-app, identity-based access.

Your Replacement Options

FortiGate SSL VPN to IPsec VPN migration: three paths, or a mix.

How to migrate FortiGate SSL VPN to IPsec: audit who connects and how they sign in, build the IKEv2 tunnel next to SSL VPN, pilot with FortiClient, roll out in waves, then disable SSL VPN and upgrade FortiOS. Pick one of three replacement methods, or mix them.

IPsec IKEv2 + FortiClient

Fortinet’s primary replacement for tunnel mode. Works with the free FortiClient VPN-only client — no EMS (Fortinet’s paid client-management server) required. Supports SAML/MFA, split tunneling, and IKE over TCP 443.

Agentless VPN

The renamed SSL VPN web mode on 7.6.3+: a browser portal for web, RDP, SSH, and file bookmarks. Not available on 2 GB models (the 40F family, 60F/61F, FGR-60F) or on the 90G/91G; from 7.6.4 Fortinet also lists the 50G and 70G families.

ZTNA

Per-application, identity- and device-aware access through FortiClient and EMS. The most granular model; requires paid EMS licensing. See ZTNA implementation on FortiGate for scope.

Mixed

If you have staff laptops and outside contractors, a split works: IPsec for staff, Agentless VPN or ZTNA for contractors and specific apps. Weighing VPN against ZTNA? Read our VPN to ZTNA migration guide. We document who gets what and why.

What the Migration Includes

Five phases, designed so users don’t lose access mid-week.

1 · SSL VPN audit

Users and groups, authentication (local, LDAP, RADIUS, SAML, MFA), portals and bookmarks, split-tunnel routes, DNS, FortiClient versions in the field, and which FortiGates and FortiOS versions are involved.

2 · Design

Target method per user group, IKEv2 phase 1/2 settings, port plan (UDP 500/4500 vs TCP 443), SAML/MFA flow, split tunnel and split DNS, FortiClient version and rollout method.

3 · Side-by-side pilot

IPsec runs alongside SSL VPN for a pilot group, including SAML. We validate on home, hotel, and cellular networks before anyone else moves.

4 · Rollout

FortiClient profile deployment and user instructions, in waves. Help-desk notes for the first week so issues get fixed, not escalated.

5 · Retire SSL VPN and upgrade

Disable SSL VPN and close its internet-facing port so nothing is left listening for attackers, then upgrade FortiOS on a tested path. Documentation handed to your team, or kept under a managed plan from $695 per site per month.

The Gotchas We Plan Around

Where SSL VPN migrations break.

These come straight from Fortinet’s documentation and field reports. Each one is a line item in our plan.

SAML needs IKEv2 + FortiClient

SAML over dial-up IPsec only works with IKEv2 and FortiClient 7.2.4+. Native Windows/macOS clients can’t do it, and browser-based login needs newer builds on both sides.

IKEv1 is gone in new clients

FortiClient 7.4.4 and later dropped IKEv1 entirely. Old IKEv1 dial-up configs need to move to IKEv2.

Port 443 collisions

IKE over TCP 443 needs FortiClient 7.4.1+ and IKEv2. On 7.6.1+ the default IKE TCP port is 443, which can collide with HTTPS admin access on the same interface.

Different defaults

SSL VPN enabled split tunneling by default; a custom IPsec tunnel does not. Split DNS requires IKEv2. LDAP over IKEv2 needs EAP-TTLS.

MFA proxies

RADIUS-based MFA (for example Duo proxy) with IKEv2 EAP is a common failure point. We test the exact chain in the pilot.

Certificates

Fortinet’s migration guide doesn’t cover moving certificate-based user authentication. If you use it, we design that piece explicitly.

Track Record

The numbers behind the outcomes.

We only do networks. That is not a limitation — it is why the outcomes are different.

Engineering

20+

Years of network-only practice. Architecture, security, and operations — not IT generalism.

Delivery

300+

Sites delivered. Healthcare clinics, law offices, financial branches, multi-site operations.

Availability

99.99%

Design target for fully redundant builds with HA firewalls, diverse ISPs, and backed-up power.

Ownership

100%

The same senior engineer, start to finish. No junior handoffs. No ticket queue. No escalation chain.

Career aggregate. The 20+ years and 300+ sites span the operator’s full network-only practice, including prior-employer engagements. 99.99% availability, about 53 minutes of downtime per year, is an architecture design target for engagements that fund full redundancy. It is not a service guarantee or uptime SLA. Contracted response times and service levels are defined in each customer agreement.

Where We Work

Sacramento, the Bay Area, and remote across California.

SSL VPN migrations are done remotely, with an on-site visit only if you want one. Local clients: see our Fortinet MSP in Sacramento and Fortinet MSP in San Francisco pages. Moving off another vendor at the same time? See firewall migration; going further than VPN replacement? See zero trust network access. Hardware too old for FortiOS 7.6, or a 2 GB model that lost SSL VPN entirely? See FortiGate end of life replacement and the FortiGate sizing guide to pick a replacement that still runs the VPN method you want.

FAQ

FortiGate SSL VPN migration questions.

Is FortiGate SSL VPN deprecated or end of life?

Tunnel mode is: Fortinet removed it from every model in FortiOS 7.6.3 and publishes guides for migrating to IPsec VPN. Web mode continues as Agentless VPN on mid-range and larger models. On the 7.4 branch, SSL VPN remains on most models except entry-level G-series.

Did Fortinet remove SSL VPN in FortiOS 7.4?

Mostly no. FortiOS 7.4.8 does not support SSL VPN on the 50G, 70G, 90G and their variants. The 30G and 50G never supported SSL VPN. The big change is FortiOS 7.6.3, which removed SSL VPN tunnel mode from every FortiGate. Earlier in the 7.6 branch, 7.6.0 removed SSL VPN entirely from 2 GB-RAM models (40F, 60F/61F, FGR-60F), and 7.6.1 separately removed it from the 90G/91G.

What happens if we upgrade to 7.6.3 without migrating?

SSL VPN tunnel-mode settings are not carried over in the upgrade, so FortiClient SSL VPN connections stop working. Fortinet's guidance is to migrate remote users to another method before upgrading. Browser-based web mode survives on mid-range and larger models, renamed Agentless VPN.

Can we just stay on 7.4?

For now, on most models SSL VPN still exists in 7.4. But it only postpones the move, keeps you off newer releases, and leaves an internet-facing service that has been a repeated target. Check Fortinet's product lifecycle page for your branch's support dates; we'll plan the migration around them.

Do we need FortiClient EMS licenses?

Not for IPsec. The free FortiClient VPN-only client supports IPsec IKEv2 with local, LDAP, RADIUS, or SAML authentication, with no EMS. It does not include Fortinet support or features like always-up and VPN-before-logon. ZTNA does require paid EMS licensing.

Will our SAML single sign-on and MFA keep working?

Yes, with the right setup. SAML for dial-up IPsec requires IKEv2 and FortiClient 7.2.4 or later; Windows and macOS built-in VPN clients can't do it. Browser-based SAML login needs newer FortiOS and FortiClient builds. We run SSL VPN and IPsec side by side during the pilot so nobody loses access.

What about hotels and guest Wi-Fi that block IPsec?

Classic IPsec uses UDP 500 and 4500, which some networks block. IKEv2 can run over TCP 443 (FortiClient 7.4.1+), the same port SSL VPN used. One trap: on 7.6.1+ the default IKE TCP port 443 can collide with the admin GUI on the same interface. We plan ports before cutover.

How long does it take and what does it cost?

The work runs in five phases: audit, design, pilot with a small group, roll out, then disable SSL VPN and upgrade. Cost depends on how many users, rules and applications you have, so we price it after a short review of your current setup. If you are also moving to a new firewall, the SSL VPN replacement is included in the scope of a firewall migration (from $6,500); with a $2,500 like-for-like FortiGate swap it is quoted separately after the same review.

Sources

Checked against Fortinet’s own documentation.

Last reviewed October 21, 2026. Fortinet updates release notes often; confirm against the notes for your exact FortiOS build.

Fortinet, FortiGate, FortiOS, and FortiClient are trademarks of Fortinet, Inc. Ambio Edge Networks is an independent Fortinet partner and is not affiliated with or endorsed by Fortinet.

Start the SSL VPN Migration

Start with a 30-minute SSL VPN scoping call.
Leave with a plan.

Tell us your FortiGate models, FortiOS version, user count, and how people sign in today (local, LDAP, RADIUS, SAML/MFA). We’ll tell you which replacement fits, what will break if you upgrade first, and a written quote for the migration, or confirm it fits inside a firewall migration or alongside a like-for-like FortiGate swap. You keep the design and as-built documentation either way. Want the whole network reviewed first? The Network Risk Assessment is $3,500 for a single small site; larger networks are priced on the assessment pricing page. See a sample report (PDF) for the level of detail we write to.