2024 · 7.4.4
Fortinet published its first SSL VPN to IPsec VPN migration guide. SSL VPN itself stayed in 7.4 on almost every model.
FortiGate SSL VPN Migration
FortiGate SSL VPN tunnel mode is removed.
Migrate to IPsec or ZTNA — planned, piloted, documented.
FortiOS 7.6.3 removed SSL VPN tunnel mode from every FortiGate, and the upgrade does not carry those settings over. We move your remote users to IPsec IKEv2, Agentless VPN, or ZTNA — with SAML single sign-on and MFA intact and a side-by-side pilot, planned to avoid Monday-morning lockouts. One senior engineer with deep FortiGate experience, start to finish. Based in Sacramento, serving the Bay Area and remote across California.
What Fortinet Changed
FortiGate SSL VPN deprecated, removed, or end of life? Version by version.
Reviewed 2026-10-02 against Fortinet’s release notes. If you search “SSL VPN removed 7.4,” this is the part most posts get wrong.
2024 · 7.6.0 / 7.6.1
SSL VPN tunnel and web mode removed from 2 GB-RAM models: 40F family, 60F/61F, FGR-60F — then 90G/91G in 7.6.1.
2025 · 7.4.8
SSL VPN removed from entry-level G-series (50G, 70G, 90G and variants) on the 7.4 branch.
2025 · 7.6.3
SSL VPN tunnel mode removed on all models. Web mode survives on mid-range and larger models as Agentless VPN. Tunnel settings do not upgrade — migrate first.
Why Move Now
Why SSL VPN is worth retiring now.
Internet-facing SSL VPN has produced several critical, actively exploited FortiGate vulnerabilities. Replacing it shrinks the attack surface instead of waiting for the next advisory.
Repeated critical CVEs
CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762 were all SSL VPN flaws listed in CISA’s Known Exploited Vulnerabilities catalog.
Persistence after patching
In 2025 Fortinet disclosed that attackers who had exploited older flaws left a foothold in the SSL VPN file area that survived patching. Devices with SSL VPN disabled were not affected.
Forced by the upgrade path
Staying current on FortiOS 7.6.3 or later means losing tunnel mode anyway. Planning the move beats discovering it after a firmware update.
Better options exist
IPsec IKEv2 with FortiClient is Fortinet’s primary replacement and can run over TCP 443; ZTNA adds per-app, identity-based access.
Your Replacement Options
FortiGate SSL VPN to IPsec VPN migration: three paths.
IPsec IKEv2 + FortiClient
Fortinet’s primary replacement for tunnel mode. Works with the free FortiClient VPN-only client — no EMS required. Supports SAML/MFA, split tunneling, and IKE over TCP 443.
Agentless VPN
The renamed SSL VPN web mode on 7.6.3+: a browser portal for web, RDP, SSH, and file bookmarks. Not available on 2 GB models, including the 40F family, 60F/61F, FGR-60F, and 90G/91G.
ZTNA
Per-application, identity- and device-aware access through FortiClient and EMS. The most granular model; requires paid EMS licensing.
Mixed
Many migrations use IPsec for staff laptops plus Agentless VPN or ZTNA for contractors and specific apps. We document who gets what and why.
What the Migration Includes
Five phases, designed so users don’t lose access mid-week.
1 · SSL VPN audit
Users and groups, authentication (local, LDAP, RADIUS, SAML, MFA), portals and bookmarks, split-tunnel routes, DNS, FortiClient versions in the field, and which FortiGates and FortiOS versions are involved.
2 · Design
Target method per user group, IKEv2 phase 1/2 settings, port plan (UDP 500/4500 vs TCP 443), SAML/MFA flow, split tunnel and split DNS, FortiClient version and rollout method.
3 · Side-by-side pilot
IPsec runs alongside SSL VPN for a pilot group, including SAML. We validate on home, hotel, and cellular networks before anyone else moves.
4 · Rollout
FortiClient profile deployment and user instructions, in waves. Help-desk notes for the first week so issues get fixed, not escalated.
5 · Retire SSL VPN and upgrade
Disable SSL VPN, close the listener, then upgrade FortiOS on a tested path. Documentation handed to your team or kept under our managed service.
The Gotchas We Plan Around
Where SSL VPN migrations usually break.
These come straight from Fortinet’s documentation and field reports. Each one is a line item in our plan.
SAML needs IKEv2 + FortiClient
SAML over dial-up IPsec only works with IKEv2 and FortiClient 7.2.4+. Native Windows/macOS clients can’t do it, and browser-based login needs newer builds on both sides.
IKEv1 is gone in new clients
FortiClient 7.4.4 and later dropped IKEv1 entirely. Old IKEv1 dial-up configs need to move to IKEv2.
Port 443 collisions
IKE over TCP 443 needs FortiClient 7.4.1+ and IKEv2. On 7.6.1+ the default IKE TCP port is 443, which can collide with HTTPS admin access on the same interface.
Different defaults
SSL VPN enabled split tunneling by default; a custom IPsec tunnel does not. Split DNS requires IKEv2. LDAP over IKEv2 needs EAP-TTLS.
MFA proxies
RADIUS-based MFA (for example Duo proxy) with IKEv2 EAP is a common failure point. We test the exact chain in the pilot.
Certificates
Fortinet’s migration guide doesn’t cover moving certificate-based user authentication. If you use it, we design that piece explicitly.
Track Record
The numbers behind the outcomes.
We only do networks. That is not a limitation — it is why the outcomes are different.
Engineering
20+
Years of network-only practice. Architecture, security, and operations — not IT generalism.
Delivery
300+
Sites delivered. Healthcare clinics, law offices, financial branches, multi-site operations.
Availability
99.99%
Design target for fully redundant builds with HA firewalls, diverse ISPs, and backed-up power.
Ownership
100%
Senior engineer–led. No junior handoffs. No ticket queue. No escalation chain.
Career aggregate. The 20+ years and 300+ sites span the operator’s full network-only practice, including prior-employer engagements. 99.99% availability, about 53 minutes of downtime per year, is an architecture design target for engagements that fund full redundancy. It is not a service guarantee or uptime SLA. Contracted response times and service levels are defined in each customer agreement.
Where We Work
Sacramento, the Bay Area, and remote across California.
Most SSL VPN migrations are done remotely, with an on-site visit only if you want one. Local clients: see our Fortinet MSP in Sacramento and Fortinet MSP in San Francisco pages. Moving off another vendor at the same time? See firewall migration; going further than VPN replacement? See zero trust network access. Hardware too old for FortiOS 7.6? See FortiGate end of life replacement.
FAQ
FortiGate SSL VPN migration questions.
Is FortiGate SSL VPN deprecated or end of life?
Tunnel mode is: Fortinet removed it from every model in FortiOS 7.6.3 and publishes guides for migrating to IPsec VPN. Web mode continues as Agentless VPN on mid-range and larger models. On the 7.4 branch, SSL VPN remains on most models except entry-level G-series.
Did Fortinet remove SSL VPN in FortiOS 7.4?
Mostly no. On 7.4, SSL VPN was removed only from entry-level G-series models (50G, 70G, 90G and variants) starting in 7.4.8. The big change is FortiOS 7.6.3, which removed SSL VPN tunnel mode from every FortiGate. Smaller 2 GB models (40F, 60F/61F, FGR-60F, plus 90G/91G) lost SSL VPN entirely earlier in the 7.6 branch.
What happens if we upgrade to 7.6.3 without migrating?
SSL VPN tunnel-mode settings are not carried over in the upgrade, so FortiClient SSL VPN connections stop working. Fortinet's guidance is to migrate remote users to another method before upgrading. Browser-based web mode survives on mid-range and larger models, renamed Agentless VPN.
Can we just stay on 7.4?
For now, on most models SSL VPN still exists in 7.4. But it only postpones the move, keeps you off newer releases, and leaves an internet-facing service that has been a repeated target. Check Fortinet's product lifecycle page for your branch's support dates; we'll plan the migration around them.
Do we need FortiClient EMS licenses?
Not for IPsec. The free FortiClient VPN-only client supports IPsec IKEv2 with local, LDAP, RADIUS, or SAML authentication, with no EMS. It does not include Fortinet support or features like always-up and VPN-before-logon. ZTNA does require paid EMS licensing.
Will our SAML single sign-on and MFA keep working?
Yes, with the right setup. SAML for dial-up IPsec requires IKEv2 and FortiClient 7.2.4 or later; Windows and macOS built-in VPN clients can't do it. Browser-based SAML login needs newer FortiOS and FortiClient builds. We run SSL VPN and IPsec side by side during the pilot so nobody loses access.
What about hotels and guest Wi-Fi that block IPsec?
Classic IPsec uses UDP 500 and 4500, which some networks block. IKEv2 can run over TCP 443 (FortiClient 7.4.1+), the same port SSL VPN used. One trap: on 7.6.1+ the default IKE TCP port 443 can collide with the admin GUI on the same interface. We plan ports before cutover.
How long does it take and what does it cost?
Most single-FortiGate migrations are a short, scoped project: assess, pilot with a small group, roll out, then disable SSL VPN and upgrade. We quote a fixed fee after a scoping call, based on user count, authentication method, and how many sites and FortiGates are involved.
Sources
Checked against Fortinet’s own documentation.
Last reviewed 2026-10-02. Fortinet updates release notes often; confirm against the notes for your exact FortiOS build.
Fortinet, FortiGate, FortiOS, and FortiClient are trademarks of Fortinet, Inc. Ambio Edge Networks is an independent Fortinet partner and is not affiliated with or endorsed by Fortinet.
- FortiOS 7.6.3 release notes — SSL VPN tunnel mode no longer supported
- FortiOS 7.6.0 release notes — SSL VPN removed from 2GB RAM models
- Fortinet Community — SSL VPN support on FortiGate models
- Fortinet — Migration from SSL VPN tunnel mode to IPsec VPN (7.6.3)
- Fortinet — Agentless VPN (7.6.3)
- Fortinet — SAML authentication for FortiClient dial-up IPsec
- Fortinet Community — FortiClient licensing and support
- Fortinet PSIRT blog — Analysis of threat actor activity (symlink persistence)
- CISA Known Exploited Vulnerabilities catalog
Start the SSL VPN Migration
Start with a 30-minute SSL VPN scoping call.
Leave with a plan.
Tell us your FortiGate models, FortiOS version, user count, and how people sign in today (local, LDAP, RADIUS, SAML/MFA). We’ll tell you which replacement fits, what will break if you upgrade first, and a fixed-fee quote for the migration.
What Happens Next
Response from a senior engineer within 1 business day.
A direct conversation — no sales team, no runaround.
An honest assessment of whether we are the right fit.
Clear next steps if we are — no pressure if we are not.