VPN to ZTNA Migration Guide
FortiOS 7.6 removed SSL-VPN from 2 GB-RAM FortiGates and the current G-series never had it. This is the seven-step method we use to move an office from the SSL-VPN portal to ZTNA with FortiClient EMS, with the exit test for each step and the design decisions that make or break it. Last reviewed 2026-10-06.
Why Now
FortiOS 7.6 removed SSL-VPN tunnel and web mode from 2 GB-RAM FortiGates, and the current G-series desktop models never had it. Fortinet's direction is IPsec for site-to-site and ZTNA for users. If your remote staff log in through a FortiGate SSL-VPN portal today, a migration is on the calendar whether you plan it or not. Planned, it takes about four weeks and nobody notices the cutover.
The user's device proves identity and posture for every application connection, instead of landing on the network once and roaming. FortiClient reports device state to FortiClient EMS; the FortiGate enforces per-application rules with ZTNA tags.
Users still run FortiClient. The FortiGate still terminates the session. Your identity provider still authenticates. The change is in policy granularity and in what a compromised laptop can reach: one application instead of a subnet.
FortiClient EMS licensing per user (ZTNA is included in the EMS license tiers; confirm the current SKU), plus the project. We do the migration as a $3,500 fixed-fee project, or at no charge inside a firewall migration.
Firmware upgrade removes SSL-VPN on a 2 GB model and remote staff are locked out on a Monday morning. It has happened to customers who were not warned. Check the release notes for your model before any 7.6 upgrade.
The Method
This is the order we run. Each step has an exit test; nothing moves to the next step until the test passes.
| Step | What happens | Exit test |
|---|---|---|
| 1. Inventory | List every SSL-VPN user, group and the applications they reach: RDP hosts, file shares, web apps, printers. Pull it from the FortiGate logs for 30 days, not from memory. | A spreadsheet of user → application pairs with last-used dates |
| 2. Identity and MFA | Connect the FortiGate and EMS to your identity provider (Entra ID, Google, Okta) with SAML; enforce MFA there, not on the firewall. | A test user authenticates with MFA to a ZTNA portal page |
| 3. EMS and posture | Deploy or upgrade FortiClient EMS; define ZTNA tags (OS patched, AV running, disk encrypted); push FortiClient with the EMS connection to the pilot group. | Pilot devices show tags in EMS and on the FortiGate |
| 4. Application rules | Build ZTNA server definitions and rules per application, least privilege, matching the inventory. Dead applications are not migrated. | Pilot users reach only their listed applications |
| 5. Pilot | Ten percent of users for two weeks, including the most vocal ones. Keep SSL-VPN running in parallel. | Zero unresolved pilot tickets for five business days |
| 6. Cutover | Move groups weekly; disable SSL-VPN per group after each move; watch the logs for anyone still hitting the old portal. | No SSL-VPN sessions in 7 days |
| 7. Decommission | Disable SSL-VPN, remove the portal, close the port on the WAN policy, document the final rule set. | External scan shows no SSL-VPN listener; as-built delivered |
Typical elapsed time four to six weeks for 20 to 200 users, most of it pilot and group moves. Engineering effort is 12 to 20 hours for a single site.
Design Notes
Four choices made early save the project later.
FortiClient (agent) gives posture checks and works for RDP and thick clients. Agentless ZTNA through the browser covers web applications only. Most offices need the agent for at least the IT and finance groups.
Start with two tags: OS patch level and endpoint protection running. Add disk encryption when every laptop can pass it. A rule nobody can pass is a help-desk flood, not security.
ZTNA is for users. Branch offices, cloud VPCs and partner tunnels stay on IPsec; migrate them separately if at all.
Turn on ZTNA logging to FortiAnalyzer or syslog before the pilot so the first access denial is diagnosable in a minute, not an hour.
Track Record
We only do networks. That is not a limitation — it is why the outcomes are different.
Years of network-only practice. Architecture, security, and operations — not IT generalism.
Sites delivered. Healthcare clinics, law offices, financial branches, multi-site operations.
Design target for fully redundant builds with HA firewalls, diverse ISPs, and backed-up power.
Senior engineer–led. No junior handoffs. No ticket queue. No escalation chain.
Career aggregate. The 20+ years and 300+ sites span the operator’s full network-only practice, including prior-employer engagements. 99.99% availability, about 53 minutes of downtime per year, is an architecture design target for engagements that fund full redundancy. It is not a service guarantee or uptime SLA. Contracted response times and service levels are defined in each customer agreement.
Where We Work
Pre-staging and configuration happen remotely; cutover is on site or remote-hands guided, your choice. Local clients: see our Fortinet MSP in Sacramento and Fortinet MSP in San Francisco pages. Replacing a non-Fortinet firewall? See firewall migration. Want it watched afterward? See network monitoring.
FAQ
Inventory the SSL-VPN users and the applications they actually reach from 30 days of logs; connect the FortiGate and FortiClient EMS to your identity provider with SAML and MFA; define posture tags in EMS; build per-application ZTNA rules; run a two-week pilot alongside SSL-VPN; move groups weekly; then disable SSL-VPN and close the port. Four to six weeks for most offices.
FortiOS 7.6.0 removed SSL-VPN tunnel and web mode from 2 GB-RAM models such as the 40F, 60F and 61F. The current 30G, 50G and 70G never supported it, and the 90G only on a narrow 7.0 release range. Fortinet's documented direction is IPsec and ZTNA.
For agent-based ZTNA with posture checks, yes. EMS issues the client certificate and tags that the FortiGate enforces. Agentless browser-based ZTNA for web applications does not need an agent on the device but still uses the FortiGate as the proxy.
ZTNA capability is part of FortiClient EMS licensing, priced per endpoint per year. Confirm the current SKU and tier with us; it changes. The FortiGate side needs no extra license.
Our fixed fee is $3,500 standalone for policy design, the agent or agentless rollout plan, a pilot group and cutover of the existing SSL-VPN population. It is included at no charge when done inside a firewall migration. Larger programs with multiple identity providers or more than 500 users are scoped after an assessment.
No. ZTNA governs user-to-application access. Site-to-site links between offices and cloud networks stay on IPsec, which FortiGate handles with SD-WAN steering if you have two circuits.
If the pilot is done properly, no. FortiClient stays on the laptop; the login prompt moves to your identity provider with MFA; applications open the same way. The visible change is that a user who is not entitled to a server cannot see it at all.
Roll back to the prior release from the backup image to restore access, then run this migration deliberately. Do not stay on an unsupported release longer than the project takes; call us the same day if you are locked out.
Sources
Last reviewed 2026-10-06. Vendor documents and prices change; confirm against the linked pages before you decide.
Fortinet, FortiGate, FortiOS, FortiGuard and FortiCare are trademarks of Fortinet, Inc. Other vendor names are trademarks of their respective owners, used to identify the products discussed. Ambio Edge Networks is an independent Fortinet partner and is not affiliated with or endorsed by any vendor named here.
Plan the Migration
Tell us the model and FortiOS version, how many SSL-VPN users, your identity provider, and whether you already run FortiClient EMS. We return a plan with the pilot group and dates, and a fixed fee.
Response from a senior engineer within 1 business day.
A direct conversation — no sales team, no runaround.
An honest assessment of whether we are the right fit.
Clear next steps if we are — no pressure if we are not.
