Since FortiOS 7.6.3, FortiGate devices no longer support SSL VPN in tunnel mode, which many companies use with FortiClient for remote working. If you upgrade the firmware without preparing the migration first, your users are left without remote access.
What has changed
Fortinet has removed SSL VPN tunnel mode in FortiOS 7.6.3, on all FortiGate models. The existing configuration is not converted automatically: it disappears from the graphical interface and the command line, and the connection stops working after the upgrade.
- Web mode (browser-based access, with no client) still exists under the name Agentless VPN, disabled by default and with limited browser support.
- On the 40F, 60F and 90G models, not even web mode is available.
- On devices with 2 GB of RAM or less, SSL VPN had already disappeared in earlier versions.
The alternative proposed by the manufacturer is remote access (dial-up) IPsec VPN, with the same FortiClient.
Why it is more than an inconvenience
In recent years, the SSL VPN portal has been one of ransomware groups' favourite ways in: several critical vulnerabilities allowed attackers to get into unpatched devices without credentials. Moving to IPsec with IKEv2 and two-factor authentication reduces the surface exposed to the internet, so the migration is also a security improvement.
How to migrate step by step
- Inventory. Note the FortiOS version, the user portals and groups, the two-factor method and the networks each group can access.
- IPsec tunnel design. Set up an IKEv2 dial-up tunnel with the same groups and the same authentication: FortiToken or your identity provider, such as Entra ID.
- Clients. Deploy the new FortiClient version and connection profile to the laptops, preferably centrally rather than device by device.
- Pilot. Test with a small group while SSL VPN is still active, including connections from home networks, mobile networks and hotels.
- Cutover. When everyone is using IPsec, disable SSL VPN and close its port. Only then upgrade to 7.6.3 or later.
Important: do not upgrade the firmware of a FortiGate that still provides SSL VPN in tunnel mode until you have completed the migration.
And after IPsec?
If your staff often work away from the office, it is worth considering Zero Trust Network Access (ZTNA): instead of putting the laptop on the network, it gives access only to the applications each person needs and checks the device's status before every connection.
How we can help
As a Fortinet partner, we review your current configuration, prepare the IPsec tunnel with two-factor authentication, deploy FortiClient on your devices and carry out the cutover out of hours, without your users losing a day's work.