Direct answer for buyers
A FortiGate SSL VPN solution is used to give authenticated remote users controlled access to internal business resources through a FortiGate security gateway. Organisations with existing FortiGate infrastructure, hybrid staff, travelling employees, support engineers or controlled third-party access may consider it. However, buyers should not assume that traditional SSL VPN tunnel mode is still available on every FortiGate or FortiOS version. FortiOS 7.6.3 and newer remove that tunnel mode and direct remote-access designs toward IPsec, while browser-based SSL access is now called Agentless VPN. Before proceeding, confirm the FortiGate model, firmware path, user count, endpoint types, identity provider, MFA requirement, applications to be reached, certificate plan and whether migration from an older SSL VPN configuration is required.
What the solution does
Remote access places the FortiGate between an off-site user and protected business resources. Authentication determines who the user is; security policy determines what that user can reach; the VPN or agentless access method determines how the traffic is carried; and logging helps the IT team review sessions and troubleshoot access.
A well-planned deployment can restrict users to only the networks, servers or applications they need rather than extending broad internal access. This makes the design relevant to everyday work-from-home use, administration, vendor support, branch operations and business continuity planning.
Who it may suit
The solution may suit companies already operating FortiGate firewalls, organisations consolidating remote access onto a controlled security gateway, and teams that want identity-aware access with MFA and clear firewall policies. It can also be relevant during a firewall refresh or FortiOS upgrade when legacy SSL VPN users need a supported replacement path.
It is not a one-size-fits-all service. Businesses with highly distributed workforces, application-specific access goals or zero-trust initiatives may need to compare IPsec remote access, Agentless VPN and Fortinet ZTNA approaches rather than selecting a design only because it has historically been called SSL VPN.
Business challenges this planning helps address
Remote staff need internal access
Users may need ERP, file services, intranet applications, remote desktop, management tools or other resources that are not published directly to the internet. The design maps authorised users to only the resources required for their role.
A firmware upgrade changes VPN behaviour
An organisation planning FortiOS 7.6.3 or later must account for the removal of SSL VPN tunnel mode. Migration planning should happen before the upgrade so user connectivity, authentication and policies can be validated on the replacement method.
Passwords alone are not enough
Remote access is internet-facing and should be designed with stronger identity controls. Depending on the environment, that can include MFA, SAML-based sign-in, certificate use, external identity sources and controlled user groups.
Access rules have grown too broad
Older VPN policies can accumulate exceptions. A redesign creates an opportunity to map remote user groups to defined destinations and services, remove obsolete objects and document why each access rule exists.
Buyer information table
Which remote-access approach fits the requirement?
Version, model and migration dependencies
Remote-access projects must be planned against the exact FortiGate hardware and FortiOS release. Fortinet removed SSL VPN tunnel mode from FortiOS 7.6.3 and later across FortiGate models. That means an older configuration should not be treated as something that will automatically remain operational after an upgrade. Fortinet’s migration direction is IPsec VPN for tunnel-based remote access, including options that can use TCP port 443 when appropriate. This can help in networks where conventional IPsec traffic encounters restrictive upstream conditions, but the complete design still requires validation.
Fortinet also renamed SSL VPN web mode to Agentless VPN from FortiOS 7.6.3. Agentless VPN can provide browser-based access to supported network services without installing a full VPN client, but support is model dependent. Some FortiGate platforms do not provide this feature, so a buyer should not purchase or upgrade a firewall on the assumption that the web portal will always be available.
The practical rule is simple: confirm model, memory/platform restrictions, firmware release, target firmware, remote-user workflow and application requirements before changing production. FourTeck can incorporate this check into an assessment and provide a migration or configuration scope based on the actual environment rather than an outdated generic SSL VPN template.
A structured engagement journey
Discover
Record the FortiGate model, FortiOS version, WAN topology, user population, identity source, current VPN method, applications, routes and business constraints.
Design
Choose IPsec, Agentless VPN or another approach, define authentication, group mapping, address pools, access rules, certificates, logging and endpoint requirements.
Pilot
Test with a limited user set, representative applications and realistic networks before a broad rollout. Validate MFA, DNS, routing, access scope and user experience.
Roll out
Coordinate client configuration, communication, cutover timing and fallback steps. Legacy SSL tunnel users may require special attention during firmware transitions.
Operate
Document user groups, policies and support steps, then review logs, certificate expiry, identity changes, client versions and firmware advisories as part of ongoing operations.
Capability focus: identity, MFA and access control
Remote access should begin with identity rather than a shared network secret. A FortiGate deployment can work with local and external authentication designs, while current Fortinet documentation also supports SAML-based approaches for Agentless VPN and for FortiClient remote-access IPsec in applicable configurations. This makes it possible to align remote access with an organisation’s identity strategy, including environments using Microsoft Entra ID, Okta, FortiAuthenticator or other supported services.
MFA is especially important because the remote-access gateway is reachable from outside the corporate network. The exact MFA method may involve FortiToken, an external identity provider, RADIUS or another supported integration. The choice should be based on existing identity infrastructure, user experience, licensing, operational ownership and recovery procedures. It is not enough to enable MFA once; organisations also need a process for new users, lost devices, token replacement, terminated employees and service accounts.
Access policy should then map identity to business need. Finance staff may need specific servers, administrators may require management segments, and external vendors may need time-limited access to a small set of systems. Keeping these groups separate reduces unnecessary exposure and makes logs easier to interpret. FourTeck can help translate the user and application requirements into a configuration scope without assuming that all remote users should receive the same network access.
Capability focus: certificates and trusted connection experience
A remote-access portal or gateway should present users with a certificate that matches the business domain and chains to a trusted certificate authority. Fortinet’s Agentless VPN guidance recommends using a non-factory certificate so users can recognise the identity of the service and avoid normalising browser warnings. Certificate planning includes the fully qualified domain name, DNS record, certificate source, renewal ownership and any intermediate certificate requirements.
Certificates can also be part of authentication in more controlled deployments. Whether certificate-based user or device authentication is appropriate depends on the endpoint-management model and the chosen VPN method. Managed corporate endpoints can support stricter controls than unmanaged contractor laptops, while browser-only access may require a different balance between convenience and assurance.
Operational ownership matters because expired certificates cause avoidable outages and user confusion. A good handover should record what certificate is installed, where its private key is protected, who renews it, which DNS name users connect to and how the replacement will be tested. This is a small detail in the initial project but a major support issue if it is ignored.
Capability focus: remote-access migration without broad disruption
The move away from SSL VPN tunnel mode is not only a protocol change. It affects user instructions, FortiClient profiles, authentication behaviour, address assignment, split-tunnel decisions, firewall policies, routing, DNS, troubleshooting procedures and possibly the ports allowed by upstream networks. Treating the change as a controlled migration is safer than replacing a few configuration lines during the same maintenance window as a major FortiOS upgrade.
A practical migration begins by documenting the current state: who connects, what resources each group reaches, whether traffic is full or split tunnel, which DNS servers are used, what authentication path is in place and what client versions are deployed. The replacement IPsec design can then be built and tested with a representative group. Fortinet supports remote-access IPsec options over UDP or TCP, including TCP port 443 in current FortiOS, which may help preserve connectivity in restrictive networks where classic IPsec transports are problematic.
Migration success should be measured by application access, authentication, security policy and supportability rather than the simple ability to establish a tunnel. FourTeck can help define pilot users, test cases, cutover steps and fallback criteria according to the customer’s change-management process.
Ideal business environments and practical use cases
Hybrid office teams
Employees working from home or travelling may need controlled access to internal file services, line-of-business systems or administrative resources. User-group policy and MFA help keep access role based.
IT administration
Infrastructure teams can use remote access for selected management networks, but privileged access should be narrower than ordinary employee access and supported by strong authentication and logging.
External vendor support
A contractor may require temporary access to a server or application. Separate user groups, precise policy, agreed time windows and documented ownership help avoid turning vendor access into permanent broad connectivity.
Firmware modernisation
Organisations preparing for a FortiOS upgrade can review remote access at the same time, particularly where SSL VPN tunnel mode exists today and must be migrated before a later FortiOS release is deployed.
Browser-only access
Where users only need supported web-mediated services and the FortiGate model supports it, Agentless VPN can be evaluated without placing a full network tunnel on the endpoint.
Remote-access redesign
A business that has accumulated legacy groups and firewall rules can use the project to simplify access, remove unused objects, align groups with job roles and introduce better documentation.
Integration and operational considerations
Remote access touches more systems than the firewall alone. Authentication may depend on Active Directory, LDAP, RADIUS, SAML or another identity provider. DNS must resolve internal resources correctly for remote users. Routing must return traffic to the assigned VPN address pool. Firewall rules must permit only intended destinations. If the business uses network access control, endpoint management, SIEM, syslog or monitoring platforms, the project may also need logging and integration decisions.
FortiClient management is another decision. A few standalone users can be operationally different from hundreds of managed endpoints that need centrally provisioned profiles, controlled updates and consistent configuration. FortiClient EMS can provide central management functions for FortiClient endpoints, but feature and licence requirements should be checked against the chosen architecture rather than assumed to be included in a basic VPN setup.
Internet connectivity should be reviewed from both sides. Users may connect from home broadband, mobile networks, hotels, customer sites or restricted guest networks. Current FortiOS can run remote-access IPsec over TCP, including TCP 443, which can be useful where conventional IPsec traffic is restricted, but administrators should also check management-port conflicts and the complete gateway configuration.
Finally, the operating procedure should include firmware planning, certificate renewal, identity changes, configuration backups, break-glass access and troubleshooting ownership. These points determine whether the remote-access service remains manageable six or twelve months after deployment.
Questions to resolve before ordering or configuration
This identifies feature availability and whether an upgrade changes the remote-access method.
The answer helps separate IPsec remote access from Agentless VPN and application-specific approaches.
Record the source of user accounts, groups, MFA method and any SAML or RADIUS dependencies.
A list of networks, servers and services allows policy to be narrow and auditable.
Windows, macOS, mobile and unmanaged devices may require different deployment or support approaches.
Legacy SSL VPN tunnel users need testing, user communication and cutover planning before FortiOS 7.6.3+.
Procurement and project checklist
How FourTeck can assist
FourTeck can help turn a general request for “SSL VPN” into a specific remote-access requirement. The review can cover the existing FortiGate, firmware, current users, identity source, MFA, certificates, network resources and operational constraints. From there, the scope can focus on a supported design rather than copying a legacy configuration into a newer platform.
Assistance may include design review, IPsec remote-access planning, Agentless VPN evaluation, migration planning, policy cleanup, certificate guidance, SAML or other authentication integration, FortiClient considerations, pilot testing, rollout support and documentation. The exact activities depend on the environment and should be defined in the quotation.
See FourTeck firewall services or review the broader firewall product portfolio when remote access is part of a wider firewall refresh.
When the firewall itself may need review
A remote-access project sometimes reveals that the existing FortiGate cannot support the required firmware, feature, user scale or broader security roadmap. In that case, the project should separate the VPN need from the hardware refresh decision. A replacement appliance should be sized for internet throughput, security inspection, site connectivity, VPN users, interface needs and expected growth rather than purchased solely because a particular legacy VPN feature existed on the old device.
For businesses considering a Fortinet refresh, review Fortinet firewall options in Dubai. FourTeck can also compare whether the remote-access requirement should be delivered through the current appliance, a replacement FortiGate, FortiClient management or a different access architecture.
UAE availability and support guidance
For a FortiGate SSL VPN Solution in the UAE, the first availability question is usually not stock but technical applicability. The service may involve an existing FortiGate, a firmware change, configuration work, certificates, identity integration, FortiClient requirements, licensing, or a hardware refresh. Contact FourTeck to confirm the current scope that fits your environment. Availability may depend on the firewall model, FortiOS version, quantity, required licences or subscriptions, remote-user count and vendor lead time if hardware or commercial components are needed.
Delivery and project coordination can be discussed after the exact requirement is confirmed. Installation and configuration should be included in the quotation when required, with testing expectations and any migration window stated clearly. For Dubai, Abu Dhabi, Sharjah and Ajman requirements, FourTeck can coordinate requirement review and quotation planning as one UAE project rather than assuming that each location needs a separate remote-access architecture. Use the FourTeck contact page to share the model, firmware, user count and current VPN method.
GCC Availability
FortiGate remote-access requirements across the GCC should be planned with the destination country and technical scope clearly identified. FourTeck can assist organisations in the United Arab Emirates and other GCC markets such as Saudi Arabia, Kuwait, Qatar, Bahrain and Oman with requirement review, FortiGate model or licence clarification, quotation coordination, remote-access architecture, configuration scope, installation planning and migration guidance. A regional project may use similar security principles across offices, but licensing, delivery schedules, site access, maintenance windows and vendor lead times can vary by country and by the exact FortiGate model or commercial package. For an accurate quotation, share the destination country, existing firewall model, current and target FortiOS versions, quantity where hardware is involved, number of users, identity platform, expected deployment location and target timeline. FourTeck can then help define whether the requirement is configuration on an existing appliance, SSL VPN tunnel migration to IPsec, Agentless VPN evaluation, endpoint management, or a broader firewall upgrade. Country-specific stock, customs outcomes, installation dates and certification should be confirmed separately rather than assumed.
Africa Availability
Organisations planning FortiGate remote access in Africa can use the same requirement-first approach while accounting for regional fulfilment, internet conditions, identity platforms and local project constraints. FourTeck can help businesses in East Africa, West Africa, Southern Africa and selected markets such as Kenya and Uganda evaluate the FortiGate model, software version, licences, certificates, endpoint needs, MFA, migration scope and support expectations before a quotation is prepared. Availability and fulfilment can vary according to the destination, hardware model, quantity, licence region, power and regulatory requirements, shipping arrangements, vendor lead time and whether on-site work is part of the project. Buyers should provide the destination country, exact remote-access requirement, number of users, current FortiOS release, preferred deployment schedule and any installation or support expectations. This allows FourTeck to distinguish between an existing-firewall configuration request, a legacy SSL VPN migration, an Agentless VPN use case and a hardware refresh. For regional enquiries, buyers can also review FourTeck Africa coverage and confirm the specific project scope before making procurement assumptions.
Related products, services and alternatives to consider
FortiGate firewall sizing
Relevant when the existing appliance is approaching lifecycle, capacity or firmware limitations. Model selection should consider more than VPN users alone.
FortiClient remote-access IPsec
The primary tunnel-based migration direction for current FortiOS environments that no longer support SSL VPN tunnel mode.
Agentless VPN
Browser-based access to supported resources where the FortiGate model, FortiOS release and required service are compatible.
FortiClient EMS
Consider when endpoint configuration, central profile management and wider FortiClient operational controls are required at scale.
ZTNA assessment
Useful when the goal is application-specific access and endpoint-aware policy rather than broad network-level VPN connectivity.
Firewall migration services
Relevant when remote access is only one part of a larger device replacement, policy cleanup or network security modernisation project.
Why businesses contact FourTeck for this requirement
The value of assistance is practical: determining what the customer currently has, which Fortinet remote-access options are supported on that exact platform and what must change before users can connect reliably. FourTeck can help clarify requirements, review the current FortiGate and FortiOS version, map user groups, identify identity and MFA dependencies, plan certificates, define firewall policy, estimate configuration effort and prepare the information needed for a meaningful quotation.
For migration projects, the discussion can cover pilot users, client deployment, testing, cutover timing, rollback considerations and documentation. For new projects, it can cover whether the business actually needs a network tunnel, an Agentless VPN portal, IPsec remote access or a more application-focused architecture. That distinction reduces the risk of buying hardware or licences before the access model is understood.
You can learn more about FourTeck firewall solutions in Dubai or contact the team with the current FortiGate details for a scoped discussion.
What buyers are really trying to work out before changing FortiGate remote access
“Does FortiGate still support SSL VPN?”
The answer depends on what the buyer means by SSL VPN and which FortiOS release is involved. Traditional SSL VPN tunnel mode is no longer available in FortiOS 7.6.3 and later. Browser-based SSL VPN web mode remains as Agentless VPN on supported models. This is why search results or old configuration guides can appear contradictory: they may describe an earlier FortiOS release or a different mode. Before following any tutorial, match it to the exact FortiOS release running on the firewall.
“What replaces SSL VPN tunnel mode?”
For current FortiOS, Fortinet directs tunnel-based remote access toward IPsec VPN. The design can still be user friendly when FortiClient profiles, authentication and routing are planned correctly. Current FortiOS also supports IPsec transport over TCP and can use TCP port 443, which is relevant to users who previously valued SSL VPN because it often crossed restrictive networks more easily. The replacement is therefore not simply “use standard UDP IPsec”; the architecture can be tuned to the access environment.
Another common buyer question is whether a FortiClient licence is required just to create a basic remote-access connection. The answer depends on the desired FortiClient capabilities and how endpoints will be managed. A small standalone VPN requirement is different from a deployment that needs FortiClient EMS, central provisioning, endpoint posture controls, ZTNA features, reporting or coordinated security functions. Rather than making a licensing assumption from a download page or an older article, define the client requirement first and then confirm the current Fortinet commercial model for the chosen feature set.
Buyers also search for “SSL VPN versus IPsec” as if the choice were purely about encryption speed. In a FortiGate project today, the more useful comparison is operational. Does the user need a full network tunnel? Will they connect from managed laptops, phones, home networks or customer sites? Does the organisation need SAML login with an existing identity provider? Must traffic work through restrictive outbound networks? Who will deploy and update the endpoint profile? What applications need access? These answers influence the protocol, FortiClient configuration, authentication, routing and policy more than a generic feature comparison.
If the project starts with “we need SSL VPN for 50 users,” the next step should be requirement discovery, not an immediate quote. The same 50-user request can describe a new IPsec deployment, a legacy SSL tunnel migration, browser-only Agentless VPN access, a FortiClient management project or a wider firewall upgrade.
MFA is another recurring search topic because remote-access credentials are exposed to internet-based login attempts. Fortinet supports several authentication patterns across current remote-access features, including SAML-based integration and FortiToken scenarios. Buyers should decide whether the identity platform is already standardised around Microsoft Entra ID, Okta, FortiAuthenticator, RADIUS, LDAP or another system. The implementation must account for user groups, MFA enrolment, account disablement, backup authentication, certificate trust and the way authentication events will be investigated.
Certificate warnings are often treated as a nuisance to click through during testing, but they should be solved before production. A trusted certificate tied to the public DNS name helps users know they are connecting to the intended gateway and avoids training staff to ignore browser or client warnings. The project should record who owns the DNS record, who obtains and renews the certificate, where the private key is stored and when renewal will be tested. For Agentless VPN, this is particularly visible because users interact with a web portal.
Performance questions also need context. The number of remote users by itself does not define the load. Fifty users reading email and using a small internal web application create a different traffic profile from engineers transferring large files or users sending all internet traffic through a full tunnel. Buyers should estimate concurrency, bandwidth per user, application type, full versus split tunnel, internet link capacity and any other inspection features running on the FortiGate. If the appliance is also the branch internet gateway, site-to-site VPN hub and security inspection point, remote access is only one part of the sizing calculation.
Finally, many buyers are trying to find a “FortiGate SSL VPN configuration price” when what they really need is a scoped service quote. Configuration effort changes with the current state of the firewall, number of user groups, identity integration, certificate work, migration complexity, FortiClient deployment, test cases and change window. FourTeck can review these inputs before quoting so the proposal reflects the actual work rather than a generic one-line VPN setup. For procurement teams, providing a configuration backup, model, FortiOS version, user count, identity platform and application list is a strong starting point.
Decision questions buyers ask in real projects
Can we keep our existing SSL VPN after upgrading FortiOS?
Not if the design depends on SSL VPN tunnel mode and the target is FortiOS 7.6.3 or later. The tunnel configuration must be migrated before that upgrade. A project should compare the existing address pools, routes, user groups, split-tunnel behaviour, DNS and policies with the replacement IPsec design, then pilot the new method before cutover.
Can remote IPsec still work where only web-style outbound traffic is allowed?
Current FortiOS can support dial-up IPsec over TCP, including TCP port 443. This can help in restrictive networks, but it is not a guarantee for every hotel, customer network or carrier. The firewall configuration, management ports, FortiClient behaviour and upstream policy must be tested with representative users.
Is Agentless VPN the same thing as the old SSL VPN web portal?
It is the current name for SSL VPN web mode from FortiOS 7.6.3. Users authenticate to a FortiGate web portal and can access supported resources without a full VPN client. Model support and the required application protocol must be checked before it is selected as the primary access method.
Should every remote user get the same policy?
Usually no. The cleaner approach is to map groups to the minimum resources their roles require. Staff, administrators and vendors often need different destinations and services. Separating them improves control, troubleshooting and off-boarding, and it reduces the effect of a compromised account.
What information makes a quotation accurate?
Provide the FortiGate model, current FortiOS, target FortiOS, remote-user count, endpoint types, identity provider, MFA plan, required applications and current VPN configuration. Also state whether client deployment, certificate work, migration, testing, documentation and after-cutover support are required.
When should we consider ZTNA instead of a VPN?
Consider it when the business goal is controlled access to specific applications rather than broad network reach. ZTNA can fit identity- and endpoint-aware access strategies, but compatibility, endpoint requirements and application architecture need assessment. Some organisations use VPN and ZTNA side by side while they modernise access gradually.
Frequently asked questions
1. Is FortiGate SSL VPN tunnel mode still supported?
SSL VPN tunnel mode is not supported in FortiOS 7.6.3 and later. Organisations using it on older releases should assess migration to FortiClient remote-access IPsec before upgrading.
2. What happened to SSL VPN web mode?
Fortinet renamed SSL VPN web mode to Agentless VPN beginning with FortiOS 7.6.3. It provides browser-based access to supported resources without a full VPN client, subject to FortiGate model support and configuration.
3. Can FortiClient still be used for remote access?
Yes. FortiClient supports remote-access VPN functions, including IPsec. The features available, central management options and licensing requirements depend on the FortiClient edition, FortiOS version and deployment design.
4. Can FortiGate remote-access IPsec use TCP port 443?
Current FortiOS supports dial-up IPsec over TCP and can use TCP port 443. This can be useful on restrictive networks, but port conflicts, endpoint configuration and the complete network path should be tested.
5. Can MFA be added to FortiGate remote access?
Fortinet supports MFA scenarios for remote access, including FortiToken and identity-provider integrations. The exact method depends on the selected VPN mode, authentication source, licensing and user workflow.
6. Do we need a trusted SSL certificate?
A trusted certificate is strongly recommended for browser-based Agentless VPN and other HTTPS-facing services so users can verify the gateway identity and avoid certificate warnings. DNS naming and renewal ownership should be planned with it.
7. Does every FortiGate support Agentless VPN?
No. Support depends on the FortiGate platform and FortiOS version. The exact model should be checked before Agentless VPN is included in a design or upgrade plan.
8. What should be tested before migration from SSL VPN tunnel mode?
Test authentication, MFA, client installation, address assignment, routes, DNS, application access, split or full tunnel behaviour, firewall policy, reconnect behaviour and representative user networks before broad rollout.
9. How do we request a FortiGate remote-access quotation in Dubai?
Share the FortiGate model, FortiOS release, user count, identity platform, MFA requirement, applications, current VPN method and whether configuration, migration, FortiClient deployment, certificates or support are required. FourTeck can then prepare a scope-based quotation.
Plan the right FortiGate remote-access path before you change production
Send FourTeck the FortiGate model, current FortiOS version, number of users and existing VPN method. We can help identify whether your requirement is a new IPsec deployment, Agentless VPN, SSL tunnel migration, identity integration or a wider FortiGate upgrade.