For a new FortiGate remote-access deployment, choose IPsec as the strategic default. FortiOS 7.6.3 and later replace the proprietary SSL VPN tunnel mode with standards-based IPsec VPN tunnel mode, so organizations upgrading to those releases must plan a manual migration. IPsec also supports UDP, TCP, and TCP 443 fallback, making it suitable for users behind restrictive firewalls when it is configured correctly.
SSL VPN still matters when you are maintaining an older FortiOS release, and FortiGate web (agentless) mode can provide limited browser-only access without an endpoint client. The right choice depends on the FortiOS and FortiClient versions, whether users need full network access or only a few web applications, the authentication and certificate design, and how much migration work your team can absorb.
As an Amazon Associate I earn from qualifying purchases.
Quick decision: which FortiGate VPN should you use?
Use the following decisions before looking at individual features:
- New or redesigned full-tunnel remote access: select IPsec, normally with IKEv2, because it is the standards-based tunnel technology used by current FortiOS releases.
- FortiOS 7.6.3 or later with existing SSL tunnel users: schedule a manual move to IPsec and test FortiClient compatibility before changing production access.
- Older FortiOS where SSL tunnel mode is still available: SSL can remain a practical interim option for broad remote-user application access, but it should be treated as a release-dependent design rather than a permanent assumption.
- A few browser-accessible applications and unmanaged devices: web mode (also called agentless VPN) avoids an endpoint application, but it supports fewer applications than a full tunnel.
- Users on networks that block common VPN traffic: IPsec can use TCP 443 as a fallback when UDP 500/4500 is unavailable. Confirm that your FortiOS, FortiGate model, client, and configuration support the selected transport.
| Decision factor | IPsec VPN | SSL VPN tunnel mode | Web/agentless VPN |
|---|---|---|---|
| Current FortiOS direction | Standards-based tunnel mode in FortiOS 7.6.3 and later | Proprietary tunnel mode replaced in FortiOS 7.6.3 and later | Clientless browser access remains a separate mode, subject to release and configuration |
| Transport options | UDP, TCP, and TCP 443 fallback can be used | HTTPS-based transport; DTLS/UDP is available in supported releases | HTTPS in a web browser |
| Endpoint software | Requires a compatible VPN client or operating-system IPsec client | Historically used FortiClient for tunnel access | No endpoint VPN application |
| Application coverage | Full routed network access when policies and routes permit it | Broad remote-user access through a tunnel | Fewer applications; limited to what web mode can proxy or present |
| Migration implication on 7.6.3+ | Target technology | Existing configurations require manual migration | Separate clientless option rather than a replacement for full tunneling |
What changed in FortiOS 7.6.3 and later
Fortinet states that “Starting from FortiOS 7.6.3, the proprietary SSL VPN tunnel mode is replaced with standards-based IPsec VPN tunnel.” This is a product change, not merely a recommendation to prefer one protocol. A configuration that depended on SSL tunnel mode must be redesigned for IPsec when the firewall is upgraded to 7.6.3 or a later release.
#1 Best Overall
What the replacement means for existing users
Existing SSL tunnel settings do not automatically become a finished IPsec design. Treat the change as a migration project: inventory users and groups, authentication dependencies, address pools, split- or full-tunnel routes, firewall policies, DNS behavior, certificates, and client versions. Build the IPsec configuration, then move users in a controlled pilot before removing the old access path.
What it does not mean
The change does not make every form of browser-based access disappear. Fortinet describes web mode, or agentless VPN, as clientless network access through a browser with built-in SSL encryption. That mode serves a narrower use case than a routed tunnel and should not be presented as an equivalent replacement for every SSL tunnel application.
How the three FortiGate access models work
IPsec tunnel mode
IPsec creates an encrypted tunnel using the Internet Key Exchange (IKE) to authenticate peers and negotiate cryptographic parameters, followed by encrypted data transport. For remote access, the FortiGate assigns or routes addresses and applies firewall policy to traffic entering the tunnel. For site-to-site connections, the same standards-based technology carries traffic between networks.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchFortinet’s migration guidance recommends IKEv2. It can be transported over UDP, and the design can use TCP when required. TCP 443 fallback is particularly useful when an upstream firewall permits ordinary HTTPS but blocks UDP 500 and 4500. Whether a specific client and FortiGate model support every transport combination must be checked against their release documentation.
SSL VPN tunnel mode
On releases that still provide it, SSL tunnel mode uses TLS protection and an endpoint client to create a remote-access tunnel over HTTPS-oriented connections. It has traditionally been familiar to remote users and can expose a broad range of internal applications through the client. Its availability is now tied to the FortiOS release, and FortiOS 7.6.3+ changes the migration path to IPsec.
Rank #2
Web mode (agentless VPN)
Web mode presents selected resources in a browser, so a user does not install a VPN application on the endpoint. The browser connection is protected with SSL encryption. This is useful for tightly scoped access from an unmanaged computer, but it supports fewer applications than a network tunnel. Protocols or applications that require arbitrary native connections, custom ports, or local-network discovery may not work through the web portal.
Security: neither protocol is secure by default
IPsec and SSL tunnel mode can both provide strong protection when configured and maintained correctly. The protocol name alone does not establish the security level. The effective result depends on authentication, cryptographic proposals, certificate validation, patching, segmentation, and the firewall policies applied after a user connects.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Encryption and negotiation
IPsec uses negotiated IKE and data-plane cryptography. Select current, mutually supported algorithms and remove obsolete proposals where your FortiOS and client versions permit it. Keep the proposal set narrow enough to avoid accidental downgrade while retaining compatibility with the clients you actually support.
SSL tunnel mode protects the connection with TLS. Its security therefore depends on the TLS capabilities of the FortiOS release and client, the server certificate presented to users, and correct validation of that certificate. A valid encryption layer does not compensate for a weak authentication policy or an over-permissive post-login rule.
Authentication and identity
Document which user directory, multifactor method, group mapping, and certificate requirements are used for each access profile. The same identity can receive very different effective access if it is placed in a different group or matched by a broader firewall policy. Require the strongest authentication your environment supports, remove dormant accounts, and review group membership as part of every migration.
Certificates
For either design, track the certificate used by the VPN service, its issuing chain, subject names, expiration date, and the trust stores on managed clients. A certificate renewal can look like a protocol outage when clients reject the new chain or name. Test renewal on a pilot client and keep an overlap or rollback procedure appropriate to your certificate process.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteSegmentation and policy
A successful tunnel only proves that negotiation and authentication worked. Firewall policy still determines whether the user can reach a server, subnet, or administrative interface. Use separate groups and policies for different job functions, restrict destination networks and ports, and avoid granting the entire internal address space merely because a full tunnel is convenient.
Compatibility with NAT, restrictive firewalls, and operating systems
When UDP is blocked
IPsec commonly uses UDP 500 for IKE and UDP 4500 when NAT traversal is in use. Restrictive guest Wi-Fi, hotel networks, and corporate egress filters may block one or both. Fortinet documents TCP transport, including TCP 443 fallback, for migration designs. This allows the tunnel to resemble permitted HTTPS traffic, but it is not a guarantee that every captive portal, proxy, or inspection device will pass it.
SSL transport behavior
SSL tunnel mode is built around HTTPS and has historically passed through more networks without special UDP handling. Where supported, DTLS/UDP can avoid some of the performance problems of carrying a reliable tunnel inside a reliable TCP connection. If DTLS is unavailable or blocked, SSL over TCP can experience TCP-in-TCP retransmission and head-of-line delays, especially on lossy links.
NAT and address planning
For IPsec, confirm that NAT traversal, address pools, and overlapping private networks are handled consistently at both ends. An address pool that overlaps a user’s local home network can make an apparently authenticated connection unable to reach internal hosts. Document the pool, DNS servers, routes, and any exclusions before migration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
Client and release matching
FortiClient compatibility is a release-specific constraint in Fortinet’s migration guidance. Match the client version, operating-system support, authentication plug-ins, and EMS or management policies to the FortiOS release. Do not assume that a client which connected to SSL tunnel mode will connect to the new IPsec profile without an update or a new profile.
Performance and user experience
Fortinet identifies efficient bandwidth use and low latency as IPsec benefits. In practice, throughput and responsiveness depend on encryption proposals, FortiGate capacity, client hardware, Internet path, packet loss, and the amount of traffic sent through the tunnel. No universal speed advantage applies to every deployment.
Why TCP-in-TCP can feel slow
When a reliable VPN stream is carried inside another reliable TCP stream, a lost packet at the outer layer can cause retransmission and hold up unrelated inner traffic. This is the TCP-in-TCP problem associated with SSL tunnel mode when it cannot use a datagram transport. Interactive applications, voice, and remote desktop are more sensitive to these delays than ordinary web requests.
Choosing full tunnel or split tunnel
Full-tunnel routing sends a user’s Internet traffic through the FortiGate, which simplifies centralized inspection but consumes more gateway bandwidth. Split tunneling sends only specified internal networks through the VPN, reducing gateway load but requiring careful route and DNS design. The choice is an access-policy decision, not an inherent property of IPsec or SSL.
Migration plan for FortiOS 7.6.3+
Use a staged procedure rather than changing the gateway and all clients at once.
- Record the current service. List SSL tunnel portals, user groups, authentication methods, certificates, address pools, DNS settings, split/full-tunnel routes, firewall policies, and applications used by each group.
- Confirm the target versions. Check the FortiGate model and FortiOS build, FortiClient versions, operating systems, management platform, and authentication integrations. Fortinet’s documented client constraints should be treated as a release gate.
- Design the IPsec profile. Prefer IKEv2 as recommended in Fortinet’s migration guidance. Select compatible cryptographic proposals, define peer and user authentication, assign an address pool, and choose UDP, TCP, or TCP 443 fallback according to the networks your users actually encounter.
- Recreate access controls. Map each former SSL portal or group to IPsec policies, routes, DNS behavior, and destination restrictions. Verify that the resulting policy gives only the intended networks and services.
- Prepare certificates and trust. Install the correct server certificate and chain, confirm names and expiration, and distribute any required trust anchors to managed endpoints before the pilot.
- Build a pilot group. Include users on a normal office connection, a home connection behind NAT, and at least one restrictive network. Test sign-in, multifactor prompts, internal DNS, file services, web applications, remote administration tools, and disconnect/reconnect behavior.
- Test failure and recovery. Block UDP where possible to verify the intended TCP or TCP 443 fallback. Revoke a test account, expire a test certificate, and remove a test route to confirm that failures are visible and recoverable.
- Roll out in waves. Publish the new client profile, move one group at a time, and retain a documented rollback path until usage and logs show stable operation.
- Retire obsolete access. After the final group is confirmed, disable unused SSL tunnel objects, old client profiles, and broad firewall rules. Remove stale certificates and credentials from endpoints and management systems.
Ongoing maintenance checklist
Every FortiOS upgrade
- Read the release notes for VPN behavior, supported IKE versions, transport options, certificate handling, and FortiClient compatibility.
- Export or otherwise preserve the current configuration and record a tested rollback plan.
- Check that the target FortiOS version still supports the FortiGate model, authentication integrations, and endpoint operating systems in use.
- Re-test one client for each operating system and access profile before broad deployment.
Monthly or on your security schedule
- Review failed logins, unusual source locations, repeated tunnel negotiation failures, and accounts that no longer need remote access.
- Check certificate expiry and the health of the issuing chain.
- Review cryptographic proposals and remove legacy options when all clients support the stronger set.
- Compare VPN groups and firewall destinations with current job requirements; remove unused routes and policies.
- Verify that tunnel-health monitoring and alerting reach the staff responsible for response.
After a client or identity change
- Retest authentication, multifactor prompts, group mapping, address assignment, DNS, and routes.
- Confirm that a new FortiClient or operating-system update does not alter IKE, certificate, or transport behavior.
- Recheck restrictive-network fallback if the client profile or transport preference changed.
Troubleshooting by symptom
The user cannot establish a tunnel
- Confirm the FortiGate service is listening on the expected transport and that upstream devices permit it.
- Check IKE version, proposals, authentication parameters, certificate names, and trust chains on both client and gateway.
- Review the user’s group mapping and ensure the account is allowed to use the selected profile.
- If UDP is blocked, test the configured TCP or TCP 443 fallback rather than repeatedly changing encryption settings.
The tunnel connects but internal applications fail
- Check the assigned address pool for overlap with the user’s local network.
- Verify routes, split/full-tunnel settings, DNS servers, and firewall policies for the destination.
- Test one known internal IP address and one hostname to distinguish routing from DNS failure.
- Confirm that the application is suitable for a routed tunnel; browser-only resources may have been designed for web mode instead.
The connection is slow or repeatedly stalls
- Measure whether the path is using SSL over TCP and suffering TCP-in-TCP effects; use a supported DTLS/UDP or IPsec transport where policy permits.
- Check packet loss, latency, client CPU, FortiGate resource use, and the amount of traffic sent through a full tunnel.
- Test split tunneling as a policy and capacity decision, not as an automatic performance cure.
Users fail after an upgrade
- Confirm whether the upgrade crossed the FortiOS 7.6.3 threshold that replaces SSL tunnel mode.
- Compare the installed client and new IPsec profile with Fortinet’s documented version constraints.
- Restore the last known-good access path only under a documented rollback plan; do not leave obsolete, broadly permissive policies enabled indefinitely.
Which option fits common deployments?
Employees needing many internal applications
Use IPsec for a current FortiOS deployment. It provides a standards-based routed tunnel and can accommodate restrictive networks through the supported transport options. Build narrow policies and decide explicitly whether Internet traffic is full-tunnel or split-tunnel.
Contractors using unmanaged computers
Consider web mode when the required resources are browser-accessible and can be safely exposed through a limited portal. If contractors need native file, database, or administrative applications, a managed endpoint and IPsec profile provide a more complete control model.
A legacy estate that cannot migrate immediately
Keep the existing SSL tunnel only on a supported FortiOS release while you complete client, certificate, authentication, and policy preparation. Set a deadline tied to the FortiOS upgrade plan; do not treat legacy availability as evidence that SSL tunnel mode will remain on later releases.
Recommended Free Tools
Site-to-site connectivity
IPsec is the natural choice because it is designed for standards-based network-to-network tunneling. Define both sides’ subnets, routes, proposals, authentication, and monitoring, then test failover and rekey behavior before carrying production traffic.
Bottom line
For FortiOS 7.6.3 and later, design around IPsec and plan the migration as an operational change. SSL tunnel mode may still exist on older releases, while web mode remains useful for narrowly scoped, browser-only access. Security and reliability come from the complete system—version compatibility, IKE and cryptographic settings, certificates, authentication, segmentation, transport fallback, patching, and monitoring—not from choosing a protocol name in isolation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
