How to Migrate FortiGate SSL VPN to IPsec VPN Before Upgrading to FortiOS 7.6.3

Overview

This guide provides step-by-step instructions to replace SSL VPN tunnel mode with a dial-up IPsec VPN on a FortiGate before upgrading to FortiOS 7.6.3 or later. It covers the full migration workflow, from checking whether your hardware is affected and backing up the existing configuration, through building the IPsec tunnel with the VPN wizard, enabling TCP transport on port 443 for users behind restrictive firewalls, rebuilding firewall policies, and migrating the FortiClient EMS profile, so remote access continues working without an outage on upgrade day.

SSL VPN tunnel mode is removed in FortiOS 7.6.3. Existing tunnel mode settings are not carried across the upgrade, and the feature cannot be reconfigured afterwards because it is gone from both the GUI and the CLI. Complete this migration before you upgrade.

Prerequisites

Ensure all of the following are in place before starting. Missing any of these will cause the migration to fail partway through or force a rollback.

• Administrative access to the FortiGate GUI and CLI

• FortiClient EMS access, if your endpoints are centrally managed

• FortiClient 7.4.1 or later on endpoints, required for TCP transport

• A working backup of the current FortiGate configuration

• Details of your current authentication source (local, LDAP, or RADIUS)

• A test endpoint outside your network, ideally with mobile hotspot access

Do not modify your existing SSL VPN configuration. Build the IPsec tunnel alongside it. Users can then fall back to the old method during testing, and your rollback is a client-side instruction rather than a firmware restore.

Step 1: Check Whether Your FortiGate Is Affected

Two changes may apply to your device, and they landed in different releases. Confirm which one you are dealing with before planning.

Procedure:

1. Open the FortiGate CLI

2. Run the following command:

diagnose hardware sysinfo conserve

3. Check the total RAM value in the output

Note: SSL VPN web mode was not removed in 7.6.3. Fortinet renamed it Agentless VPN and existing web mode configurations survive the upgrade. Only tunnel mode is destroyed. Agentless VPN is unavailable on the 40F, 60F and 90G series.

Step 2: Back Up and Document Your SSL VPN Configuration

The wizard in Step 4 will not read your existing setup. Anything you fail to document here becomes a support ticket on rollout day.

Procedure:

1. Take a full configuration backup:

execute backup config tftp <filename> <tftp-server-ip>

Or use System → Configuration → Backup in the GUI.

2. Record the following from your current SSL VPN settings:

Expected output: A complete list of every resource your VPN users currently reach, and under which policy.

Step 3: Match Your Authentication Method

Your existing SSL VPN authentication determines how the IPsec tunnel must be configured.

Security Note: From FortiClient 7.4.4 onward, IKEv1 is no longer supported on the client. Configure any new tunnel with IKEv2. IKE version mismatch is the single most common cause of tunnels that never establish.

Step 4: Create the IPsec Tunnel Using the VPN Wizard

The wizard builds the phase 1 interface, phase 2 selectors, address objects and a base firewall policy in one pass. Hand-building these is slower and easier to get wrong.

Procedure:

1. Go to VPN → IPsec Wizard

2. Enter a tunnel name, for example RemoteAccess-IPsec

3. Select template type Remote Access

4. Select FortiClient as the remote device

5. Set the incoming interface to your WAN interface

6. Set authentication method to Pre-shared Key and enter a strong key

7. Select the user group identified in Step 3

8. Set the local interface, usually your internal LAN interface

9. Enter the local address range VPN users need to reach

10. Enter the client address pool, reusing your SSL VPN range only if it is not currently in use

11. Enter the DNS servers to push to clients

12. Click Create

Expected output: A new tunnel appears under VPN → IPsec Tunnels. IKE version, IKE mode and custom security associations can be adjusted there afterwards.

Step 5: Enable TCP Transport on Port 443

This step makes IPsec work for users on hotel wifi, mobile data and guest networks that block UDP 500 and 4500. Skip it and you will get support calls from the field.

Requirements: the tunnel must use IKEv2, and endpoints need FortiClient 7.4.1 or later.

Procedure:

1. Set the transport protocol on the phase 1 interface:

config vpn ipsec phase1-interface
    edit "RemoteAccess-IPsec"
        set transport tcp
    next
end

2. Confirm the TCP port the FortiGate listens on:

show full-configuration system settings | grep ike-tcp

Expected output: set ike-tcp-port 443

Note: transport is set per tunnel, but ike-tcp-port is a system-wide setting. Changing the port affects every IPsec tunnel on the device, including site-to-site links to branches and partners. Confirm what else runs over IPsec before changing it.

Check that nothing else on the FortiGate already uses TCP 443 on the same WAN interface, such as the admin GUI or an Agentless VPN portal. Move the admin HTTPS port if there is a conflict.

Step 6: Rebuild Your Firewall Policies

The wizard creates one policy covering the address range you entered. Your SSL VPN setup almost certainly had more.

Procedure:

1. Go to Policy & Objects → Firewall Policy

2. Filter for policies using ssl.root as the incoming interface

3. For each one, create an equivalent policy with the new IPsec tunnel interface as the source

4. Match the destination addresses, services and schedule

5. Apply the same security profiles, including antivirus, web filter and application control

6. Leave the SSL VPN policies enabled for now

Note: Security profiles are the most commonly missed item here. If your SSL VPN policies applied inspection and your IPsec policies do not, you have quietly reduced coverage without any alert being raised.

Step 7: Update the FortiClient EMS Profile

Teams frequently leave this until last, then discover on rollout day that hundreds of managed endpoints are still pushing the old profile. The FortiGate and FortiClient configurations must match, so migrate them together.

Procedure:

1. In FortiClient EMS, open the endpoint profile currently in use

2. Go to the VPN section

3. Add a new IPsec VPN connection with the following values:

4. Leave the existing SSL VPN connection in the profile so users see both options

5. Save and push the profile to a small test group only

Expected outcome: Test endpoints show both an SSL VPN and an IPsec connection option in FortiClient.

Step 8: Test and Verify the Tunnel

Test from a machine outside your network. Testing from the LAN proves nothing.

Procedure:

1. Connect using the new IPsec entry in FortiClient

2. Confirm the tunnel is negotiating on the FortiGate:

diagnose vpn ike gateway list

3. Confirm traffic is passing:

diagnose vpn tunnel list

4. From the client, reach the internal resources users actually need. Test a file share, an internal web application and RDP if applicable

5. Repeat the test on a mobile hotspot or guest wifi network

Expected outcome: The tunnel establishes on both broadband and mobile networks, and every resource reachable over SSL VPN is reachable over IPsec.

Note: A tunnel that comes up is not the same as access that works. Test the applications, not just the connection state.

Step 9: Decommission SSL VPN and Upgrade

Only once every user group is validated on IPsec.

Procedure:

1. Remove the SSL VPN connection from the FortiClient EMS profile and push the update

2. Disable the SSL VPN firewall policies, then delete them

3. Remove the SSL VPN portal and settings configuration

4. Take a fresh configuration backup

5. Upgrade to FortiOS 7.6.3 or later

Compliance Note: If CERT-In log retention requirements apply to your organisation, confirm the IPsec tunnel produces equivalent access logging before removing the SSL VPN configuration, not after.

Common Issues and Troubleshooting

IPsec tunnel will not establish at all

Most often an IKE version mismatch or a pre-shared key that does not match exactly. Confirm both sides are set to IKEv2, and re-enter the pre-shared key on both the FortiGate and the client rather than assuming it copied cleanly. Run diagnose debug application ike -1 with debug enabled to see where negotiation fails.

Tunnel connects but no traffic reaches internal resources

A firewall policy or phase 2 selector problem. Confirm a policy exists from the IPsec tunnel interface to your internal interface, and that its destination address actually covers the resource you are testing. Compare against the SSL VPN policy you documented in Step 2.

VPN works on home broadband but fails on mobile data or hotel wifi

UDP 500 and 4500 are being blocked on those networks. Enable TCP transport as described in Step 5, and confirm the FortiClient profile has Enable IPsec over TCP ticked with a matching port.

LDAP or RADIUS authentication fails after migration

Confirm the user group referenced in the phase 1 configuration is the correct one, and that the FortiGate can still reach the authentication server. Test the authentication source independently before assuming the tunnel is at fault.

Some users connect while others are refused

The client address pool has run out of addresses. Check the pool size against your peak concurrent user count. While SSL VPN and IPsec run in parallel, the two pools must not overlap.

FortiClient still shows only the old SSL VPN option

The EMS profile has not reached that endpoint. Confirm the device is checked into EMS and that the updated profile is applied to its group, not just saved.

Admin GUI becomes unreachable after enabling TCP transport

The FortiGate admin HTTPS port is conflicting with ike-tcp-port on the same interface. Change the admin port under System → Settings, or set a custom ike-tcp-port such as 5500 and update every client profile to match.

Planning a FortiGate migration and short on runway before your upgrade window? Talk to NetNXT →

FAQs

1) Do I have to migrate SSL VPN before upgrading to FortiOS 7.6.3?

Yes. SSL VPN tunnel mode configurations are not carried across the upgrade and cannot be recreated afterwards, because the feature is removed from the GUI and CLI. Build and validate the replacement first, then upgrade.

2) Is SSL VPN completely removed in FortiOS 7.6.3?

No. Only tunnel mode. Web mode was renamed Agentless VPN and existing configurations survive the upgrade. The exception is 2GB RAM models such as the 40F, 60F and 61F, which lost SSL VPN entirely in FortiOS 7.6.0.

3) How do I make IPsec VPN work through restrictive firewalls?

Set transport tcp on the phase 1 interface and confirm ike-tcp-port is 443. This requires IKEv2 on the tunnel and FortiClient 7.4.1 or later on the endpoint, and it allows the VPN to traverse networks that block UDP 500 and 4500.

4) Can I run SSL VPN and IPsec VPN at the same time during migration?

Yes, and you should. Build the IPsec tunnel alongside the existing SSL VPN configuration so users can fall back during testing. Ensure the two client IP pools do not overlap.

5) Which FortiGate models lost SSL VPN before 7.6.3?

Models with 2GB RAM or less lost both web and tunnel mode in FortiOS 7.6.0, including FGT and FWF 40F, 60F and 61F, plus 2GB FGR-60F variants. Entry-level G-series models 50G, 70G and 90G lost SSL VPN from FortiOS 7.4.8.