FortiGate VPN Options and What You Actually Licence
FortiGate remote and site connectivity usually means IPsec VPN (site-to-site and dial-up / remote access), optional ZTNA with FortiClient and EMS, and — only where your FortiOS version and model still allow it — SSL VPN modes. On FortiOS 7.6, SSL VPN tunnel mode is removed (replaced by IPsec); some small models with limited RAM also lose Agentless (web-mode) VPN. Licence the FortiGate bundle for the security services you need; endpoint ZTNA/VPN clients are licensed separately when you use FortiClient EMS.
Megatron Technology Pte Ltd (est. 1990), Singapore Cisco Networking Partner and Managed Services Provider, Fortinet reseller. CT Hub, Kallang.
Related pages: Fortinet · FortiOS 7.6 removed SSL VPN on small FortiGates · FortiGate vs Meraki MX for Singapore offices · Knowledge base
What VPN options do buyers actually choose?
| Option | Typical use | What you licence (high level) |
|---|---|---|
| IPsec site-to-site | Office ↔ office, office ↔ cloud VPC/VNet | Included in FortiGate capability; size for IPsec throughput. Peer device/cloud may have its own costs |
| IPsec dial-up (remote access) | Staff VPN into the office, including migrations from SSL VPN tunnel mode | FortiGate side is feature/config; users often run FortiClient. EMS/endpoint licences apply when you manage clients centrally |
| SSL VPN tunnel mode | Legacy remote access on older FortiOS | Not available from FortiOS 7.6.3 onward on FortiGates — migrate before upgrade |
| Agentless / web-mode VPN | Browser-based access without full tunnel client | Removed on listed small models in 7.6; still check release notes for your exact model |
| ZTNA | Application access with continuous trust checks via FortiClient | FortiClient ZTNA/endpoint licensing via EMS (seat counts and minimums are Fortinet programme rules — confirm current) |
FortiOS 7.6: read this before you renew or upgrade
Fortinet’s FortiOS 7.6 release notes state that SSL VPN tunnel mode is replaced with IPsec VPN (configurable to use TCP/443) starting in 7.6.3, across models. Separately, Agentless VPN (formerly SSL VPN web mode) is no longer available on listed entry models (including common 40F/60F-class and several G-series desktops — see the current notes for the full list). If remote access is how your staff work, treat firmware target and VPN design as a migration project. Details for buyers: FortiOS 7.6 Removed SSL VPN on Small FortiGates. When planning the hop list itself, use FortiGate Firmware Upgrade Path.
What is usually included vs sold separately?
On the FortiGate: configuring IPsec and (where still present) SSL VPN features does not typically mean a separate “VPN SKU” on top of the appliance — you still need appropriate FortiCare/FortiGuard bundles for a supported, inspected gateway.
On the endpoint: unmanaged/free client options exist for some use cases; managed FortiClient with EMS and ZTNA is a different bill of materials with per-endpoint entitlements. Confirm current FortiClient ordering guides rather than assuming seats are free.
SAML / MFA / certificates: often integrate with identity products you already own; those may carry their own licences.
Through an authorised reseller, the invoice is often well below list after stack — ask for a dated quote naming users, tunnels and whether EMS is in scope.
Buyer questions to answer before the quote
How many concurrent remote users, and from where (home, travel, partners)?
Site-to-site only, remote users only, or both?
Current FortiOS version and whether 7.6 is on the roadmap.
Do you need full tunnel, application-level ZTNA, or browser-only access?
Is FortiClient already deployed? Who manages EMS today?
Any cloud networks (AWS/Azure/GCP) that need IPsec back to Singapore?
What is the bandwidth of the site?
Frequently asked questions
Is IPsec “worse” than SSL VPN for staff?
Not as a rule. Fortinet’s direction is IPsec dial-up for remote access, including options that work over TCP/443 to ease firewall traversal. User experience depends on client packaging, MFA and how you split-tunnel — not the logo on the protocol.
Do we need ZTNA to replace SSL VPN?
No. Many offices migrate tunnel users to IPsec dial-up first. ZTNA is a broader access model when you want per-app controls and device posture. Choose it for security design reasons, not only because SSL VPN disappeared.
Does VPN throughput appear on the datasheet?
Yes — IPsec VPN throughput is a separate column from threat protection. Size remote-access gateways with both user count and VPN throughput in mind; see How to Size a FortiGate.
Can Megatron migrate us off SSL VPN?
Yes — planning, FortiClient packaging, cutover windows and firmware path are normal reseller professional services.
Licence FortiGate VPN the way your staff actually connect
Megatron Technology Pte Ltd is a Singapore networking specialist established in 1990 (UEN 199002644W), a Cisco Networking Partner and Managed Services Provider, and a Fortinet reseller, based at 2 Kallang Avenue, #08-17 CT Hub. Tell us your remote-user count, FortiOS version and whether EMS is required — we will propose IPsec/ZTNA options and a dated quote. Visit our Fortinet page or contact Megatron Technology.