VPN and ZTNA take different approaches to remote access. Zero Trust principles, the end of SSL VPN tunnel mode in FortiOS 7.6.3, and how to migrate.
A VPN encrypts a tunnel between a remote device and the corporate network, then generally trusts the user once they are connected. Zero Trust Network Access (ZTNA) reverses this logic: every access to every application is verified, continuously, based on identity, device posture and context. Both approaches coexist today, and understanding how they differ helps you choose the right architecture for remote work and third-party contractors.
A remote access VPN (often called "client-to-site" or "dial-up") establishes an encrypted tunnel between the user's device and a gateway, such as a firewall. Once authenticated, the user receives an address on the internal network and can reach the resources allowed by the filtering rules.
This model remains easy to understand and works with almost every application, including legacy protocols. Its weaknesses are well known:
The Zero Trust model is formalised by NIST in publication SP 800-207 (Zero Trust Architecture, August 2020). Its core principle: no implicit trust is granted to a user or a device simply because of its network location or because it belongs to the organisation. Authentication and authorisation are performed before each session to a resource, and protection focuses on the resources themselves rather than on network segments.
ZTNA applies this model to application access. In practice:
An important change affects FortiGate administrators. Starting with FortiOS 7.6.3, SSL VPN tunnel mode is no longer supported: the related configuration, including the associated firewall policies, is not carried over during the upgrade. Fortinet asks customers to migrate these connections to IPsec VPN before moving to 7.6.3. IPsec can now use TCP as its transport (port 443 by default), which helps when UDP is filtered or degraded by a carrier. SSL VPN web mode is retained but renamed "Agentless VPN". Finally, a FortiGate configured as an SSL VPN client is no longer supported and must be switched to an IPsec dial-up client.
If your environment still relies on SSL VPN tunnel mode, you therefore need to plan the migration (FortiClient profiles, authentication, policies) before any firmware upgrade.
Fortinet offers a ZTNA solution built on existing components:
For organisations that prefer a cloud service, FortiSASE delivers these secure access functions from the cloud, with no gateway to host in-house.
In practice, few organisations move from VPN to ZTNA in a single step. A gradual approach produces better results:
For entities subject to Law No. 05-20 on cybersecurity in Morocco, this work naturally fits within the requirements for securing access to information systems, whose implementation is governed by Decree No. 2-21-406 and overseen by the DGSSI.
Implementing IPsec VPN and ZTNA on FortiGate requires a solid command of FortiOS: policies, authentication, certificates and security profiles. The FortiGate Administrator certification preparation covers these fundamentals. To place these choices within a complete security architecture, CompTIA Security+ provides the foundations, and ISC2 CISSP is aimed at professionals who design and manage the access strategy.
The VPN has not disappeared, but it is no longer sufficient as the only answer to remote access. ZTNA reduces the attack surface by granting access to specific applications after continuous verification of the user and the device. For Fortinet environments, the end of SSL VPN tunnel mode is a good opportunity to review the access architecture as a whole.