FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Nivedha
Staff
Staff
Article Id 288653

 

Description

This article describes why the SSL VPN options may not be visible in FortiGate, and explains how to fix it by enabling the SSL VPN feature or through CLI commands.

Scope

FortiGate.

Solution

For Firmware lower than v7.4.1:

The SSL VPN feature can be enabled from Feature Visibility, navigate to System -> Feature Visibility and enable SSL VPN as shown below:

 

Nivedha_0-1702259533694.png


For Firmware v7.4.1 and above:

Due to the change in default behavior from v7.4.1 onward, the SSL VPN settings and the menus remain hidden from the GUI under VPN Settings and missing under feature visibility.

Under VPN:


vpn2.PNG

 

Under System -> Feature Visibility:

vpn1.PNG

 

The feature now must be enabled from the CLI, to enable the VPN -> SSL VPN GUI menu:

 

config system settings
    set gui-sslvpn enable
end

 

This is the default behavior in the brand-new installation of v7.4.1:

Changes in default behavior

(Bug ID: 923718)


The above CLI commands can also be used in firmware versions lower than v7.4.1. To enable the IPsec VPN feature, navigate to System -> Feature Visibility and enable IPsec VPN as shown below:

Screenshot 2024-09-04 144757.png

 

It is also possible to run the following command via the CLI to enable the IPSec VPN feature:

 

config system settings

    set gui-vpn enable

end

 

Web mode and realm features are also disabled by default and will not be enabled with the above commands. It is possible to enable it with the following commands:

 

config system global

    set sslvpn-web-mode enable

end

 

config system settings

    set gui-sslvpn-realms enable

end

 

Note:

Starting from v.7.6.x, the SSL VPN web and tunnel mode feature will no longer be available from the GUI or CLI for FortiGates with 2GB of RAM or below. A workaround is to use an IPsec dial-up tunnel for remote access VPN instead:

SSL VPN removed from 2GB RAM models for tunnel and web mode

From v7.0.16 onwards, the SSL VPN feature will not be available on the FortiGate-90G and 91G models.
SSL VPN not supported on FortiGate 90G series models | FortiGate / FortiOS 7.0.16 | Fortinet Documen...

 

v7.2.10 still supports SSL VPN on the FortiGate-90G and 91G models. In v7.4.x, this option can be enabled from the CLI using the below commands.


 config system settings

      set gui-sslvpn enable

 end

SSL VPN is not supported on either the FortiGate-30G model or the FortiGate-50G model.

 

Related Article:

https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/pdf/fortigate-fortiwifi-30g-series....

https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/pdf/fortigate-fortiwifi-50g-series....