Since SSLVPN will be discontinue on 7.6, herewith my feedback on FortiClient IPSEC

[LVHan]

ince FortiOS going to obsolete SSLVPN from 7.6 onward,

Information

1. Ditch away the idea user group, it unable support user grouping like SSL VPN did.
2. FSSO is a must for user grouping except local database, but FSSO has some restriction
3. FSSO deploy with DC agent mode for better performance
4. Please test with your own mobile data, example I connect my office wifi and the office WAN IP is use to peer with DC via IPSec, when test this remote access I always matched with the office IPSec profile.
5. If you have multiple IPSec dailup profile, it could be matched to other IPsec profile that contain same phase-1 variable, especially the NAT-T option. Example, your Remote Access profile name F, FortiGate will try match the proposed variable from top to bottom (Profile A-F), let say the proposed proposal profile match variable at Profile C, firewall will take the NAT-T value at Profile C and negotiated based on it, but your remote user Profile F is without NAT-T but FortiGate will keep communicate with NAT-T 4500, so configure the propose profile wisely else will keep troubleshoot here and there.
6. Mobile phone setup, going be a nightmare, wrong pre-sharekey key in by user, wrong proposal selected and more.
7. Azure Group object wont work for BYOD.

Local User Database

1. Grouping user only option is to configure multiple dailup profile with different peer id and different profile has different assigned ip to group the user.

LDAP information

1. Support ikev1, stick to ikev1 if you have mobile phone user.
2. IKEV2 due to EAP-TLS must be turn on require amended the xml and restore the amended xml file on desktop but mobile phone setup there is no option to select EAP TLS, not sure it support ot not (EAP-TTLS support for IPsec VPN)

Radius

1. 
   Didn't test lazy to setup, more or less the same

SAML information

1. 
   No object group id is allow, else will face EAP error issue (Technical Tip: Error 'EAP failure' with IPsec Dial-Up VPN using remote groups)
2. Object Group ID wont work for Azure
3. Even integrated with FSSO DC agent, it need user to lock and relogin to trigger the netlogon update quite troublesome.

Related document for SAML
Technical Tip: Configuring IPsec VPN client-to-site with Azure SAML authentication

BYOD

Bye, if a domain environment, netlogon details doesn't send to AD so FSSO wont work.

Other site information
Forti VM with FortiOS 7.4.8
diagnose debug application authd -1 when turn on this debug the SAML wont work till disable debug

Update 17 July 2025,
FSSO
Due to AD behavior, FSSO also has some limitation on user identification, example IPSEC success with limvuihan (IP 192.168.10.1) but I remote desktop with domain admin pbbadmin to another server due to AD behavior, the logon event id will be update that pbbadmin IP address same as your IPSEC IP which is 192.168.10.1. So all the defined rules based on grouping wont work and unable access. Alternative is to ignore the pbbadmin user list at collector agent.
If your RDP username is same as your FortiClient Login ID mostly will be disconnect.

Update 1st August 2025
So when there is user connect the FortiClient IPsec, cant change the Split Tunnel Parameter , is not flexible as SSL VPN Tunnel request user to reconnect the VPN to get the new route.

[djp]

You can use network id or localID identifier to simulate groups with IPSEC

I'm sure FTNT will have an enhancement soon

[LVHan]

Yes for small scale client, but no for large scale enterprise.

7.4 end of engineering at May 2026, not much time left for 7.6 improvement.

[Toshi_Esumi]

Since IPsec over TCP w/ Free FortiClient VPN wouldn't be supported any more. FGT is no longer an option for many of smaller, non-corporate, users like my home. UDP IPsec is widely blocked over public WiFi, hotel WiFi, and often overseas access. At least an EMS server/EMS Cloud license is required to do either IPsec over TCP or ZTNA for remote access.

I'm now looking for something else like OPNsense to replace my home 40F before upgrading it from 7.4.8 to 7.6.4 or later version.

Toshi