FortiGate SSL VPN Hardening Checklist (2026)

FortiToken Mobile or token-based MFA

For a FortiOS-managed LDAP user, go to User & Authentication > User Definition, create or edit the remote LDAP user, enable Two-factor Authentication, choose FortiToken, and assign the token. Fortinet warns that MFA for remote LDAP and RADIUS users can be bypassed if the typed username case does not match the user definition, so disable username sensitivity on each such user. This is a CLI-only setting.

config user local
    edit "<vpn-user>"
        set type ldap
        set ldap-server "<ldap-server>"
        set email-to "<user-email>"
        set username-sensitivity disable
        set two-factor fortitoken
        set fortitoken "<token-serial>"
    next
end

SAML with Microsoft Entra ID or Okta

Fortinet documents FortiGate as the SAML service provider and Microsoft Entra ID or Okta as the identity provider. Enforce MFA and access policy at the IdP, place the SAML object in a FortiGate user group, then map that group under VPN > SSL-VPN Settings > Authentication/Portal Mapping. Microsoft Authenticator is an MFA method managed by Entra ID, not a separate FortiGate token type.

LDAP or RADIUS with MFA

Fortinet documents LDAP users paired with FortiToken and RADIUS with FortiAuthenticator/FortiToken Mobile push. Email two-factor authentication is also documented. SMS and email codes are available FortiOS options, but use the strongest method your identity system and recovery process support.

SSL VPN source login limits

In FortiOS 7.4, login-attempt-limit defaults to 2 failed attempts and login-block-time defaults to 60 seconds. Fortinet's technical tip gives ranges of 0–10 attempts and 0–86400 seconds, but the 7.4 CLI reference lists a wider range, so check the accepted values on your release. Setting either to zero disables the block. login-timeout (10–180 seconds, default 30) is the time FortiClient has to set up the tunnel after a successful login. It is not a lockout timer.

config vpn ssl settings
    set login-attempt-limit <attempts>
    set login-block-time <seconds>
    set login-timeout <10-180>
end

The block time is also the window in which failures are considered consecutive. Fortinet notes that this method does not apply to SAML groups because the IdP handles the username and password entries.

Firewall user authentication lockout

Fortinet documents config user setting lockout for firewall user authentication, such as captive portal logins. It is separate from the SSL VPN source block above. In FortiOS 7.4.6, auth-lockout-threshold accepts 1–10 and defaults to 3, and auth-lockout-duration accepts 0–4294967295 seconds and defaults to 0. A Fortinet technical tip says a duration of 0 applies a 60-second lockout. Set an explicit duration and test it.

config user setting
    set auth-lockout-threshold <1-10>
    set auth-lockout-duration <seconds>
end

A lockout policy can itself be abused to deny access to known usernames. Combine it with MFA, source restrictions and monitoring. See account lockout prevention and password spraying against VPNs.

Replace the factory certificate

Import a certificate for the VPN hostname under System > Certificates. Select it at VPN > SSL-VPN Settings > Server Certificate. Fortinet describes its factory self-signed certificates as installation and testing aids and recommends a server certificate signed by a trusted CA.

config vpn ssl settings
    set servercert "<trusted-vpn-server-certificate>"
end

Set the minimum TLS version

In the FortiOS 7.4 CLI reference, ssl-min-proto-ver defaults to tls1-2 and algorithm defaults to high. Confirm that neither was lowered for old clients, and test all supported FortiClient versions before raising the minimum to TLS 1.3.

config vpn ssl settings
    set ssl-min-proto-ver tls1-2
    set algorithm high
end

The ciphersuite setting controls TLS 1.3 cipher suites. Fortinet notes that strong-crypto does not control the SSL VPN encryption level.

Keep HTTPS and SSH management off the public WAN

Fortinet's hardening guide says external WAN access to administrative ports is generally not recommended. Use a trusted management interface or an out-of-band path. If public access is unavoidable, restrict it with trusted hosts or a local-in policy.

Set trusted hosts and administrator MFA

Go to System > Administrators, edit each administrator, define trusted hosts, and enable two-factor authentication. FortiOS supports FortiToken, FortiToken Cloud, email and SMS for administrator MFA. Fortinet recommends creating a second recoverable administrator before enabling MFA on the main account.

config system admin
    edit "<administrator>"
        set trusthost1 <management-subnet> <netmask>
        set two-factor fortitoken
        set fortitoken "<token-serial>"
    next
end

When every administrator has trusted hosts, FortiOS restricts administrative access to those sources, except for ping. Fortinet's hardening guide also recommends changing the default administrative ports and the default admin username to non-standard values. The SSL VPN security best practices recommend a custom SSL VPN listening port instead of the default 10443.