Design considerations

The following example diagram represents a common SSL VPN tunnel-mode topology:

Individual users connect from the internet to the WAN interface of the FortiGate. Each user must authenticate to be granted access and establish an SSL VPN tunnel. Once connected, traffic is encrypted and secured by TLS between the endpoint and the FortiGate WAN interface. Users can access internal resources based on the configured firewall policy for their user group.

In a dial-up IPsec VPN scenario, the topology is generally the same:

Individual users connect to the WAN interface of the VPN gateway and will authenticate using the chosen method. Once the IPsec tunnel is established, traffic is encrypted and secured by the ISAKMP protocol between the endpoint and the FortiGate WAN interface. Users can access internal resources based on the configured firewall policy for their user group.

In conclusion, no topology design changes are needed to migrate from SSL VPN to IPsec VPN.