Ferrite Guidance Hub Interactive Field Runbook #17
← All Runbooks Main Platform
Zero-Trust & Identity · Remote Access Migration

SSL-VPN to IPsec / ZTNA Migration & Heap Memory Leak Mitigation

Step-by-step operational migration and hardening guide to isolate SSL-VPN daemon memory leaks (sslvpnd), restrict unauthorized WAN access and transition remote workforce users to hardware-accelerated IKEv2 Dial-Up and ZTNA HTTPS access proxies across 12 consolidated Fortinet TAC knowledge base articles.

RUNBOOK POSITION 17 OF 17 Zero-Trust & Identity SSL-VPN Migration ⚡ 12 KBs Consolidated
SSL-VPN Daemon Blast Radius Verify `sslvpnd` process memory footprint in `diagnose sys process top` and check for memory leaks triggering conserve mode.
FortiClient Profile Deployment Ensure FortiClient EMS endpoints have provisioned IKEv2 / ZTNA connection profiles before disabling SSL-VPN listener ports.
Public Port Conflict Audit Confirm that disabling SSL-VPN port 443 frees the interface listener for ZTNA HTTPS Access Proxy VIPs.

Migration & Triage Workflow

STEP 01

Audit active SSL-VPN tunnels & daemon memory

Capture active SSL-VPN user tunnels, tunnel memory consumption and verify if `sslvpnd` workers are leaking memory buffers.

diagnose vpn ssl list
diagnose sys process top
STEP 02

Isolate and recycle high-memory sslvpnd workers

Safely restart stuck SSL-VPN worker threads to release heap memory buffers without requiring a full appliance reboot.

fnsysctl killall sslvpnd
STEP 03

Provision hardware-accelerated IKEv2 Dial-Up VPN

Configure IKEv2 Dial-Up with EAP-MSCHAPv2 / SAML authentication, offloaded to NP7 hardware for 10x throughput and zero conserve-mode risk.

config vpn ipsec phase1-interface
    edit "IKEv2_DIALUP"
        set type dynamic
        set interface "wan1"
        set ike-version 2
        set authmethod psk
        set peertype any
        set net-device disable
        set mode-cfg enable
        set ipv4-start-ip 10.200.1.1
        set ipv4-end-ip 10.200.1.254
        set ipv4-netmask 255.255.255.0
    next
end
STEP 04

Deploy Local-In Policy to restrict legacy SSL-VPN exposure

While migration is underway, restrict SSL-VPN connection access exclusively to approved geographic regions or trusted subnets.

config firewall local-in-policy
    edit 10
        set intf "wan1"
        set srcaddr "GEO_AUTHORIZED_COUNTRIES"
        set dstaddr "all"
        set action accept
        set service "SSL_VPN_PORT"
        set schedule "always"
    next
    edit 11
        set intf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action deny
        set service "SSL_VPN_PORT"
        set schedule "always"
    next
end
STEP 05

Decommission legacy SSL-VPN portal and release port 443

Once all endpoints are transitioned to IKEv2 / ZTNA, disable the SSL-VPN listener to eliminate the attack surface completely.

config vpn ssl settings
    set status disable
end
Operational Caution: Disabling SSL-VPN without a provisioned IKEv2 fallback will immediately disconnect remote staff. Verify at least one test pool on IKEv2 before executing `set status disable`.

Consolidated Fortinet Knowledge Base & Technical References