FortiClient VPN: Features, Pricing and How the Business VPN Works

FortiClient is the endpoint software made by Fortinet, a United States cybersecurity company, and its VPN feature lets remote workers connect securely to an office network over the public internet. Most people first meet it as a free, “VPN-only” download handed out by an IT department; others run the full, centrally managed version that also bundles antivirus, web filtering and Zero Trust access. This guide explains, in plain language, what FortiClient VPN actually is, how it works, what it costs, how it handles your data, and who it suits.

What is FortiClient VPN?

A VPN (virtual private network) creates an encrypted “tunnel” between your device and another network, so data travelling between the two cannot be easily read or tampered with along the way. If the idea is new to you, our plain-English guide to what a VPN is covers the basics first.

FortiClient is an endpoint agent — a small program that runs on a laptop, phone or server (the “endpoint”). Its VPN component connects that device back to a company’s FortiGate firewall or to Fortinet’s cloud service, giving staff secure access to internal files, applications and systems as if they were sitting in the office. This is the key difference from a consumer VPN such as the ones used to change your apparent location for streaming: FortiClient does not route you through a provider’s worldwide server network. It connects you to your own organisation’s gateway, which an administrator controls.

Fortinet was co-founded in October 2000 by brothers Ken Xie and Michael Xie and is headquartered in Sunnyvale, California. The company is publicly listed and sells a broad range of network-security products; FortiClient is the piece that lives on the user’s device rather than in the data centre.

How FortiClient VPN works

FortiClient supports the two VPN technologies that dominate corporate remote access:

• IPsec VPN — a long-established protocol suite that encrypts traffic at the network level. It is fast and well suited to always-on, full-device tunnels, but can be fussier to configure and is sometimes blocked on restrictive networks.
• SSL VPN — a tunnel built on TLS, the same encryption that secures web pages. Because it uses standard web ports, it usually passes through firewalls and public Wi-Fi more easily. Note that Fortinet has been steering customers away from SSL VPN on its FortiGate firewalls toward IPsec and ZTNA, so your organisation’s choice may depend on the gateway it runs.

If you want to understand the trade-offs between tunnelling protocols in more depth, see our comparison of WireGuard and OpenVPN, which explains the same encryption concepts that underpin IPsec and SSL.

Newer versions also push ZTNA (Zero Trust Network Access). Instead of giving a connected device broad access to the whole network, ZTNA checks the device’s identity and security “posture” (for example, whether it is patched and running antivirus) and then grants access to specific applications only. It is designed to reduce the damage if a single laptop is compromised: even a valid login cannot reach systems the policy does not explicitly allow for that device’s current state.

Whichever method is used, the practical experience is the same for the end user. You open the client, pick a saved connection, authenticate, and a padlock-style status shows you are connected. From then on, traffic destined for the office (or, with a full tunnel, all of your traffic) travels inside the encrypted tunnel to the gateway, which decrypts it and forwards it onward. When you disconnect, your device returns to its normal internet path.

Authentication and multi-factor options

FortiClient can verify who is connecting using usernames and passwords, digital certificates, and SAML single sign-on, which lets staff log in through an identity provider such as Microsoft Entra ID. It also integrates with FortiToken for two-factor authentication (2FA) — a second proof of identity, such as a one-time code, on top of the password. Adding a second factor is one of the most effective ways to stop stolen passwords being reused; our guide to hardening two-factor authentication explains why.

Free VPN-only client versus the full FortiClient

This is the point that confuses most first-time users, so it is worth separating clearly. FortiClient comes in two very different forms.

• Free VPN-only client. Fortinet offers a no-cost client that does basic IPsec and SSL VPN (and supports SAML and certificate login). It does not require registration with a management server, but it also has no central management, no advanced modules, and — importantly — no Fortinet technical support. It is intended for individuals who simply need to reach a FortiGate gateway. Fortinet states the free client should only be downloaded from its official FortiClient.com or FNDN portals.
• Full, managed FortiClient. The paid product is deployed and controlled through FortiClient EMS (Endpoint Management Server), either self-hosted or in Fortinet’s cloud. In this form the agent can add antivirus, web filtering, application control, vulnerability scanning and ZTNA, all configured centrally by administrators. This is the version organisations actually license.

In short: the free download is a convenience tool for connecting; the licensed, EMS-managed version is the full endpoint-security platform. They look similar but are sold and supported very differently.

Features at a glance

Depending on the edition and licence, FortiClient can provide:

• IPsec and SSL VPN remote access to a company network
• ZTNA for per-application, posture-aware access
• Endpoint antivirus and anti-exploit protection (managed editions)
• Web filtering and application firewall controls (managed editions)
• Vulnerability scanning to flag unpatched software
• Central deployment, policy and reporting through FortiClient EMS
• Integration with the wider Fortinet “Security Fabric” of firewalls and tools
• Multi-factor authentication via FortiToken and SAML single sign-on

The free VPN-only client includes only the first item on that list.

Supported platforms and system requirements

FortiClient 7.4 is the current generation at the time of writing. Supported platforms, based on Fortinet’s own release notes, are summarised below. The claim in older write-ups that FortiClient runs on “Windows Phone” is out of date — that platform has been discontinued for years.

Chromebook devices can be managed as endpoints under certain Fortinet licences, but the main desktop experience is Windows, macOS and Linux.

Pricing and licensing

There are two things to understand here. First, the VPN-only client is free. Second, the managed product is a paid subscription, and Fortinet does not publish fixed list prices — it is sold through resellers and channel partners who quote based on the number of endpoints, the licence tier (for example, a VPN/ZTNA-only subscription versus a full endpoint-protection bundle) and the contract length.

• Licences are generally bought per endpoint (or per user), typically with a minimum of 25 endpoints and terms of up to five years.
• FortiClient EMS can be self-hosted or delivered from Fortinet’s cloud (FortiClient Cloud / FortiSASE), which affects the price.
• Per-endpoint and per-user licensing cannot be mixed on the same EMS instance.

As a rough guide, reseller data aggregated by third-party pricing sites suggests figures in the region of NZ-equivalent US$15–US$40 per endpoint per year, scaling down with volume. Treat that only as an indication: the sensible step is to get a written quote from a Fortinet partner for the exact edition, endpoint count and term you need, because published figures from unofficial sources go stale quickly. The old price points that circulated for this product (specific four-figure reseller bundles) are no longer reliable.

Privacy and data collection

This is the most misunderstood part of using any corporate VPN, so it deserves a clear statement: a business VPN is a security tool, not a personal privacy tool. When you connect through FortiClient, your organisation’s gateway can see and log the traffic you send through the tunnel, and administrators set the rules. That is the point of the product — it protects the company, and it gives IT visibility and control.

Beyond that, the managed FortiClient agent sends telemetry (details about the device and its security status) to FortiClient EMS and to Fortinet’s threat-intelligence services so that protection and reporting can work. Fortinet’s own privacy policy governs what the company itself collects. If your goal is to hide your browsing from your own employer, or to gain personal anonymity online, FortiClient is not the right tool — a consumer privacy VPN such as Proton VPN is designed for that use case instead.

One practical note: because the full agent can install antivirus and other modules, some users are surprised when components they did not expect appear after a managed install. On a company-issued device that is normal and controlled by policy; on a personal device, only install the free VPN-only client unless your IT team asks otherwise. If you are ever unsure which edition you have, open the client and check whether it reports being managed by an EMS server — a standalone free client will not be.

Performance and reliability

Because FortiClient connects to your own organisation’s FortiGate or cloud gateway rather than a shared public server network, “speed” depends almost entirely on three things: your internet connection, the gateway’s capacity and location, and how the administrator has configured the tunnel. A well-provisioned FortiGate on a good link feels fast and stable; an overloaded or distant gateway feels slow regardless of the client.

Common real-world issues are configuration-related rather than faults in the software: SSL VPN ports being blocked on restrictive guest Wi-Fi, certificate or SAML login problems, split-tunnel settings that send too much (or too little) traffic through the tunnel, and version mismatches between the client and the FortiGate. The free mobile apps, in particular, attract a mix of reviews, often reflecting setup and support limitations rather than the tunnel quality itself.

Two settings matter most for everyday performance. Split tunnelling decides whether only office-bound traffic goes through the tunnel (faster, lighter) or everything does (more control, but all your browsing routes via the gateway). The encryption and protocol choice set by the administrator also affects throughput, though on modern hardware the difference is usually small. If a connection feels slow, the cause is far more often the home internet link or a distant gateway than the client itself — running a quick speed test both on and off the VPN is the simplest way to tell them apart.

How to get started

1. Check what your organisation uses. If IT has given you connection details or a pre-configured installer, follow those; the settings (gateway address, port, authentication method) must match the FortiGate.
2. Download from the official source. Get the free VPN-only client only from Fortinet’s official download pages. Avoid third-party “mirror” sites, which can bundle unwanted software.
3. Install and create a VPN connection. Choose IPsec or SSL as instructed, enter the gateway address and your credentials, and complete any two-factor step.
4. Connect and verify. Once connected, confirm you can reach the internal resource you need. If it fails, the gateway address, port, or authentication method is the usual culprit.
5. Keep it updated. Install updates when prompted so the client stays compatible with the gateway and keeps current security fixes.

How FortiClient compares

FortiClient sits in the business remote-access and endpoint category, so the fair comparison is with other enterprise VPN and Zero Trust tools rather than consumer streaming VPNs. The table below outlines several well-known alternatives and where each tends to fit. Links go to each vendor’s official page.

For individuals and small households who simply want privacy and an encrypted connection on public Wi-Fi — not office access — a consumer service such as Private Internet Access is a closer match to what they actually need, and far simpler to set up.

Common mistakes to avoid

• Treating it as a privacy VPN. It protects the organisation, not your personal anonymity from your employer.
• Downloading from unofficial sites. Only use Fortinet’s official pages for the free client.
• Confusing the free client with the full product. The free download has no central management and no Fortinet support; licensed features live in the EMS-managed edition.
• Installing the full agent on a personal device. Unless IT requires it, stick to the VPN-only client to avoid unexpected modules.
• Ignoring updates. Version mismatches between client and gateway are a frequent cause of connection failures and a security risk.

Who FortiClient VPN is for

FortiClient is a strong fit for organisations — especially those that already run Fortinet firewalls — which want remote access, endpoint protection and Zero Trust managed from one console. Small and medium businesses get enterprise-grade capability without necessarily buying the largest platforms, and the integration across Fortinet’s products is a genuine advantage for existing customers. For broader context on protecting a business network, see our overview of cyber security solutions, and for how endpoint anti-malware fits in, our explainer on what malware is.

It is not aimed at individuals who want to stream geo-blocked video, hide activity from an internet provider, or gain personal privacy — those needs are served by consumer VPNs instead.

Frequently Asked Questions (FAQ)

Is FortiClient VPN free?

Yes, Fortinet offers a free VPN-only client that provides basic IPsec and SSL VPN access. It has no central management and no Fortinet technical support. The full, managed FortiClient with antivirus, web filtering and ZTNA is a paid subscription licensed through resellers.

Does FortiClient VPN hide my browsing or let me watch geo-blocked streaming?

No. It is a business remote-access tool that connects you to your organisation’s own gateway, not a worldwide server network. It is not designed for anonymity or for unblocking streaming services, and your employer can see and log traffic that passes through the tunnel.

What operating systems does FortiClient support?

The current 7.4 generation supports Windows 10 and 11 and Windows Server, recent macOS versions, several Linux distributions, plus free iOS and Android apps. Older claims about Windows Phone support are out of date.

What is the difference between the free client and FortiClient EMS?

The free client only connects a single device to a VPN gateway. FortiClient EMS (Endpoint Management Server) is the paid system that deploys, configures and monitors the full agent — including security modules and ZTNA — across many endpoints from one console.

How much does the paid FortiClient cost?

Fortinet does not publish fixed list prices; it is sold per endpoint through partners, usually with a minimum of 25 endpoints and terms up to five years. Costs vary by edition, volume and whether EMS is self-hosted or cloud-based, so request a quote from a Fortinet reseller for an accurate figure.