Room3.05Floor 3 Network and firewall
Business VPN support in Toronto
Remote access and site-to-site VPNs for GTA offices. FortiGate, Cisco, Meraki and UniFi, set up and secured with one login per person and multi-factor sign-in.
- Remote access and site-to-site
- One login per person
- Multi-factor sign-in
- FortiGate, Cisco, Meraki, UniFi
The VPN your staff use to reach the office
We set up, fix and secure business VPNs for offices across Toronto, Mississauga, Vaughan and the rest of the GTA. That covers remote access for staff working from home or on the road, and site-to-site tunnels that join one office to another.
We work on Fortinet FortiGate, Cisco and Meraki, and Ubiquiti UniFi equipment, and we take over VPNs that someone else set up and nobody wrote down.
This is the kind of VPN that connects a laptop to your file server, accounting database or office PC. If you want a personal VPN to stream from another country or hide your location, that is a consumer subscription and not something we sell.
The VPN lives on your firewall, so it is part of the same job as the rest of the network. Our network and firewall support page covers the firewall, switches and Wi-Fi around it.
When the VPN will not connect, or connects and does nothing
Most VPN calls fall into two groups. Either the client will not connect at all, or it says Connected and the shared drive, printer or accounting program still will not open. The causes are different, so the first thing we ask is which one you are seeing.
It will not connect
- The firewall updated itself. A firmware upgrade can remove the VPN type your laptops use. FortiGate SSL VPN is the common case right now, covered below.
- A certificate expired. The VPN works for months, then every user gets the same security warning on the same morning.
- The sign-in changed. A new phone without the authenticator app, a password reset that never reached the VPN, or an account disabled when someone changed roles.
- The network in between blocks it. Hotel and airport Wi-Fi, some home routers and a few mobile hotspots block the ports older VPN types need.
- The licence count ran out. Some VPN clients are licensed per user, and the next person to connect is refused.
It connects, but nothing works
- Names do not resolve. The laptop reaches the office but cannot find the server by name, so mapped drives and shortcuts fail. This is a DNS setting on the VPN.
- Home and office use the same addresses. Many home routers and small offices both use 192.168.1.x. The laptop looks for the server on the home network and never finds it.
- Everything is slow. When all internet traffic, Teams calls included, goes through the office first, the office upload speed becomes the limit for everyone at home. Sending only office traffic through the VPN usually fixes it.
- Large files stall part way. Packets too big for the tunnel get dropped. A small change to the tunnel’s packet size settles it.
When you call the help desk, tell us the exact error, where you are connecting from and whether it worked yesterday. Those three answers usually point straight at one of the causes above.
FortiGate SSL VPN ends in FortiOS 7.6.3
If your staff connect to a FortiGate with FortiClient, check which kind of VPN it uses. Fortinet removed SSL VPN tunnel mode from every FortiGate model starting with FortiOS 7.6.3. The settings are not carried over in the upgrade, so a firewall that moves to 7.6.3 or later stops accepting those connections.
Recent FortiGate firmware also turns on automatic upgrades by default. A firewall can install a newer release overnight, and the first sign of trouble is a team at home who cannot reach the office.
The replacement is an IPsec VPN, which Fortinet lets you run over TCP port 443 so it still gets through most hotel and guest networks. We build the IPsec VPN beside the old one, keep your multi-factor sign-in, push the new FortiClient profile to staff laptops and test from outside the office. Only then do we upgrade the firmware and switch the old VPN off.
On entry models such as the 40F, 60F and 90G, the browser-based SSL VPN option is gone as well. Our Fortinet page covers renewals and replacements if your model is due.
PPTP, L2TP and the VPN types worth keeping
Plenty of small office VPNs still run on protocols that operating systems are dropping. They keep working until a phone update or a new laptop stops them, so it is better to move on your own schedule. This is where each common type stands.
| VPN type | Where you see it | Our advice |
|---|---|---|
| PPTP | Old Windows servers and older routers | Replace now. Its security has been broken for years. |
| L2TP/IPsec | Built into Windows and macOS, and older Meraki and UniFi setups | Plan the move. Android no longer creates new L2TP connections, and Microsoft has deprecated it on Windows Server. |
| FortiGate SSL VPN tunnel mode | FortiClient on FortiGate firewalls | Move to IPsec before upgrading to FortiOS 7.6.3. |
| IPsec with IKEv2 | FortiClient, Meraki MX and the Windows built-in client | The usual choice for a business VPN today. |
| WireGuard and UniFi Teleport | UniFi gateways | Fast and simple. UniFi recommends it over L2TP. |
| OpenVPN | UniFi gateways and some other firewalls | Still secure, slower than WireGuard. Fine where it already works. |
| Cisco Secure Client (formerly AnyConnect) | Cisco firewalls and Meraki MX | A solid choice, licensed per user. |
Microsoft has deprecated PPTP and L2TP for incoming connections on Windows Server and points customers to IKEv2 and SSTP. If your VPN still runs on an office server rather than the firewall, moving it to the firewall is usually the cleaner fix.
A VPN is a door into the office, so lock it properly
Attackers go after firewall VPNs because one working login gets them inside. In 2025, ransomware groups broke into businesses through SonicWall SSL VPN logins, in some cases on accounts with one-time-code MFA turned on. The same year, attacks on the VPN service of Cisco ASA firewalls led the US cybersecurity agency to order end-of-support ASA models unplugged from federal networks.
Neither is a reason to panic, and both point to the same habits. This is how we set up and look after remote access:
- One account per person, never a shared login, tied to your Microsoft 365 or server sign-in so disabling a leaver disables their VPN too
- Multi-factor sign-in on every VPN account, using an authenticator app rather than text messages wherever the firewall allows it
- No forgotten local accounts on the firewall, and passwords reset whenever a VPN moves to new hardware
- Sign-ins accepted only from the countries your staff work in, where the firewall supports it, with exceptions for travel
- Firewall firmware kept current, and appliances replaced before the manufacturer stops issuing fixes
- Each VPN group reaches only what it needs, so a contractor’s login cannot browse the whole network
- Sign-in logging turned on, so a burst of failed attempts or a login from an odd place can be traced
For the wider picture, including endpoint protection and email filtering, see our cybersecurity services.
Site-to-site VPN between offices, warehouses and partners
A site-to-site VPN is a permanent tunnel between two firewalls. Nobody has to start it. Staff at the branch reach the main office server as if it were down the hall. We set these up between your own locations and, when a vendor or parent company needs one, to their network too.
Between two firewalls of the same brand, the vendor’s own tools do most of the work: Meraki Auto VPN, UniFi Site Magic or FortiGate’s IPsec wizard. Mixed brands need matching encryption settings entered by hand at both ends, and that is where most tunnel problems start.
Site-to-site problems we fix
- The tunnel shows as up, but no traffic passes because a route or firewall rule is missing on one side
- The tunnel drops whenever the internet provider changes the office’s public address
- One end was upgraded or replaced, and its settings no longer match the other
- Both offices use the same internal addresses, so traffic has nowhere to go
- The link is slow because it can only run as fast as the slower upload at either end
Opening a new location? Our network page covers the full setup of a second office, from the firewall to the Wi-Fi.
Do your staff still need a VPN?
Only for what still lives at the office. Microsoft 365, web-based accounting and most cloud business apps work from anywhere without one. A VPN is still the right tool for a file server, a desktop accounting database such as Sage 50 or QuickBooks Desktop, an on-site application server, a printer, or remote desktop to an office PC.
Moving shared files to SharePoint and OneDrive often removes most VPN use, and most VPN calls with it. Our Microsoft 365 page covers that move. What is left can stay on a smaller, tighter VPN for the few people who need it.
Newer remote access products check the device as well as the person before letting anyone in. For most offices of 5 to 50 people, a well-run VPN with multi-factor sign-in is still the practical choice. If yours has outgrown it, we will say so and quote the change before any work starts.
VPN work in the managed plan, and fixed-price projects
On the managed IT plan, VPN problems are help desk calls like any other, and adding or removing a VPN user is a routine request. Outside a plan, VPN fixes are billed hourly. Bigger changes are quoted at a fixed price before work starts, with any hardware and licences listed separately.
- FortiGate SSL VPN to IPsec move before FortiOS 7.6.3Fixed quote
- VPN clean-up with one login per person and multi-factor sign-inFixed quote
- Replace a PPTP or L2TP VPN with IKEv2 or WireGuardFixed quote
- Site-to-site VPN to a second office or a partnerFixed quote
- VPN rebuild on a new or replacement firewallFixed quote
- Cisco Secure Client rollout on Cisco or MerakiFixed quote
Questions people ask
Do you sell personal VPN subscriptions?
No. We set up and support the VPN a business uses to connect its staff to its own office network. If you want a VPN to change your location for streaming or private browsing, a consumer VPN service is the right product.
Our VPN connects but the shared drive will not open. Why?
Usually the laptop cannot find the server by name, or the home network uses the same addresses as the office. Both are settings on the VPN rather than a fault on the laptop. Call the help desk with the drive or server name that fails and we can check it remotely.
FortiClient stopped connecting after a firewall update. What happened?
Your FortiGate has most likely moved to FortiOS 7.6.3 or later, which no longer includes SSL VPN tunnel mode. The fix is an IPsec VPN with a new FortiClient profile. If staff are locked out right now, call the 24/7 emergency line and we will work on getting them back in first, then plan the permanent change.
Is L2TP still safe to use?
L2TP with IPsec is not broken the way PPTP is, but it is on its way out. Android no longer creates new L2TP connections, and Microsoft has deprecated it on Windows Server. We move offices to IKEv2, WireGuard or the firewall maker's own client the next time the VPN needs work.
Does the monthly plan cover VPN problems?
Yes. Help desk calls about VPN trouble are included, and so are small requests such as adding or removing a VPN user. Moving to a new VPN type, a new firewall or a new site-to-site link is quoted as a fixed project.
How do you remove a former employee's VPN access?
Call the help desk, Monday to Friday from 8 a.m. to 6 p.m. When the VPN is tied to Microsoft 365 or your server sign-in, disabling their account blocks the VPN as well. We also check the firewall for any separate login they had and remove it.
Tell us what’s going on
Pick how urgent it is and leave a way to reach you. The help desk replies by phone or email. If work has stopped, call 647-812-3775 instead.
Something broken, or something to plan?
For anything urgent, call. A technician answers the emergency line 24/7. For everything else, open a ticket and tell us what is going on.