Since you have a Fortigate you can use FortiClient VPN for free. The free version is unsupported and only offers the basic features to get connected … but it does work and if you only have 20 users it shouldn’t be much of a headache to support. It’s certainly no AnyConnect though. Make sure you’re specifically downloading the “FortiClient VPN” clients and not the full blown “FortiClient” which isn’t what you want. They are different downloads.
We use L2TP with IPsec on our Mikroitks. It’s simple and just works.
Actually, we have 80 something remote sites that all L2TP back to our core and then distribute the management vlans via OSPF. Only have a handful of actual “road-warriors” (me being one) who use L2TP from their desktops to gain access to the core when out and about.
You shouldn’t need 40 licenses anymore though. Now it’s only connections in use (and I believe redundant is free.) So you could get by with 20 licenses if that’s the Max that will connect at once.
If you have Fortigate you have unlimited licences on the Fortigate which can also be integrated with LDAP for even easier management. Even better option is to configure OpenVPN on the Mikrotik since the users are accustomed to using OpenVPN. Both options totally free and works like a charm. Absolutely NO NEED for extra spending, just a little bit configuration and you are there.
Twingate might be a good solution for you. Doesn’t require any changes to your existing network hardware and can integrate with IdPs for user management.
Perimeter 81 is also out there, but slightly more difficult to use.
Plus if you acquire the firewall through a Barracuda MSP partner, it can be had as an ongoing monthly OpEx cost rather than up-front CapEx, which eliminates sticker shock for those not used to how expensive network/firewall/security kit can be.