SSL VPN
SSL VPN configurations consist of one <options> section, followed by one or more VPN <connection> section.
<forticlient_configuration>
<vpn>
<sslvpn>
<options>
<enabled>1</enabled>
<dnscache_service_control>0</dnscache_service_control>
<!-- 0=disable dnscache, 1=do not tounch dnscache service, 2=restart dnscache service, 3=sc control dnscache paramchange -->
<prefer_sslvpn_dns>1</prefer_sslvpn_dns>
<use_legacy_ssl_adapter>1</use_legacy_ssl_adapter>
<preferred_dtls_tunnel>1</preferred_dtls_tunnel>
<no_dhcp_server_route>0</no_dhcp_server_route>
<no_dns_registration>0</no_dns_registration>
<disallow_invalid_server_certificate>0</disallow_invalid_server_certificate>
<keep_connection_alive>1</keep_connection_alive>
</options>
<connections>
<connection>
<name>SSLVPN_Name</name>
<description>Optional_Description</description>
<server>ssldemo.fortinet.com:10443</server>
<username>Encrypted/NonEncrypted_UsernameString</username>
<single_user_mode>0</single_user_mode>
<ui>
<show_remember_password>1</show_remember_password>
<show_alwaysup>1</show_alwaysup>
<show_autoconnect>1</show_autoconnect>
<save_username>0</save_username>
</ui>
<password>Encrypted/NonEncrypted_PasswordString</password>
<certificate />
<warn_invalid_server_certificate>1</warn_invalid_server_certificate>
<allow_standard_user_use_system_cert>0</allow_standard_user_use_system_cert>
<prompt_certificate>0</prompt_certificate>
<prompt_username>0</prompt_username>
<fgt>1</fgt>
<on_connect>
<script>
<os>windows</os>
<script>
<![CDATA[test]]>
</script>
</script>
</on_connect>
<on_disconnect>
<script>
<os>windows</os>
<script>
<![CDATA]]>
</script>
</script>
</on_disconnect>
</connection>
</connections>
</sslvpn>
</vpn>
</forticlient_configuration>
The following table provides the XML tags for SSL VPN, as well as the descriptions and default values where applicable.
|
XML Tag |
Description |
Default Value |
|---|---|---|
|
|
||
|
<enabled> |
Enable or disable SSL VPN. Boolean value: |
1 |
|
<dnscache_service_control> |
FortiClient disables Windows OS DNS cache when an SSL VPN tunnel is established. The DNS cache is restored after SSL VPN tunnel is disconnected. If it is observed that FSSO clients do not function correctly when an SSL VPN tunnel is up, use the following XML configuration to control DNS cache |
0 |
|
<prefer_sslvpn_dns> |
When this setting is Boolean value: |
0 |
|
<use_legacy_ssl_adapter> |
When this setting is Boolean value: |
1 |
|
<preferred_dtls_tunnel> |
When this setting is When this setting is Boolean value: |
|
|
<no_dhcp_server_route> |
When this setting is When this setting is Boolean value: |
0 |
|
<no_dns_registration> |
When this setting is When this setting is Boolean value: |
0 |
|
<disallow_invalid_server_certificate> |
When this setting is When this setting is Boolean value: |
0 |
|
<keep_connection_alive> |
Retry restoring connection of an active VPN session. Boolean value: |
|
The <connections> XML tag may contain one or more <connection> elements. Each <connection> has the following:
- Information used to establish an SSL VPN connection
- on_connect: a script to run right after a successful connection
- on_disconnect: a script to run just after a disconnection
The following table provides VPN connection XML tags, the description, and the default value (where applicable).
|
The VPN connection name is mandatory. If a connection of this type and this name exists, its values are overwritten with the new ones. |
The <on_connect> and <on_disconnect> tags both have very similar tag structure:
<on_connect>
<script>
<os>windows</os>
<script>
<script>
<![CDATA[
]]>
</script>
</script>
</script>
</on_connect>
<on_disconnect>
<script>
<os>windows</os>
<script>
<script>
<![CDATA[
]]>
</script>
</script>
</script>
</on_disconnect>
The following table provides CDATA XML tags, the description, and the default value (where applicable).
|
XML Tag |
Description |
Default Value |
|---|---|---|
|
<os> |
The OS for which the script is written. Select either: |
|
|
<script> |
The MS DOS batch or macOS shell script to run. |
|
|
<![CDATA[ ]]> |
Wraps the scripts in CDATA elements. |
|
|
Write the MS DOS batch or macOS shell script inside the CDATA tag. Write one line per command like a regular batch script file. The script is executed in the context of the user that connected the tunnel. Wherever you write Wherever you write Remember to check your XML file before deploying to ensure that carriage returns/line feeds are present. |
||
The example scripts above show a script that mounts several network drives after an SSL connection is established. The drives are unmounted with the corresponding scripts in the <on_disconnect> XML tag.
The <on_connect> and <on_disconnect> scripts are optional.