Fortinet black logo

Version:

7.2.1
7.2.0
7.0.9

Version:

7.0.8
7.0.7
7.0.6

Version:

7.0.5
7.0.4
7.0.3

Version:

7.0.2
7.0.1
7.0.0

Version:

6.4.10
6.4.9
6.4.8

Version:

6.4.7
6.4.6
6.4.5

Version:

6.4.4
6.4.3
6.4.2

Version:

6.4.1
6.4.0
6.2.9

Version:

6.2.8
6.2.7
6.2.6

Version:

6.2.5
6.2.4
6.2.3

Version:

6.2.2
6.2.1
6.2.0

Version:

6.0.10
6.0.9
6.0.8

Version:

6.0.7
6.0.6
6.0.5

Version:

6.0.4
6.0.3
6.0.2

Version:

6.0.1
6.0.0

Table of Contents

XML Reference Guide

6.0.7
7.2.1
7.2.0
7.0.9
7.0.8
7.0.7
7.0.6
7.0.5
7.0.4
7.0.3
7.0.2
7.0.1
7.0.0
6.4.10
6.4.9
6.4.8
6.4.7
6.4.6
6.4.5
6.4.4
6.4.3
6.4.2
6.4.1
6.4.0
6.2.9
6.2.8
6.2.7
6.2.6
6.2.5
6.2.4
6.2.3
6.2.2
6.2.1
6.2.0
6.0.10
6.0.9
6.0.8
6.0.7
6.0.6
6.0.5
6.0.4
6.0.3
6.0.2
6.0.1
6.0.0
Download PDF
Copy Doc ID ff39e5e8-92bc-11e9-81a4-00505692583a:358032
Copy Link

IPsec settings

The following table provides the XML tags for IPsec settings, as well as the descriptions and default values where applicable.

XML tag Description Default value

<remote_networks> elements

<network>

 Specifies a network address <addr> with subnet mask <mask>.

<addr>

 Network IP address.

<mask>

 Subnet mask to apply to network address <addr>.

<dhgroup>

 A list of possible Diffie-Hellman (DH) protocol groups, separated by semicolons.

<key_life_type>

Phase 2 key re-key duration type. Select one of the following:

  • seconds
  • kbytes
  • both

<key_life_seconds>

 Phase 2 key maximum life in seconds. 1800

<key_life_Kbytes>

 Phase 2 key maximum life in KB. 5120

<replay_detection>

 Detect an attempt to replay a previous VPN session.

<pfs>

Enable or disable Perfect Forward Secrecy (PFS).

Boolean value: [0 | 1]

<use_vip>

Use virtual IP.

Boolean value: [0 | 1]

<virtualip> elements

<type>

Enter the virtual IP address type.

[modeconfig | dhcpoveripsec]

<ip>

 IP address.

<mask>

 Network mask.

<dnsserver>

 DNS server IP address.

<dnsserver_secondary>

 The secondary DNS server IP address.

<winserver>

 Microsoft Windows server IP address.

<proposals> elements

<proposal>

Encryption and authentication types to use, separated by a pipe.

Example:

<proposal>3DES|MD5<proposal>

Multiple elements accepted.

First setting: Encryption type: DES, 3DES, AES128, AES192, AES256

Second setting: Authentication type: MD5, SHA1, SHA256, SHA384, SHA512

The on_connect and on_disconnect structure and scripting format are similar to that described in the section titled: SSL VPN earlier.

Previous
Next

IPsec settings

The following table provides the XML tags for IPsec settings, as well as the descriptions and default values where applicable.

XML tag Description Default value

<remote_networks> elements

<network>

 Specifies a network address <addr> with subnet mask <mask>.

<addr>

 Network IP address.

<mask>

 Subnet mask to apply to network address <addr>.

<dhgroup>

 A list of possible Diffie-Hellman (DH) protocol groups, separated by semicolons.

<key_life_type>

Phase 2 key re-key duration type. Select one of the following:

  • seconds
  • kbytes
  • both

<key_life_seconds>

 Phase 2 key maximum life in seconds. 1800

<key_life_Kbytes>

 Phase 2 key maximum life in KB. 5120

<replay_detection>

 Detect an attempt to replay a previous VPN session.

<pfs>

Enable or disable Perfect Forward Secrecy (PFS).

Boolean value: [0 | 1]

<use_vip>

Use virtual IP.

Boolean value: [0 | 1]

<virtualip> elements

<type>

Enter the virtual IP address type.

[modeconfig | dhcpoveripsec]

<ip>

 IP address.

<mask>

 Network mask.

<dnsserver>

 DNS server IP address.

<dnsserver_secondary>

 The secondary DNS server IP address.

<winserver>

 Microsoft Windows server IP address.

<proposals> elements

<proposal>

Encryption and authentication types to use, separated by a pipe.

Example:

<proposal>3DES|MD5<proposal>

Multiple elements accepted.

First setting: Encryption type: DES, 3DES, AES128, AES192, AES256

Second setting: Authentication type: MD5, SHA1, SHA256, SHA384, SHA512

The on_connect and on_disconnect structure and scripting format are similar to that described in the section titled: SSL VPN earlier.

Previous
Next