IPsec settings
The following table provides the XML tags for IPsec settings, as well as the descriptions and default values where applicable.
| XML tag | Description | Default value |
|---|---|---|
|
|
||
|
<network> |
Specifies a network address <addr> with subnet mask <mask>. |
|
|
<addr> |
Network IP address. |
|
|
<mask> |
Subnet mask to apply to network address <addr>. |
|
|
<ipv4_split_exclude_networks> |
Configure negative split tunnel or network exclusion for IPsec VPN using the If negative split tunnel configuration is also received from FortiOS, FortiClient uses the settings from FortiOS and ignores the |
|
|
<dhgroup> |
A list of possible DH protocol groups, separated by semicolons. |
|
|
<key_life_type> |
Phase 2 key re-key duration type. Select one of the following:
|
|
|
<key_life_seconds> |
Phase 2 key maximum life in seconds. | 1800
|
|
<key_life_Kbytes> |
Phase 2 key maximum life in KB. | 5120
|
|
<replay_detection> |
Detect an attempt to replay a previous VPN session. |
|
|
<pfs> |
Enable perfect forward secrecy (PFS). Boolean value: |
|
|
<use_vip> |
Use a virtual IP address. Boolean value: |
|
|
|
||
|
<type> |
Enter the virtual IP address type: |
|
|
<ip> |
Enter the IP address. |
|
|
<mask> |
Enter the Network mask. |
|
|
<dnsserver> |
Enter the DNS server IP address. |
|
|
<dnsserver_secondary> |
Enter the secondary DNS server IP address. |
|
|
<winserver> |
Enter the Windows server IP address. |
|
|
|
||
|
<proposal> |
Encryption and authentication types to use, separated by a pipe. Example: <proposal>3DES|MD5<proposal> Multiple elements accepted.First setting: Encryption type: DES, 3DES, AES128, AES192, AES256 Second setting: Authentication type: MD5, SHA1, SHA256, SHA384, SHA512 |
|
The on_connect and on_disconnect structure and scripting format are similar to those described in SSL VPN.