Fortinet black logo

IPsec settings

IPsec settings

The following table provides the XML tags for IPsec settings, as well as the descriptions and default values where applicable.

XML tag Description Default value

<remote_networks> elements

<network>

Specifies a network address <addr> with subnet mask <mask>.

<addr>

Network IP address.

<mask>

Subnet mask to apply to network address <addr>.

<ipv4_split_exclude_networks>

Configure negative split tunnel or network exclusion for IPsec VPN using the <subnetwork> subelement. This feature supports FQDN, resolved from the client and expanded into a list of networks.

If negative split tunnel configuration is also received from FortiOS, FortiClient uses the settings from FortiOS and ignores the <ipv4_split_exclude_networks> settings. See Configure VPN remote gateway.

<dhgroup>

A list of possible DH protocol groups, separated by semicolons.

<key_life_type>

Phase 2 key re-key duration type. Select one of the following:

  • seconds
  • kbytes
  • both

<key_life_seconds>

Phase 2 key maximum life in seconds. 1800

<key_life_Kbytes>

Phase 2 key maximum life in KB. 5120

<replay_detection>

Detect an attempt to replay a previous VPN session.

<pfs>

Enable perfect forward secrecy (PFS).

Boolean value: [0 | 1]

<use_vip>

Use a virtual IP address.

Boolean value: [0 | 1]

<virtualip> elements

<type>

Enter the virtual IP address type: [modeconfig | dhcpoveripsec]

<ip>

Enter the IP address.

<mask>

Enter the Network mask.

<dnsserver>

Enter the DNS server IP address.

<dnsserver_secondary>

Enter the secondary DNS server IP address.

<winserver>

Enter the Windows server IP address.

<proposals> elements

<proposal>

Encryption and authentication types to use, separated by a pipe.

Example:

<proposal>3DES|MD5<proposal>

Multiple elements accepted.

First setting: Encryption type: DES, 3DES, AES128, AES192, AES256

Second setting: Authentication type: MD5, SHA1, SHA256, SHA384, SHA512

The on_connect and on_disconnect structure and scripting format are similar to those described in SSL VPN.

IPsec settings

The following table provides the XML tags for IPsec settings, as well as the descriptions and default values where applicable.

XML tag Description Default value

<remote_networks> elements

<network>

Specifies a network address <addr> with subnet mask <mask>.

<addr>

Network IP address.

<mask>

Subnet mask to apply to network address <addr>.

<ipv4_split_exclude_networks>

Configure negative split tunnel or network exclusion for IPsec VPN using the <subnetwork> subelement. This feature supports FQDN, resolved from the client and expanded into a list of networks.

If negative split tunnel configuration is also received from FortiOS, FortiClient uses the settings from FortiOS and ignores the <ipv4_split_exclude_networks> settings. See Configure VPN remote gateway.

<dhgroup>

A list of possible DH protocol groups, separated by semicolons.

<key_life_type>

Phase 2 key re-key duration type. Select one of the following:

  • seconds
  • kbytes
  • both

<key_life_seconds>

Phase 2 key maximum life in seconds. 1800

<key_life_Kbytes>

Phase 2 key maximum life in KB. 5120

<replay_detection>

Detect an attempt to replay a previous VPN session.

<pfs>

Enable perfect forward secrecy (PFS).

Boolean value: [0 | 1]

<use_vip>

Use a virtual IP address.

Boolean value: [0 | 1]

<virtualip> elements

<type>

Enter the virtual IP address type: [modeconfig | dhcpoveripsec]

<ip>

Enter the IP address.

<mask>

Enter the Network mask.

<dnsserver>

Enter the DNS server IP address.

<dnsserver_secondary>

Enter the secondary DNS server IP address.

<winserver>

Enter the Windows server IP address.

<proposals> elements

<proposal>

Encryption and authentication types to use, separated by a pipe.

Example:

<proposal>3DES|MD5<proposal>

Multiple elements accepted.

First setting: Encryption type: DES, 3DES, AES128, AES192, AES256

Second setting: Authentication type: MD5, SHA1, SHA256, SHA384, SHA512

The on_connect and on_disconnect structure and scripting format are similar to those described in SSL VPN.