SSL VPN
SSL VPN configurations consist of one <options> section, followed by one or more VPN <connection> sections:
<forticlient_configuration>
<vpn>
<sslvpn>
<options>
<enabled>1</enabled>
<dnscache_service_control>0</dnscache_service_control>
<!-- 0=disable dnscache, 1=do not tounch dnscache service, 2=restart dnscache service, 3=sc control dnscache paramchange -->
<prefer_sslvpn_dns>1</prefer_sslvpn_dns>
<use_gui_saml_auth>0</use_gui_saml_auth>
<use_legacy_ssl_adapter>1</use_legacy_ssl_adapter>
<preferred_dtls_tunnel>1</preferred_dtls_tunnel>
<block_ipv6>0</block_ipv6>
<no_dhcp_server_route>0</no_dhcp_server_route>
<no_dns_registration>0</no_dns_registration>
<disallow_invalid_server_certificate>0</disallow_invalid_server_certificate>
<keep_connection_alive>1</keep_connection_alive>
<show_auth_cert_only>1</show_auth_cert_only>
<negative_split_tunnel_metric>10</negative_split_tunnel_metric>
<enforce_disabling_smartdns_for_splitdns>0</enforce_disabling_smartdns_for_splitdns>
<dtls_mtu>1100</dtls_mtu>
<mtu_size>1300</mtu_size>
</options>
<connections>
<connection>
<name>SSLVPN_Name</name>
<description>Optional_Description</description>
<no_vnic_dns_server>0</no_vnic_dns_server>
<server>ssldemo.fortinet.com:10443</server>
<username>Encrypted/NonEncrypted_UsernameString</username>
<single_user_mode>0</single_user_mode>
<disclaimer_msg></disclaimer_msg>
<redundant_sort_method>0</redundant_sort_method>
<sso_enabled>1</sso_enabled>
<keep_fqdn_resolution_consistency>1</keep_fqdn_resolution_consistency>
<use_external_browser>1</use_external_browser>
<warn_invalid_server_certificate>1</warn_invalid_server_certificate>
<machine>1</machine>
<dual_stack>0</dual_stack>
<keep_running>0</keep_running>
<resolve_to_ipv4_only>1</resolve_to_ipv4_only>
<pkcs11_lib>/usr/lib/sample.so</pkcs11_lib>
<traffic_keep_strategy>1</traffic_keep_strategy>
<ssl_vpn_method>1</ssl_vpn_method>
<fido_auth>1</fido_auth>
<ui>
<show_remember_password>1</show_remember_password>
<show_alwaysup>1</show_alwaysup>
<show_autoconnect>1</show_autoconnect>
<save_username>0</save_username>
<save_password>0</save_password>
</ui>
<password>Encrypted/NonEncrypted_PasswordString</password>
<allow_standard_user_use_system_cert>0</allow_standard_user_use_system_cert>
<prompt_certificate>0</prompt_certificate>
<prompt_username>0</prompt_username>
<fgt>1</fgt>
<certificate/>
<on_connect>
<script>
<os>windows</os>
<script>
<![CDATA[test]]>
</script>
</script>
</on_connect>
<on_disconnect>
<script>
<os>windows</os>
<script>
<![CDATA]]>
</script>
</script>
</on_disconnect>
<traffic_control>
<enabled>1</enabled>
<mode>2</mode>
<enable_local_lan>1</enable_local_lan>
<apps>
<app>%LOCALAPPDATA%\Microsoft\Teams\Current\Teams.exe</app>
<app>%appdata%\Zoom\bin\Zoom.exe</app>
<app>C:\Program Files (x86)\Microsoft\Skype for Desktop\skype.exe</app>
<app>%LOCALAPPDATA%\GoToMeeting\18068\g2mcomm.exe</app>
<app>%LOCALAPPDATA%\GoToMeeting\18068\g2mlauncher.exe</app>
<app>%LOCALAPPDATA%\GoToMeeting\18068\g2mstart.exe</app>
</apps>
<fqdns>
<fqdn>webex.com</fqdn>
<fqdn>gotomeeting.com</fqdn>
<fqdn>youtube.com</fqdn>
</fqdns>
</traffic_control>
<tags>
<allowed>NoVuln</allowed>
<prohibited>CriticalVuln</prohibited>
</tags>
<azure_auto_login>
<enabled></enabled>
<azure_app>
<tenant_name></tenant_name>
<client_id></client_id>
</azure_app>
</azure_auto_login>
<vpn_before_logon>
<username_format>username</username_format>
<vpn_before_logon/>
<KeepTunnelAliveWithoutGui>0</KeepTunnelAliveWithoutGui>
</connection>
</connections>
</sslvpn>
</vpn>
</forticlient_configuration>
The following table provides the SSL VPN XML tags, as well as the descriptions and default values where applicable:
The <connections> XML tag may contain one or more <connection> elements. Each <connection> has the following:
- Information used to establish an SSL VPN connection
- on_connect: a script to run right after a successful connection
- on_disconnect: a script to run just after a disconnection
The following table provides VPN connection XML tags, the description, and the default value (where applicable).
|
XML tag |
Description |
Default value |
|---|---|---|
|
<name> |
VPN connection name. |
|
|
<description> |
Optional description to identify the VPN connection. |
|
|
<no_vnic_dns_server> |
If enabled, FortiClient does not send DNS requests to the SSL VPN virtual adapter and only to the local adapters. If disabled, FortiClient may send DNS requests to both the SSL VPN virtual and local adapters depending on other DNS configuration settings. Boolean value: |
0 |
|
<server> |
SSL server IP address or FQDN, along with the port number as applicable. |
Default port number: 443 |
|
<username> |
Encrypted or non-encrypted username on SSL server. |
|
|
<single_user_mode> |
Enable single user mode. If enabled, new and existing VPN connections cannot be established or are disconnected if more than one user is logged on the computer. Boolean value: |
0 |
|
<disclaimer_msg> |
Enter a disclaimer message that appears when the user attempts VPN connection. The user must accept the message to allow connection. |
|
|
<redundant_sort_method> |
How FortiClient determines the order in which to try connection to the SSL VPN servers when more than one is defined. FortiClient calculates the order before each SSL VPN connection attempt.
|
0 |
|
<sso_enabled> |
Enable SAML SSO for the VPN tunnel. For this feature to function, the administrator must have configured the necessary options on the Service Provider and Identity Provider. See SAML support for SSL VPN. |
|
|
<keep_fqdn_resolution_consistency> |
Enable FortiClient to remember the IP address with which it contacts the FortiGate and reuse it throughout the connection phase. This feature helps support load balancing SSL VPN gateways with one FQDN. This feature is only available for FortiClient (Windows). See Load balancing SSL VPN gateways with one FQDN. |
|
|
<use_external_browser> |
Display the SAML authentication prompt in an external browser instead of in the FortiClient GUI. See Using a browser as an external user-agent for SAML authentication in an SSL VPN connection. |
|
|
<warn_invalid_server_certificate> |
Display a warning message if the server certificate is invalid. EMS automatically copies this setting to each SSL VPN tunnel. Boolean value: |
0 |
|
<machine> |
When this setting is 1, FortiClient can connect to the tunnel without user interaction. See Boolean value: |
|
|
<dual_stack> |
Enable or disable FortiClient to establish a dual stack SSL VPN tunnel to allow both IPv4 and IPv6 traffic to pass through. See Dual stack IPv4 and IPv6 support for SSL VPN. The following summarizes what occurs when dual stack settings differ between FortiClient and FortiOS:
In summary, for dual stack to function, you must enable the respective Only FortiClient (Windows) supports this feature. Boolean value: |
|
|
<keep_running> |
Ensures that the VPN tunnel remains connected if it is already connected. This is useful when there is a temporary network disconnection that causes the tunnel to drop the connection. An EMS-pushed tunnel with Boolean value: |
0 |
|
<resolve_to_ipv4_only> |
If an FQDN is used for the VPN gateway that can be resolved to IPv4 and IPv6, but only IPv4 functions, FortiClient resolves the FQDN via the IPv4 address. Boolean value: |
|
|
<pkcs11_lib> |
Enter the name or path of a shared library on a Linux machine where FortiClient can find a smart card certificate to authenticate the connection. For example, you could enter |
|
|
<traffic_keep_strategy> |
Enable to run Boolean value: |
|
|
<ssl_vpn_method> |
This option only applies for FortiClient (macOS). Enable to use alternative OpenSSL code, which can be used when using DTLS fallback to TLS. Otherwise, FortiClient uses the default existing SSL VPN logic. Boolean value: |
0 |
|
<fido_auth> |
Enable to allow Yubikey (FIDO2) authentication for the FortiClient embedded browser for macOS. Boolean value: |
|
|
<password> |
Given user's encrypted or non-encrypted password. |
|
|
<allow_standard_user_use_system_cert> |
When you enable this setting, non-administrators can use local machine certificates to connect SSL VPN. When you disable this setting, non-administrators cannot use machine certificates to connect SSL VPN. Boolean value: |
0 |
|
<prompt_certificate> |
Request a certificate during connection establishment. Boolean value: |
0 |
|
<prompt_username> |
Request a username during connection establishment. Boolean value: |
1 |
|
<fgt> |
Indicates whether FortiClient received a VPN configuration from FortiGate or EMS. When this setting is When this setting is Boolean value: |
|
|
The XML sample provided only shows XML configuration when using a username and password. See Sample XML using certificate authentication for example of XML configuration for certificate authentication. |
||
|
Elements for common name of the certificate for VPN logon. |
||
|
<match_type> |
Enter the type of matching to use:
|
|
|
<pattern> |
Enter the pattern to use for the type of matching. |
|
|
Elements about the issuer of the certificate for VPN logon. |
||
|
<match_type> |
Enter the type of matching to use:
|
|
|
<pattern> |
Enter the pattern to use for the type of matching. |
|
|
Elements about the certificate object identifier (OID). This feature filters based on all certificate OIDs at the first level of the X.509 ASN.1 structure. Nested, or second level OIDs are not supported, other than the EKU (extendedKeyUsage) OIDs. |
||
|
<match_type> |
Enter the type of matching to use. Choose from:
|
|
|
<pattern> |
Enter the pattern to use for the type of matching. |
|
|
The FortiGate sets the elements of the |
||
|
<show_remember_password> |
Display the Save Password checkbox in the console. Boolean value: |
|
|
<show_alwaysup> |
Display the Always Up checkbox in the console. Boolean value: |
|
|
<show_autoconnect> |
Display the Auto Connect checkbox in the console. Boolean value: |
|
|
<save_username> |
Save and display the last username used for VPN connection. Boolean value: |
|
|
<save_password> |
When enabled, Save Password is enabled for the VPN tunnel in the FortiClient GUI. An EMS-pushed tunnel with Boolean value: |
0 |
|
|
||
|
<enabled> |
To enable the feature, enter Boolean value: |
|
|
<mode> |
Enter |
|
|
<app> |
Specify which application traffic to exclude from the VPN tunnel and redirect to the endpoint physical interface. You can specify an application using its process name, full path, or the directory where it is installed. You can enter file and directory paths using environment variables, such as %LOCALAPPDATA%,%programfiles%, and %appdata%. Do not use spaces in the tail or head, or add double quotes to full paths with spaces. To find a running application's full path, on the Details tab in Task Manager, add the Image path name column. Once the VPN tunnel is up, FortiClient binds the specified applications to the physical interface. In the example, for the GoToMeeting path, 18068 refers to the current installed version of the GoToMeeting application. |
|
|
<enable_local_lan> |
Enable access to local resources while an application-based split tunnel with an exclusion rule configured is up. If this option is disabled, access to local resources may be denied when an application-based split tunnel with an exclusion rule configured is up. Boolean value: |
1 |
|
<fqdn> |
Specify which FQDN traffic to exclude from the VPN tunnel and redirect to the endpoint physical interface. The FQDN resolved IP address is dynamically added to the route table when in use, and is removed after disconnection. In the example, youtube.com equals youtube.com and *.youtube.com. After defining an FQDN, such as youtube.com in the example, if you use any popular browser such as Chrome, Edge, or Firefox to access youtube.com, this traffic does not go through the VPN tunnel. |
|
|
|
|
|
|
<allowed> |
Enter the desired Zero Trust tags. If EMS has tagged this endpoint with any of the entered tags, FortiClient allows the endpoint to connect to the VPN tunnel. |
|
|
<prohibited> |
Enter the desired Zero Trust tags. If EMS has tagged this endpoint with any of the entered tags, FortiClient denies the endpoint from connecting to the VPN tunnel. |
|
|
|
||
|
<enabled> |
Enable Azure auto login. When the user logs in to the endpoint using an Azure Active Directory (AD) account, FortiClient silently automatically connects to the VPN tunnel configured in See the EMS Administration Guide for details on configuring this feature. Boolean value: |
|
|
|
||
|
<tenant_name> |
Enter the Azure domain name as obtained from the Azure portal. |
|
|
<client_id> |
Enter the FortiClient application ID as obtained from the Azure portal. |
|
|
<vpn_before_logon><username_format> |
Configure the required username format for the VPN before logon connection to successfully authenticate. This configuration takes effect if the user selects their username from the left panel when logging into Windows instead of typing in their name. Configure one of the following:
|
username |
|
<KeepTunnelAliveWithoutGui> |
This setting is particularly useful in a SASE environment where the corporate policy requires all user traffic to be steered into the SASE cloud for inspection and enforcement. Since a non-admin user may have permission to end the |
0 |
|
The VPN connection name is mandatory. If a connection of this type and this name exists, FortiClient overwrites its values with the new ones. |
Sample XML using certificate authentication
<sslvpn>
...
<connections>
<connection>
...
<certificate>
<common_name>
<match_type>
<![CDATA[wildcard]]>
</match_type>
<pattern>
<![CDATA[*]]>
</pattern>
</common_name>
<issuer>
<match_type>
<![CDATA[simple]]>
</match_type>
<pattern>
<![CDATA[Certificate Authority]]>
</pattern>
</issuer>
<oids>
<oid>
<match_type>simple</match_type>
<pattern>
<![CDATA[1.3.6.1.5.5.7.3.1]]>
</pattern>
</oid>
</oids>
...
</certificate>
</connection>
</connections>
...
<sslvpn>
This is a balanced but incomplete XML configuration fragment. It includes all closing tags, but omits some important elements to complete the configuration.
See the first XML sample in this topic for a more complete XML configuration example using a username and password for authentication.
The <on_connect> and <on_disconnect> tags have similar tag structure:
<on_connect>
<script>
<os>windows</os>
<script>
<script>
<![CDATA[
]]>
</script>
</script>
</script>
</on_connect>
<on_disconnect>
<script>
<os>windows</os>
<script>
<script>
<![CDATA[
]]>
</script>
</script>
</script>
</on_disconnect>
The following table provides <on_connect> and <on_disconnect> XML tags, the description, and the default value (where applicable):
|
XML tag |
Description |
Default value |
|---|---|---|
|
<os> |
OS for which the script is written. Enter one of the following: |
|
|
<script> |
MS DOS batch or macOS shell script to run. |
|
|
<![CDATA[ ]]> |
Wraps the scripts in CDATA elements. |
|
|
Write the MS DOS batch or macOS shell script inside the CDATA tag. Write one line per command like a regular batch script file. The script is executed in the context of the user that connected the tunnel. Wherever you write Wherever you write Remember to check your XML file before deploying to ensure that carriage returns/line feeds are present. |
||
The example scripts above show a script that mounts several network drives after an SSL connection is established. The drives are unmounted with the corresponding scripts in the <on_disconnect> XML tag.
The <on_connect> and <on_disconnect> scripts are optional.