Enable SSL VPN.

FortiClient disables Windows DNS cache when it establishes an SSL VPN tunnel. The DNS cache is restored after FortiClient disconnects from the SSL VPN tunnel. If you observe that Fortinet single sign on clients do not function correctly when an SSL VPN tunnel is up, use Prefer SSL VPN DNS to control the DNS cache.

When disabled, EMS does not add the custom DNS server from SSL VPN to the physical interface. When enabled, EMS prepends the custom DNS server from SSL VPN to the physical interface.

FortiClient does not complete the requested VPN connection when an invalid VPN server certificate is used.

FortiClient displays a warning to the user when an invalid SSL VPN certificate is used.

Configure one of the following:

• FortiClient registers the VPN adapter's address in the Active Directory (AD) DNS server.
• FortiClient does not register the VPN adapter's address in the AD DNS server.
• FortiClient registers only its own tunnel interface IP address in the AD DNS server.

DTLS tunnel uses UDP instead of TCP and can increase throughput over VPN. Only FortiClient (Windows) supports DTLS.

• When enabled, FortiClient uses DTLS if it is enabled on the FortiGate and tunnel establishment succeeds. If dtls-tunnel is disabled on the FortiGate, or tunnel establishment does not succeed, FortiClient uses TLS.

• When disabled, FortiClient uses TLS, even if dtls-tunnel is enabled on the FortiGate.

Set route metric for certain subnet as needed.

For example, you may want to set negative split routes with a higher metric, so these routes can be deactivated when another VPN product is being used and sets the same routes as FortiClient negatives split routes but with a lower metric.

This configuration is not recommended for most use cases. This element only takes effect when you enable negative split tunnel.

Suppress dialogs from displaying certificates that do not bear OID "1.3.6.1.5.5.7.3.2" (client authentication).

Enter a VPN name. Use only standard alphanumeric characters. Do not use symbols or accented characters.

Select SSL VPN.

Enter the remote gateway IP address/hostname. You can configure multiple remote gateways by clicking the + button. If one gateway is not available, the tunnel connects to the next configured gateway.

Enter the access port. The default port is 443.

Enter the name or path of a shared library on a Linux machine where FortiClient can find a smart card certificate to authenticate the connection. For example, you could enter /usr/lib/sample.so.

Require a certificate.

Configure a certificate location for FortiClient (Android) to automatically go to when doing the following:

• When selecting a certificate
• When the user clicks Connect to connect to this tunnel

See Certificate path configuration for automated certificate selection.

Prompt for the username when accessing VPN.

When a tunnel is pinned, the end user cannot manually unpin it from the FortiClient GUI. All pinned tunnels display in the Remote Access tab in FortiClient. In the VPN Tunnels list on the Remote Access profile, pinned tunnels display with a thumbtack icon.

The EMS administrator can pin a maximum of three tunnels per profile. The end user may pin an additional tunnel in FortiClient. FortiClient therefore supports pinning a maximum of four tunnels.

Enable to allow the VPN tunnel to remain connected if it is already connected. This is useful when there is a temporary network disconnection that causes the tunnel to drop the connection.

An EMS-pushed tunnel with Persistent Connection enabled displays with Save Password and Always Up enabled and grayed out in the FortiClient GUI.

Enable application-based split tunnel. FortiClient (Windows) supports source application-based split tunnel, where you can specify which application traffic to exclude from or include in the VPN tunnel. You can exclude high bandwidth-consuming applications for improved performance. For example, you can exclude applications like the following from the VPN tunnel:

• Microsoft Office 365
• Microsoft Teams
• Skype
• GoToMeeting
• Zoom
• WebEx
• YouTube

Once the VPN tunnel is up, FortiClient binds the specified excluded applications to the physical interface.

Select Include or Exclude to configure whether to include or exclude certain application traffic from the VPN tunnel.

You can only exclude local applications from the VPN tunnel. Click Add. In the Add Application(s) field, specify which application traffic to exclude from the VPN tunnel and redirect to the endpoint physical interface. You can specify an application using its process name, full path, or the directory where it is installed. When entering the directory, you must end the value with \. You can enter file and directory paths using environment variables, such as %LOCALAPPDATA%, %programfiles%, and %appdata%. Do not use spaces in the tail or head, or add double quotes to full paths with spaces. You can add multiple entries by separating them with a semicolon.

For example, to exclude Microsoft Teams and Firefox from the VPN tunnel, you can enter any of the following combinations:

• Application Name: teams.exe;firefox.exe
• Full Path: C:\Users\<username>appData\Local\Microsoft\Teams\current\Teams.exe;C:\Program Files\Mozilla Firefox\firefox.exe
• Directory: C:\Users\<username>appData\Local\Microsoft\Teams\current\;C:\Program Files\Mozilla Firefox\

To find a running application's full path, on the Details tab in Task Manager, add the Image path name column.

Select the application checkbox, then click Remove to remove it from the list.

You can exclude or include cloud applications. Click Add. In the list, select the desired applications, then click Add.

Select the application checkbox, then click Remove to remove it from the list.

You can exclude or include domains. After you exclude a domain, any associated traffic does not go through the VPN tunnel when accessed through a popular browser such as Chrome, Edge, or Firefox. Click Add. In the Add Domain(s) field, enter the desired domains, using ; to configure multiple entries.

For example, if you configure the VPN tunnel to exclude youtube.com, youtube.com and *.youtube.com are excluded from the tunnel.

Select the application checkbox, then click Remove to remove it from the list.

Advanced Settings

Enable single user mode.

Save your username.

Allow non-administrator users to use local machine certificates.

Enable and enter a disclaimer message that appears when the user attempts VPN connection. The user must accept the message to allow connection.

Enable single sign on login for this VPN tunnel.

FortiClient provides an option to the end user to save their VPN login password with or without SAML configured. When using SAML, this feature relies on persistent sessions being configured in the identity provider (IdP), discussed as follows:

• Azure
• Okta

If the IdP does not support persistent sessions, FortiClient cannot save the SAML password. The end user must provide the password to the IdP for each VPN connection attempt.

The FortiClient save password feature is commonly used along with autoconnect and always-up features as well.

Configure one of the following:

• Use Internal Browser as User-Agent, Use External Browser as User-Agent: Select whether to use the FortiClient internal browser or an external browser to authenticate the user.

  FortiClient can use a browser as an external user-agent to perform SAML authentication for VPN tunnel mode instead of the FortiClient embedded login window. If a user already authenticated using SAML in the default browser, they do not need to reauthenticate in the FortiClient built-in browser. Available if you enable Enable Single Sign On (SSO) for VPN Tunnel. See Using a browser as an external user-agent for SAML authentication in an SSL VPN connection.

  On FortiClient (macOS), if Non-Secure site connections > Warn before connecting to a website over HTTP is enabled in Safari and using an external browser for SAML authentication is configured, VPN connection may fail.

• Auto Login with Azure Active Directory: configure FortiClient to automatically connect to a specified VPN tunnel immediately after it installs and receives its configuration from EMS, authenticating the connection using Microsoft Entra ID credentials. Configure the Entra ID tenant name and client ID as required. See Autoconnect on logging in as an Entra ID user.

The <before_logon_saml_auth> and <after_logon_saml_auth> XML options affect how FortiClient presents SAML authentication in the GUI. See VPN options.

Enable FortiClient to remember the IP address with which it contacts the FortiGate and reuse it throughout the connection phase. This feature helps support load balancing SSL VPN gateways with one FQDN. This feature is only available for FortiClient (Windows). See Load balancing SSL VPN gateways with one FQDN.

If the SSL VPN gateway FQDN resolves to both IPv4 and IPv6 addresses, this option forces FortiClient to use the IPv4 address to access the SSL VPN gateway. When this option is disabled, FortiClient may use the IPv4 or IPv6 address to access the SSL VPN gateway.

How FortiClient determines the order in which to try connection to the SSL VPN servers when more than one is defined. FortiClient calculates the order before each SSL VPN connection attempt.

When Server is selected, FortiClient tries the order explicitly defined in the server settings.

When Ping Speed is selected, FortiClient determines the order by the ping response speed.

When TCP Round Trip Time is selected, FortiClient determines the order by the TCP round trip time.

Select Allow or Prohibit, then select the desired security posture tag from the Select a Tag dropdown list. Tags only display in the list if they are already configured. See Security Posture Tags.

You can use this feature to prohibit endpoints from connecting to the VPN tunnel when they do not meet certain criteria. For example, if you want to prohibit endpoints without up-to-date antivirus signatures from connecting to the VPN tunnel, you would do the following:

1. Configure a security posture tagging rule that tags all endpoints without up-to-date AV signatures. See Adding a security posture tag.
2. For the VPN tunnel settings, select Prohibit, then select the configured tag from the Select a Tag dropdown list.

Endpoints without up-to-date AV signatures are prohibited from connecting to the VPN tunnel.

Enable and configure a custom message to display to the user when EMS prohibits the endpoint from connecting to the VPN tunnel due to its applied security posture tag.

For the example configuration described in the Host Tag field description, you could configure a custom message to direct the user to update their AV signature, so that they can connect to the VPN tunnel afterward.

Show option to have the VPN tunnel remember the password. You must also enable this option on the FortiGate.

Show option to have the VPN tunnel always up. You must also enable this option on the FortiGate.

Automatically connect the VPN tunnel. You must also enable this option on the FortiGate. Automatic connection to the VPN tunnel may fail if the endpoint boots up with a user profile set to automatic logon.

Enable the on connect script. Enter your script.