CLI Reference

alertemail
- alertemail setting
antivirus
- antivirus heuristic
- antivirus profile
- antivirus quarantine
- antivirus settings
application
- application custom
- application group
- application list
- application name
- application rule-settings
authentication
- authentication rule
- authentication scheme
- authentication setting
certificate
- certificate ca
- certificate crl
- certificate local
- certificate remote
credential-store
- credential-store domain-controller
dlp
- dlp filepattern
- dlp fp-doc-source
- dlp sensitivity
- dlp sensor
- dlp settings
dnsfilter
- dnsfilter domain-filter
- dnsfilter profile
emailfilter
- emailfilter bwl
- emailfilter bword
- emailfilter dnsbl
- emailfilter fortishield
- emailfilter iptrust
- emailfilter mheader
- emailfilter options
- emailfilter profile
endpoint-control
- endpoint-control fctems
extender-controller
- extender-controller dataplan
- extender-controller extender
file-filter
- file-filter profile
firewall
- firewall DoS-policy
- firewall DoS-policy6
- firewall acl
- firewall acl6
- firewall address
- firewall address6
- firewall address6-template
- firewall addrgrp
- firewall addrgrp6
- firewall auth-portal
- firewall central-snat-map
- firewall city
- firewall country
- firewall decrypted-traffic-mirror
- firewall dnstranslation
- firewall identity-based-route
- firewall interface-policy
- firewall interface-policy6
- firewall internet-service
- firewall internet-service-addition
- firewall internet-service-append
- firewall internet-service-botnet
- firewall internet-service-custom
- firewall internet-service-custom-group
- firewall internet-service-definition
- firewall internet-service-extension
- firewall internet-service-group
- firewall internet-service-ipbl-reason
- firewall internet-service-ipbl-vendor
- firewall internet-service-list
- firewall internet-service-name
- firewall internet-service-owner
- firewall internet-service-reputation
- firewall internet-service-sld
- firewall ip-translation
- firewall ipmacbinding setting
- firewall ipmacbinding table
- firewall ippool
- firewall ippool6
- firewall ldb-monitor
- firewall local-in-policy
- firewall local-in-policy6
- firewall multicast-address
- firewall multicast-address6
- firewall multicast-policy
- firewall multicast-policy6
- firewall policy
- firewall policy46
- firewall policy64
- firewall profile-group
- firewall profile-protocol-options
- firewall proxy-address
- firewall proxy-addrgrp
- firewall proxy-policy
- firewall region
- firewall schedule group
- firewall schedule onetime
- firewall schedule recurring
- firewall security-policy
- firewall service category
- firewall service custom
- firewall service group
- firewall shaper per-ip-shaper
- firewall shaper traffic-shaper
- firewall shaping-policy
- firewall shaping-profile
- firewall sniffer
- firewall ssh host-key
- firewall ssh local-ca
- firewall ssh local-key
- firewall ssh setting
- firewall ssl setting
- firewall ssl-server
- firewall ssl-ssh-profile
- firewall traffic-class
- firewall ttl-policy
- firewall vendor-mac
- firewall vip
- firewall vip46
- firewall vip6
- firewall vip64
- firewall vipgrp
- firewall vipgrp46
- firewall vipgrp6
- firewall vipgrp64
- firewall wildcard-fqdn custom
- firewall wildcard-fqdn group
ftp-proxy
- ftp-proxy explicit
icap
- icap profile
- icap server
ips
- ips custom
- ips decoder
- ips global
- ips rule
- ips rule-settings
- ips sensor
- ips settings
- ips view-map
log
- log custom-field
- log disk filter
- log disk setting
- log eventfilter
- log fortianalyzer filter
- log fortianalyzer override-filter
- log fortianalyzer override-setting
- log fortianalyzer setting
- log fortianalyzer-cloud filter
- log fortianalyzer-cloud override-filter
- log fortianalyzer-cloud override-setting
- log fortianalyzer-cloud setting
- log fortianalyzer2 filter
- log fortianalyzer2 override-filter
- log fortianalyzer2 override-setting
- log fortianalyzer2 setting
- log fortianalyzer3 filter
- log fortianalyzer3 override-filter
- log fortianalyzer3 override-setting
- log fortianalyzer3 setting
- log fortiguard filter
- log fortiguard override-filter
- log fortiguard override-setting
- log fortiguard setting
- log gui-display
- log memory filter
- log memory global-setting
- log memory setting
- log null-device filter
- log null-device setting
- log setting
- log syslogd filter
- log syslogd override-filter
- log syslogd override-setting
- log syslogd setting
- log syslogd2 filter
- log syslogd2 override-filter
- log syslogd2 override-setting
- log syslogd2 setting
- log syslogd3 filter
- log syslogd3 override-filter
- log syslogd3 override-setting
- log syslogd3 setting
- log syslogd4 filter
- log syslogd4 override-filter
- log syslogd4 override-setting
- log syslogd4 setting
- log threat-weight
- log webtrends filter
- log webtrends setting
monitoring
- monitoring np6-ipsec-engine
report
- report chart
- report dataset
- report layout
- report setting
- report style
- report theme
router
- router access-list
- router access-list6
- router aspath-list
- router auth-path
- router bfd
- router bfd6
- router bgp
- router community-list
- router isis
- router key-chain
- router multicast
- router multicast-flow
- router multicast6
- router ospf
- router ospf6
- router policy
- router policy6
- router prefix-list
- router prefix-list6
- router rip
- router ripng
- router route-map
- router setting
- router static
- router static6
ssh-filter
- ssh-filter profile
switch-controller
- switch-controller auto-config custom
- switch-controller auto-config default
- switch-controller auto-config policy
- switch-controller custom-command
- switch-controller global
- switch-controller initial-config template
- switch-controller initial-config vlans
- switch-controller lldp-profile
- switch-controller lldp-settings
- switch-controller location
- switch-controller mac-policy
- switch-controller managed-switch
- switch-controller nac-device
- switch-controller nac-settings
- switch-controller port-policy
- switch-controller ptp policy
- switch-controller qos dot1p-map
- switch-controller qos ip-dscp-map
- switch-controller qos qos-policy
- switch-controller qos queue-policy
- switch-controller remote-log
- switch-controller security-policy 802-1X
- switch-controller security-policy local-access
- switch-controller snmp-community
- switch-controller snmp-user
- switch-controller storm-control-policy
- switch-controller stp-instance
- switch-controller stp-settings
- switch-controller switch-group
- switch-controller switch-interface-tag
- switch-controller switch-profile
- switch-controller system
- switch-controller traffic-policy
- switch-controller virtual-port-pool
- switch-controller vlan-policy
system
- system 3g-modem custom
- system accprofile
- system admin
- system alarm
- system alias
- system api-user
- system arp-table
- system auto-install
- system auto-script
- system automation-action
- system automation-destination
- system automation-stitch
- system automation-trigger
- system autoupdate push-update
- system autoupdate schedule
- system autoupdate tunneling
- system central-management
- system cluster-sync
- system console
- system csf
- system custom-language
- system ddns
- system dedicated-mgmt
- system dhcp server
- system dhcp6 server
- system dns
- system dns-database
- system dns-server
- system dscp-based-priority
- system email-server
- system external-resource
- system fips-cc
- system fortiguard
- system fortimanager
- system fortisandbox
- system fsso-polling
- system ftm-push
- system geneve
- system geoip-country
- system geoip-override
- system global
- system gre-tunnel
- system ha
- system ha-monitor
- system interface
- system ipip-tunnel
- system ips
- system ips-urlfilter-dns
- system ips-urlfilter-dns6
- system ipsec-aggregate
- system ipv6-neighbor-cache
- system ipv6-tunnel
- system isf-queue-profile
- system link-monitor
- system lldp network-policy
- system lte-modem
- system mac-address-table
- system mobile-tunnel
- system modem
- system nat64
- system nd-proxy
- system netflow
- system network-visibility
- system np6
- system npu
- system ntp
- system object-tagging
- system password-policy
- system password-policy-guest-admin
- system pppoe-interface
- system probe-response
- system proxy-arp
- system ptp
- system replacemsg admin
- system replacemsg alertmail
- system replacemsg auth
- system replacemsg fortiguard-wf
- system replacemsg ftp
- system replacemsg http
- system replacemsg icap
- system replacemsg mail
- system replacemsg nac-quar
- system replacemsg spam
- system replacemsg sslvpn
- system replacemsg traffic-quota
- system replacemsg utm
- system replacemsg webproxy
- system replacemsg-group
- system replacemsg-image
- system resource-limits
- system saml
- system sdn-connector
- system sdwan
- system session-helper
- system session-ttl
- system settings
- system sflow
- system sit-tunnel
- system sms-server
- system snmp community
- system snmp sysinfo
- system snmp user
- system speed-test-server
- system sso-admin
- system standalone-cluster
- system storage
- system switch-interface
- system tos-based-priority
- system vdom
- system vdom-dns
- system vdom-exception
- system vdom-link
- system vdom-netflow
- system vdom-property
- system vdom-radius-server
- system vdom-sflow
- system virtual-wire-pair
- system vne-tunnel
- system vxlan
- system wccp
- system zone
user
- user adgrp
- user domain-controller
- user exchange
- user fortitoken
- user fsso
- user fsso-polling
- user group
- user krb-keytab
- user ldap
- user local
- user nac-policy
- user password-policy
- user peer
- user peergrp
- user pop3
- user radius
- user saml
- user security-exempt-list
- user setting
- user tacacs+
voip
- voip profile
vpn
- vpn certificate ca
- vpn certificate crl
- vpn certificate local
- vpn certificate ocsp-server
- vpn certificate remote
- vpn certificate setting
- vpn ipsec concentrator
- vpn ipsec forticlient
- vpn ipsec manualkey
- vpn ipsec manualkey-interface
- vpn ipsec phase1
- vpn ipsec phase1-interface
- vpn ipsec phase2
- vpn ipsec phase2-interface
- vpn l2tp
- vpn ocvpn
- vpn pptp
- vpn ssl settings
- vpn ssl web host-check-software
- vpn ssl web portal
- vpn ssl web realm
- vpn ssl web user-bookmark
- vpn ssl web user-group-bookmark
waf
- waf main-class
- waf profile
- waf signature
- waf sub-class
wanopt
- wanopt auth-group
- wanopt cache-service
- wanopt content-delivery-network-rule
- wanopt peer
- wanopt profile
- wanopt remote-storage
- wanopt settings
- wanopt webcache
web-proxy
- web-proxy debug-url
- web-proxy explicit
- web-proxy forward-server
- web-proxy forward-server-group
- web-proxy global
- web-proxy profile
- web-proxy url-match
- web-proxy wisp
webfilter
- webfilter content
- webfilter content-header
- webfilter fortiguard
- webfilter ftgd-local-cat
- webfilter ftgd-local-rating
- webfilter ips-urlfilter-cache-setting
- webfilter ips-urlfilter-setting
- webfilter ips-urlfilter-setting6
- webfilter override
- webfilter profile
- webfilter search-engine
- webfilter urlfilter
wireless-controller
- wireless-controller access-control-list
- wireless-controller address
- wireless-controller addrgrp
- wireless-controller ap-status
- wireless-controller apcfg-profile
- wireless-controller arrp-profile
- wireless-controller ble-profile
- wireless-controller bonjour-profile
- wireless-controller global
- wireless-controller hotspot20 anqp-3gpp-cellular
- wireless-controller hotspot20 anqp-ip-address-type
- wireless-controller hotspot20 anqp-nai-realm
- wireless-controller hotspot20 anqp-network-auth-type
- wireless-controller hotspot20 anqp-roaming-consortium
- wireless-controller hotspot20 anqp-venue-name
- wireless-controller hotspot20 h2qp-conn-capability
- wireless-controller hotspot20 h2qp-operator-name
- wireless-controller hotspot20 h2qp-osu-provider
- wireless-controller hotspot20 h2qp-wan-metric
- wireless-controller hotspot20 hs-profile
- wireless-controller hotspot20 icon
- wireless-controller hotspot20 qos-map
- wireless-controller inter-controller
- wireless-controller log
- wireless-controller mpsk-profile
- wireless-controller qos-profile
- wireless-controller region
- wireless-controller setting
- wireless-controller snmp
- wireless-controller timers
- wireless-controller utm-profile
- wireless-controller vap
- wireless-controller vap-group
- wireless-controller wag-profile
- wireless-controller wids-profile
- wireless-controller wtp
- wireless-controller wtp-group
- wireless-controller wtp-profile

Home FortiGate / FortiOS 6.4.2 CLI Reference

6.4.2

vpn ipsec phase1-interface

Configure VPN remote gateway.

  config vpn ipsec phase1-interface
      Description: Configure VPN remote gateway.
      edit <name>
          set type [static|dynamic|...]
          set interface {string}
          set ip-version [4|6]
          set ike-version [1|2]
          set local-gw {ipv4-address}
          set local-gw6 {ipv6-address}
          set remote-gw {ipv4-address}
          set remote-gw6 {ipv6-address}
          set remotegw-ddns {string}
          set keylife {integer}
          set certificate <name1>, <name2>, ...
          set authmethod [psk|signature]
          set authmethod-remote [psk|signature]
          set mode [aggressive|main]
          set peertype [any|one|...]
          set peerid {string}
          set default-gw {ipv4-address}
          set default-gw-priority {integer}
          set usrgrp {string}
          set peer {string}
          set peergrp {string}
          set monitor {string}
          set monitor-hold-down-type [immediate|delay|...]
          set monitor-hold-down-delay {integer}
          set monitor-hold-down-weekday [everyday|sunday|...]
          set monitor-hold-down-time {user}
          set net-device [enable|disable]
          set tunnel-search [selectors|nexthop]
          set passive-mode [enable|disable]
          set exchange-interface-ip [enable|disable]
          set exchange-ip-addr4 {ipv4-address}
          set exchange-ip-addr6 {ipv6-address}
          set aggregate-member [enable|disable]
          set aggregate-weight {integer}
          set mode-cfg [disable|enable]
          set assign-ip [disable|enable]
          set assign-ip-from [range|usrgrp|...]
          set ipv4-start-ip {ipv4-address}
          set ipv4-end-ip {ipv4-address}
          set ipv4-netmask {ipv4-netmask}
          set dhcp-ra-giaddr {ipv4-address}
          set dhcp6-ra-linkaddr {ipv6-address}
          set dns-mode [manual|auto]
          set ipv4-dns-server1 {ipv4-address}
          set ipv4-dns-server2 {ipv4-address}
          set ipv4-dns-server3 {ipv4-address}
          set ipv4-wins-server1 {ipv4-address}
          set ipv4-wins-server2 {ipv4-address}
          config ipv4-exclude-range
              Description: Configuration Method IPv4 exclude ranges.
              edit <id>
                  set start-ip {ipv4-address}
                  set end-ip {ipv4-address}
              next
          end
          set ipv4-split-include {string}
          set split-include-service {string}
          set ipv4-name {string}
          set ipv6-start-ip {ipv6-address}
          set ipv6-end-ip {ipv6-address}
          set ipv6-prefix {integer}
          set ipv6-dns-server1 {ipv6-address}
          set ipv6-dns-server2 {ipv6-address}
          set ipv6-dns-server3 {ipv6-address}
          config ipv6-exclude-range
              Description: Configuration method IPv6 exclude ranges.
              edit <id>
                  set start-ip {ipv6-address}
                  set end-ip {ipv6-address}
              next
          end
          set ipv6-split-include {string}
          set ipv6-name {string}
          set unity-support [disable|enable]
          set domain {string}
          set banner {var-string}
          set include-local-lan [disable|enable]
          set ipv4-split-exclude {string}
          set ipv6-split-exclude {string}
          set save-password [disable|enable]
          set client-auto-negotiate [disable|enable]
          set client-keep-alive [disable|enable]
          set backup-gateway <address1>, <address2>, ...
          set proposal {option1}, {option2}, ...
          set add-route [disable|enable]
          set add-gw-route [enable|disable]
          set psksecret {password-3}
          set psksecret-remote {password-3}
          set keepalive {integer}
          set distance {integer}
          set priority {integer}
          set localid {string}
          set localid-type [auto|fqdn|...]
          set auto-negotiate [enable|disable]
          set negotiate-timeout {integer}
          set fragmentation [enable|disable]
          set ip-fragmentation [pre-encapsulation|post-encapsulation]
          set dpd [disable|on-idle|...]
          set dpd-retrycount {integer}
          set dpd-retryinterval {user}
          set forticlient-enforcement [enable|disable]
          set comments {var-string}
          set npu-offload [enable|disable]
          set send-cert-chain [enable|disable]
          set dhgrp {option1}, {option2}, ...
          set suite-b [disable|suite-b-gcm-128|...]
          set eap [enable|disable]
          set eap-identity [use-id-payload|send-request]
          set eap-exclude-peergrp {string}
          set acct-verify [enable|disable]
          set ppk [disable|allow|...]
          set ppk-secret {password-3}
          set ppk-identity {string}
          set wizard-type [custom|dialup-forticlient|...]
          set xauthtype [disable|client|...]
          set reauth [disable|enable]
          set authusr {string}
          set authpasswd {password}
          set group-authentication [enable|disable]
          set group-authentication-secret {password-3}
          set authusrgrp {string}
          set mesh-selector-type [disable|subnet|...]
          set idle-timeout [enable|disable]
          set idle-timeoutinterval {integer}
          set ha-sync-esp-seqno [enable|disable]
          set auto-discovery-sender [enable|disable]
          set auto-discovery-receiver [enable|disable]
          set auto-discovery-forwarder [enable|disable]
          set auto-discovery-psk [enable|disable]
          set encapsulation [none|gre|...]
          set encapsulation-address [ike|ipv4|...]
          set encap-local-gw4 {ipv4-address}
          set encap-local-gw6 {ipv6-address}
          set encap-remote-gw4 {ipv4-address}
          set encap-remote-gw6 {ipv6-address}
          set vni {integer}
          set nattraversal [enable|disable|...]
          set esn [require|allow|...]
          set fragmentation-mtu {integer}
          set childless-ike [enable|disable]
          set rekey [enable|disable]
          set digital-signature-auth [enable|disable]
          set signature-hash-alg {option1}, {option2}, ...
          set rsa-signature-format [pkcs1|pss]
          set enforce-unique-id [disable|keep-new|...]
          set cert-id-validation [enable|disable]
          set fec-egress [enable|disable]
          set fec-send-timeout {integer}
          set fec-base {integer}
          set fec-redundant {integer}
          set fec-ingress [enable|disable]
          set fec-receive-timeout {integer}
          set network-overlay [disable|enable]
          set network-id {integer}
      next
  end

config vpn ipsec phase1-interface

Parameter Name	Description	Type	Size
type	Remote gateway type. static: Remote VPN gateway has fixed IP address. dynamic: Remote VPN gateway has dynamic IP address. ddns: Remote VPN gateway has dynamic IP address and is a dynamic DNS client.	option	-
interface	Local physical, aggregate, or VLAN outgoing interface.	string	Maximum length: 35
ip-version	IP version to use for VPN interface. 4: Use IPv4 addressing for gateways. 6: Use IPv6 addressing for gateways.	option	-
ike-version	IKE protocol version. 1: Use IKEv1 protocol. 2: Use IKEv2 protocol.	option	-
local-gw	IPv4 address of the local gateway's external interface.	ipv4-address	Not Specified
local-gw6	IPv6 address of the local gateway's external interface.	ipv6-address	Not Specified
remote-gw	IPv4 address of the remote gateway's external interface.	ipv4-address	Not Specified
remote-gw6	IPv6 address of the remote gateway's external interface.	ipv6-address	Not Specified
remotegw-ddns	Domain name of remote gateway (eg. name.DDNS.com).	string	Maximum length: 63
keylife	Time to wait in seconds before phase 1 encryption key expires.	integer	Minimum value: 120 Maximum value: 172800
certificate `<name>`	The names of up to 4 signed personal certificates. Certificate name.	string	Maximum length: 79
authmethod	Authentication method. psk: PSK authentication method. signature: Signature authentication method.	option	-
authmethod-remote	Authentication method (remote side). psk: PSK authentication method. signature: Signature authentication method.	option	-
mode	The ID protection mode used to establish a secure channel. aggressive: Aggressive mode. main: Main mode.	option	-
peertype	Accept this peer type. any: Accept any peer ID. one: Accept this peer ID. dialup: Accept peer ID in dialup group. peer: Accept this peer certificate. peergrp: Accept this peer certificate group.	option	-
peerid	Accept this peer identity.	string	Maximum length: 255
default-gw	IPv4 address of default route gateway to use for traffic exiting the interface.	ipv4-address	Not Specified
default-gw-priority	Priority for default gateway route. A higher priority number signifies a less preferred route.	integer	Minimum value: 0 Maximum value: 4294967295
usrgrp	User group name for dialup peers.	string	Maximum length: 35
peer	Accept this peer certificate.	string	Maximum length: 35
peergrp	Accept this peer certificate group.	string	Maximum length: 35
monitor	IPsec interface as backup for primary interface.	string	Maximum length: 35
monitor-hold-down-type	Recovery time method when primary interface re-establishes. immediate: Fail back immediately after primary recovers. delay: Number of seconds to delay fail back after primary recovers. time: Specify a time at which to fail back after primary recovers.	option	-
monitor-hold-down-delay	Time to wait in seconds before recovery once primary re-establishes.	integer	Minimum value: 0 Maximum value: 31536000
monitor-hold-down-weekday	Day of the week to recover once primary re-establishes. everyday: Every Day. sunday: Sunday. monday: Monday. tuesday: Tuesday. wednesday: Wednesday. thursday: Thursday. friday: Friday. saturday: Saturday.	option	-
monitor-hold-down-time	Time of day at which to fail back to primary after it re-establishes.	user	Not Specified
net-device	Enable/disable kernel device creation. enable: Create a kernel device for every tunnel. disable: Do not create a kernel device for tunnels.	option	-
tunnel-search	Tunnel search method for when the interface is shared. selectors: Search for tunnel in selectors. nexthop: Search for tunnel using nexthop.	option	-
passive-mode	Enable/disable IPsec passive mode for static tunnels. enable: Enable IPsec passive mode. disable: Disable IPsec passive mode.	option	-
exchange-interface-ip	Enable/disable exchange of IPsec interface IP address. enable: Enable exchange of IPsec interface IP address. disable: Disable exchange of IPsec interface IP address.	option	-
exchange-ip-addr4	IPv4 address to exchange with peers.	ipv4-address	Not Specified
exchange-ip-addr6	IPv6 address to exchange with peers	ipv6-address	Not Specified
aggregate-member	Enable/disable use as an aggregate member. enable: Enable use as an aggregate member. disable: Disable use as an aggregate member.	option	-
aggregate-weight	Link weight for aggregate.	integer	Minimum value: 1 Maximum value: 100
mode-cfg	Enable/disable configuration method. disable: Disable Configuration Method. enable: Enable Configuration Method.	option	-
assign-ip	Enable/disable assignment of IP to IPsec interface via configuration method. disable: Do not assign an IP address to the IPsec interface. enable: Assign an IP address to the IPsec interface.	option	-
assign-ip-from	Method by which the IP address will be assigned. range: Assign IP address from locally defined range. usrgrp: Assign IP address via user group. dhcp: Assign IP address via DHCP. name: Assign IP address from firewall address or group.	option	-
ipv4-start-ip	Start of IPv4 range.	ipv4-address	Not Specified
ipv4-end-ip	End of IPv4 range.	ipv4-address	Not Specified
ipv4-netmask	IPv4 Netmask.	ipv4-netmask	Not Specified
dhcp-ra-giaddr	Relay agent gateway IP address to use in the giaddr field of DHCP requests.	ipv4-address	Not Specified
dhcp6-ra-linkaddr	Relay agent IPv6 link address to use in DHCP6 requests.	ipv6-address	Not Specified
dns-mode	DNS server mode. manual: Manually configure DNS servers. auto: Use default DNS servers.	option	-
ipv4-dns-server1	IPv4 DNS server 1.	ipv4-address	Not Specified
ipv4-dns-server2	IPv4 DNS server 2.	ipv4-address	Not Specified
ipv4-dns-server3	IPv4 DNS server 3.	ipv4-address	Not Specified
ipv4-wins-server1	WINS server 1.	ipv4-address	Not Specified
ipv4-wins-server2	WINS server 2.	ipv4-address	Not Specified
ipv4-split-include	IPv4 split-include subnets.	string	Maximum length: 79
split-include-service	Split-include services.	string	Maximum length: 79
ipv4-name	IPv4 address name.	string	Maximum length: 79
ipv6-start-ip	Start of IPv6 range.	ipv6-address	Not Specified
ipv6-end-ip	End of IPv6 range.	ipv6-address	Not Specified
ipv6-prefix	IPv6 prefix.	integer	Minimum value: 1 Maximum value: 128
ipv6-dns-server1	IPv6 DNS server 1.	ipv6-address	Not Specified
ipv6-dns-server2	IPv6 DNS server 2.	ipv6-address	Not Specified
ipv6-dns-server3	IPv6 DNS server 3.	ipv6-address	Not Specified
ipv6-split-include	IPv6 split-include subnets.	string	Maximum length: 79
ipv6-name	IPv6 address name.	string	Maximum length: 79
unity-support	Enable/disable support for Cisco UNITY Configuration Method extensions. disable: Disable Cisco Unity Configuration Method Extensions. enable: Enable Cisco Unity Configuration Method Extensions.	option	-
domain	Instruct unity clients about the default DNS domain.	string	Maximum length: 63
banner	Message that unity client should display after connecting.	var-string	Maximum length: 1024
include-local-lan	Enable/disable allow local LAN access on unity clients. disable: Disable local LAN access on Unity clients. enable: Enable local LAN access on Unity clients.	option	-
ipv4-split-exclude	IPv4 subnets that should not be sent over the IPsec tunnel.	string	Maximum length: 79
ipv6-split-exclude	IPv6 subnets that should not be sent over the IPsec tunnel.	string	Maximum length: 79
save-password	Enable/disable saving XAuth username and password on VPN clients. disable: Disable saving XAuth username and password on VPN clients. enable: Enable saving XAuth username and password on VPN clients.	option	-
client-auto-negotiate	Enable/disable allowing the VPN client to bring up the tunnel when there is no traffic. disable: Disable allowing the VPN client to bring up the tunnel when there is no traffic. enable: Enable allowing the VPN client to bring up the tunnel when there is no traffic.	option	-
client-keep-alive	Enable/disable allowing the VPN client to keep the tunnel up when there is no traffic. disable: Disable allowing the VPN client to keep the tunnel up when there is no traffic. enable: Enable allowing the VPN client to keep the tunnel up when there is no traffic.	option	-
backup-gateway `<address>`	Instruct unity clients about the backup gateway address(es). Address of backup gateway.	string	Maximum length: 79
proposal	Phase1 proposal. des-md5: des-md5 des-sha1: des-sha1 des-sha256: des-sha256 des-sha384: des-sha384 des-sha512: des-sha512 3des-md5: 3des-md5 3des-sha1: 3des-sha1 3des-sha256: 3des-sha256 3des-sha384: 3des-sha384 3des-sha512: 3des-sha512 aes128-md5: aes128-md5 aes128-sha1: aes128-sha1 aes128-sha256: aes128-sha256 aes128-sha384: aes128-sha384 aes128-sha512: aes128-sha512 aes128gcm-prfsha1: aes128gcm-prfsha1 aes128gcm-prfsha256: aes128gcm-prfsha256 aes128gcm-prfsha384: aes128gcm-prfsha384 aes128gcm-prfsha512: aes128gcm-prfsha512 aes192-md5: aes192-md5 aes192-sha1: aes192-sha1 aes192-sha256: aes192-sha256 aes192-sha384: aes192-sha384 aes192-sha512: aes192-sha512 aes256-md5: aes256-md5 aes256-sha1: aes256-sha1 aes256-sha256: aes256-sha256 aes256-sha384: aes256-sha384 aes256-sha512: aes256-sha512 aes256gcm-prfsha1: aes256gcm-prfsha1 aes256gcm-prfsha256: aes256gcm-prfsha256 aes256gcm-prfsha384: aes256gcm-prfsha384 aes256gcm-prfsha512: aes256gcm-prfsha512 chacha20poly1305-prfsha1: chacha20poly1305-prfsha1 chacha20poly1305-prfsha256: chacha20poly1305-prfsha256 chacha20poly1305-prfsha384: chacha20poly1305-prfsha384 chacha20poly1305-prfsha512: chacha20poly1305-prfsha512 aria128-md5: aria128-md5 aria128-sha1: aria128-sha1 aria128-sha256: aria128-sha256 aria128-sha384: aria128-sha384 aria128-sha512: aria128-sha512 aria192-md5: aria192-md5 aria192-sha1: aria192-sha1 aria192-sha256: aria192-sha256 aria192-sha384: aria192-sha384 aria192-sha512: aria192-sha512 aria256-md5: aria256-md5 aria256-sha1: aria256-sha1 aria256-sha256: aria256-sha256 aria256-sha384: aria256-sha384 aria256-sha512: aria256-sha512 seed-md5: seed-md5 seed-sha1: seed-sha1 seed-sha256: seed-sha256 seed-sha384: seed-sha384 seed-sha512: seed-sha512	option	-
add-route	Enable/disable control addition of a route to peer destination selector. disable: Do not add a route to destination of peer selector. enable: Add route to destination of peer selector.	option	-
add-gw-route	Enable/disable automatically add a route to the remote gateway. enable: Automatically add a route to the remote gateway. disable: Do not automatically add a route to the remote gateway.	option	-
psksecret	Pre-shared secret for PSK authentication (ASCII string or hexadecimal encoded with a leading 0x).	password-3	Not Specified
psksecret-remote	Pre-shared secret for remote side PSK authentication (ASCII string or hexadecimal encoded with a leading 0x).	password-3	Not Specified
keepalive	NAT-T keep alive interval.	integer	Minimum value: 10 Maximum value: 900
distance	Distance for routes added by IKE (1 - 255).	integer	Minimum value: 1 Maximum value: 255
priority	Priority for routes added by IKE (0 - 4294967295).	integer	Minimum value: 0 Maximum value: 4294967295
localid	Local ID.	string	Maximum length: 63
localid-type	Local ID type. auto: Select ID type automatically. fqdn: Use fully qualified domain name. user-fqdn: Use user fully qualified domain name. keyid: Use key-id string. address: Use local IP address. asn1dn: Use ASN.1 distinguished name.	option	-
auto-negotiate	Enable/disable automatic initiation of IKE SA negotiation. enable: Enable automatic initiation of IKE SA negotiation. disable: Disable automatic initiation of IKE SA negotiation.	option	-
negotiate-timeout	IKE SA negotiation timeout in seconds (1 - 300).	integer	Minimum value: 1 Maximum value: 300
fragmentation	Enable/disable fragment IKE message on re-transmission. enable: Enable intra-IKE fragmentation support on re-transmission. disable: Disable intra-IKE fragmentation support.	option	-
ip-fragmentation	Determine whether IP packets are fragmented before or after IPsec encapsulation. pre-encapsulation: Fragment before IPsec encapsulation. post-encapsulation: Fragment after IPsec encapsulation (RFC compliant).	option	-
dpd	Dead Peer Detection mode. disable: Disable Dead Peer Detection. on-idle: Trigger Dead Peer Detection when IPsec is idle. on-demand: Trigger Dead Peer Detection when IPsec traffic is sent but no reply is received from the peer.	option	-
dpd-retrycount	Number of DPD retry attempts.	integer	Minimum value: 0 Maximum value: 10
dpd-retryinterval	DPD retry interval.	user	Not Specified
forticlient-enforcement	Enable/disable FortiClient enforcement. enable: Enable FortiClient enforcement. disable: Disable FortiClient enforcement.	option	-
comments	Comment.	var-string	Maximum length: 255
npu-offload	Enable/disable offloading NPU. enable: Enable NPU offloading. disable: Disable NPU offloading.	option	-
send-cert-chain	Enable/disable sending certificate chain. enable: Enable sending certificate chain. disable: Disable sending certificate chain.	option	-
dhgrp	DH group. 1: DH Group 1. 2: DH Group 2. 5: DH Group 5. 14: DH Group 14. 15: DH Group 15. 16: DH Group 16. 17: DH Group 17. 18: DH Group 18. 19: DH Group 19. 20: DH Group 20. 21: DH Group 21. 27: DH Group 27. 28: DH Group 28. 29: DH Group 29. 30: DH Group 30. 31: DH Group 31. 32: DH Group 32.	option	-
suite-b	Use Suite-B. disable: Do not use UI suite. suite-b-gcm-128: Use Suite-B-GCM-128. suite-b-gcm-256: Use Suite-B-GCM-256.	option	-
eap	Enable/disable IKEv2 EAP authentication. enable: Enable IKEv2 EAP authentication. disable: Disable IKEv2 EAP authentication.	option	-
eap-identity	IKEv2 EAP peer identity type. use-id-payload: Use IKEv2 IDi payload to resolve peer identity. send-request: Use EAP identity request to resolve peer identity.	option	-
eap-exclude-peergrp	Peer group excluded from EAP authentication.	string	Maximum length: 35
acct-verify	Enable/disable verification of RADIUS accounting record. enable: Enable verification of RADIUS accounting record. disable: Disable verification of RADIUS accounting record.	option	-
ppk	Enable/disable IKEv2 Postquantum Preshared Key (PPK). disable: Disable use of IKEv2 Postquantum Preshared Key (PPK). allow: Allow, but do not require, use of IKEv2 Postquantum Preshared Key (PPK). require: Require use of IKEv2 Postquantum Preshared Key (PPK).	option	-
ppk-secret	IKEv2 Postquantum Preshared Key (ASCII string or hexadecimal encoded with a leading 0x).	password-3	Not Specified
ppk-identity	IKEv2 Postquantum Preshared Key Identity.	string	Maximum length: 35
wizard-type	GUI VPN Wizard Type. custom: Custom VPN configuration. dialup-forticlient: Dial Up - FortiClient Windows, Mac and Android. dialup-ios: Dial Up - iPhone / iPad Native IPsec Client. dialup-android: Dial Up - Android Native IPsec Client. dialup-windows: Dial Up - Windows Native IPsec Client. dialup-cisco: Dial Up - Cisco IPsec Client. static-fortigate: Site to Site - FortiGate. dialup-fortigate: Dial Up - FortiGate. static-cisco: Site to Site - Cisco. dialup-cisco-fw: Dialup Up - Cisco Firewall. simplified-static-fortigate: Site to Site - FortiGate (SD-WAN). hub-fortigate-auto-discovery: Hub role in a Hub-and-Spoke auto-discovery VPN. spoke-fortigate-auto-discovery: Spoke role in a Hub-and-Spoke auto-discovery VPN.	option	-
xauthtype	XAuth type. disable: Disable. client: Enable as client. pap: Enable as server PAP. chap: Enable as server CHAP. auto: Enable as server auto.	option	-
reauth	Enable/disable re-authentication upon IKE SA lifetime expiration. disable: Disable IKE SA re-authentication. enable: Enable IKE SA re-authentication.	option	-
authusr	XAuth user name.	string	Maximum length: 64
authpasswd	XAuth password (max 35 characters).	password	Not Specified
group-authentication	Enable/disable IKEv2 IDi group authentication. enable: Enable IKEv2 IDi group authentication. disable: Disable IKEv2 IDi group authentication.	option	-
group-authentication-secret	Password for IKEv2 IDi group authentication. (ASCII string or hexadecimal indicated by a leading 0x.)	password-3	Not Specified
authusrgrp	Authentication user group.	string	Maximum length: 35
mesh-selector-type	Add selectors containing subsets of the configuration depending on traffic. disable: Disable. subnet: Enable addition of matching subnet selector. host: Enable addition of host to host selector.	option	-
idle-timeout	Enable/disable IPsec tunnel idle timeout. enable: Enable IPsec tunnel idle timeout. disable: Disable IPsec tunnel idle timeout.	option	-
idle-timeoutinterval	IPsec tunnel idle timeout in minutes (5 - 43200).	integer	Minimum value: 5 Maximum value: 43200
ha-sync-esp-seqno	Enable/disable sequence number jump ahead for IPsec HA. enable: Enable HA syncing of ESP sequence numbers. disable: Disable HA syncing of ESP sequence numbers.	option	-
auto-discovery-sender	Enable/disable sending auto-discovery short-cut messages. enable: Enable sending auto-discovery short-cut messages. disable: Disable sending auto-discovery short-cut messages.	option	-
auto-discovery-receiver	Enable/disable accepting auto-discovery short-cut messages. enable: Enable receiving auto-discovery short-cut messages. disable: Disable receiving auto-discovery short-cut messages.	option	-
auto-discovery-forwarder	Enable/disable forwarding auto-discovery short-cut messages. enable: Enable forwarding auto-discovery short-cut messages. disable: Disable forwarding auto-discovery short-cut messages.	option	-
auto-discovery-psk	Enable/disable use of pre-shared secrets for authentication of auto-discovery tunnels. enable: Enable use of pre-shared-secret authentication for auto-discovery tunnels. disable: Disable use of authentication defined by 'authmethod' for auto-discovery tunnels.	option	-
encapsulation	Enable/disable GRE/VXLAN encapsulation. none: No additional encapsulation. gre: GRE encapsulation. vxlan: VXLAN encapsulation.	option	-
encapsulation-address	Source for GRE/VXLAN tunnel address. ike: Use IKE/IPsec gateway addresses. ipv4: Specify separate GRE/VXLAN tunnel address. ipv6: Specify separate GRE/VXLAN tunnel address.	option	-
encap-local-gw4	Local IPv4 address of GRE/VXLAN tunnel.	ipv4-address	Not Specified
encap-local-gw6	Local IPv6 address of GRE/VXLAN tunnel.	ipv6-address	Not Specified
encap-remote-gw4	Remote IPv4 address of GRE/VXLAN tunnel.	ipv4-address	Not Specified
encap-remote-gw6	Remote IPv6 address of GRE/VXLAN tunnel.	ipv6-address	Not Specified
vni	VNI of VXLAN tunnel.	integer	Minimum value: 1 Maximum value: 16777215
nattraversal	Enable/disable NAT traversal. enable: Enable IPsec NAT traversal. disable: Disable IPsec NAT traversal. forced: Force IPsec NAT traversal on.	option	-
esn	Extended sequence number (ESN) negotiation. require: Require extended sequence number. allow: Allow extended sequence number. disable: Disable extended sequence number.	option	-
fragmentation-mtu	IKE fragmentation MTU (500 - 16000).	integer	Minimum value: 500 Maximum value: 16000
childless-ike	Enable/disable childless IKEv2 initiation (RFC 6023). enable: Enable childless IKEv2 initiation (RFC 6023). disable: Disable childless IKEv2 initiation (RFC 6023).	option	-
rekey	Enable/disable phase1 rekey. enable: Enable phase1 rekey. disable: Disable phase1 rekey.	option	-
digital-signature-auth	Enable/disable IKEv2 Digital Signature Authentication (RFC 7427). enable: Enable IKEv2 Digital Signature Authentication (RFC 7427). disable: Disable IKEv2 Digital Signature Authentication (RFC 7427).	option	-
signature-hash-alg	Digital Signature Authentication hash algorithms. sha1: SHA1. sha2-256: SHA2-256. sha2-384: SHA2-384. sha2-512: SHA2-512.	option	-
rsa-signature-format	Digital Signature Authentication RSA signature format. pkcs1: RSASSA PKCS#1 v1.5. pss: RSASSA Probabilistic Signature Scheme (PSS).	option	-
enforce-unique-id	Enable/disable peer ID uniqueness check. disable: Disable peer ID uniqueness enforcement. keep-new: Enforce peer ID uniqueness, keep new connection if collision found. keep-old: Enforce peer ID uniqueness, keep old connection if collision found.	option	-
cert-id-validation	Enable/disable cross validation of peer ID and the identity in the peer's certificate as specified in RFC 4945. enable: Enable cross validation of peer ID and the identity in the peer's certificate as specified in RFC 4945. disable: Disable cross validation of peer ID and the identity in the peer's certificate as specified in RFC 4945.	option	-
fec-egress	Enable/disable Forward Error Correction for egress IPsec traffic. enable: Enable Forward Error Correction for egress IPsec traffic. disable: Disable Forward Error Correction for egress IPsec traffic.	option	-
fec-send-timeout	Timeout in milliseconds before sending Forward Error Correction packets (1 - 1000).	integer	Minimum value: 1 Maximum value: 1000
fec-base	Number of base Forward Error Correction packets (1 - 100).	integer	Minimum value: 1 Maximum value: 100
fec-redundant	Number of redundant Forward Error Correction packets (0 - 100).	integer	Minimum value: 0 Maximum value: 100
fec-ingress	Enable/disable Forward Error Correction for ingress IPsec traffic. enable: Enable Forward Error Correction for ingress IPsec traffic. disable: Disable Forward Error Correction for ingress IPsec traffic.	option	-
fec-receive-timeout	Timeout in milliseconds before dropping Forward Error Correction packets (1 - 10000).	integer	Minimum value: 1 Maximum value: 10000
network-overlay	Enable/disable network overlays. disable: Disable network overlays. enable: Enable network overlays.	option	-
network-id	VPN gateway network ID.	integer	Minimum value: 0 Maximum value: 255

config ipv4-exclude-range

Parameter Name	Description	Type	Size
start-ip	Start of IPv4 exclusive range.	ipv4-address	Not Specified
end-ip	End of IPv4 exclusive range.	ipv4-address	Not Specified

config ipv6-exclude-range

Parameter Name	Description	Type	Size
start-ip	Start of IPv6 exclusive range.	ipv6-address	Not Specified
end-ip	End of IPv6 exclusive range.	ipv6-address	Not Specified

Configure VPN remote gateway.

config vpn ipsec phase1-interface Description: Configure VPN remote gateway. edit <name> set type [static|dynamic|...] set interface {string} set ip-version [4|6] set ike-version [1|2] set local-gw {ipv4-address} set local-gw6 {ipv6-address} set remote-gw {ipv4-address} set remote-gw6 {ipv6-address} set remotegw-ddns {string} set keylife {integer} set certificate <name1>, <name2>, ... set authmethod [psk|signature] set authmethod-remote [psk|signature] set mode [aggressive|main] set peertype [any|one|...] set peerid {string} set default-gw {ipv4-address} set default-gw-priority {integer} set usrgrp {string} set peer {string} set peergrp {string} set monitor {string} set monitor-hold-down-type [immediate|delay|...] set monitor-hold-down-delay {integer} set monitor-hold-down-weekday [everyday|sunday|...] set monitor-hold-down-time {user} set net-device [enable|disable] set tunnel-search [selectors|nexthop] set passive-mode [enable|disable] set exchange-interface-ip [enable|disable] set exchange-ip-addr4 {ipv4-address} set exchange-ip-addr6 {ipv6-address} set aggregate-member [enable|disable] set aggregate-weight {integer} set mode-cfg [disable|enable] set assign-ip [disable|enable] set assign-ip-from [range|usrgrp|...] set ipv4-start-ip {ipv4-address} set ipv4-end-ip {ipv4-address} set ipv4-netmask {ipv4-netmask} set dhcp-ra-giaddr {ipv4-address} set dhcp6-ra-linkaddr {ipv6-address} set dns-mode [manual|auto] set ipv4-dns-server1 {ipv4-address} set ipv4-dns-server2 {ipv4-address} set ipv4-dns-server3 {ipv4-address} set ipv4-wins-server1 {ipv4-address} set ipv4-wins-server2 {ipv4-address} config ipv4-exclude-range Description: Configuration Method IPv4 exclude ranges. edit <id> set start-ip {ipv4-address} set end-ip {ipv4-address} next end set ipv4-split-include {string} set split-include-service {string} set ipv4-name {string} set ipv6-start-ip {ipv6-address} set ipv6-end-ip {ipv6-address} set ipv6-prefix {integer} set ipv6-dns-server1 {ipv6-address} set ipv6-dns-server2 {ipv6-address} set ipv6-dns-server3 {ipv6-address} config ipv6-exclude-range Description: Configuration method IPv6 exclude ranges. edit <id> set start-ip {ipv6-address} set end-ip {ipv6-address} next end set ipv6-split-include {string} set ipv6-name {string} set unity-support [disable|enable] set domain {string} set banner {var-string} set include-local-lan [disable|enable] set ipv4-split-exclude {string} set ipv6-split-exclude {string} set save-password [disable|enable] set client-auto-negotiate [disable|enable] set client-keep-alive [disable|enable] set backup-gateway <address1>, <address2>, ... set proposal {option1}, {option2}, ... set add-route [disable|enable] set add-gw-route [enable|disable] set psksecret {password-3} set psksecret-remote {password-3} set keepalive {integer} set distance {integer} set priority {integer} set localid {string} set localid-type [auto|fqdn|...] set auto-negotiate [enable|disable] set negotiate-timeout {integer} set fragmentation [enable|disable] set ip-fragmentation [pre-encapsulation|post-encapsulation] set dpd [disable|on-idle|...] set dpd-retrycount {integer} set dpd-retryinterval {user} set forticlient-enforcement [enable|disable] set comments {var-string} set npu-offload [enable|disable] set send-cert-chain [enable|disable] set dhgrp {option1}, {option2}, ... set suite-b [disable|suite-b-gcm-128|...] set eap [enable|disable] set eap-identity [use-id-payload|send-request] set eap-exclude-peergrp {string} set acct-verify [enable|disable] set ppk [disable|allow|...] set ppk-secret {password-3} set ppk-identity {string} set wizard-type [custom|dialup-forticlient|...] set xauthtype [disable|client|...] set reauth [disable|enable] set authusr {string} set authpasswd {password} set group-authentication [enable|disable] set group-authentication-secret {password-3} set authusrgrp {string} set mesh-selector-type [disable|subnet|...] set idle-timeout [enable|disable] set idle-timeoutinterval {integer} set ha-sync-esp-seqno [enable|disable] set auto-discovery-sender [enable|disable] set auto-discovery-receiver [enable|disable] set auto-discovery-forwarder [enable|disable] set auto-discovery-psk [enable|disable] set encapsulation [none|gre|...] set encapsulation-address [ike|ipv4|...] set encap-local-gw4 {ipv4-address} set encap-local-gw6 {ipv6-address} set encap-remote-gw4 {ipv4-address} set encap-remote-gw6 {ipv6-address} set vni {integer} set nattraversal [enable|disable|...] set esn [require|allow|...] set fragmentation-mtu {integer} set childless-ike [enable|disable] set rekey [enable|disable] set digital-signature-auth [enable|disable] set signature-hash-alg {option1}, {option2}, ... set rsa-signature-format [pkcs1|pss] set enforce-unique-id [disable|keep-new|...] set cert-id-validation [enable|disable] set fec-egress [enable|disable] set fec-send-timeout {integer} set fec-base {integer} set fec-redundant {integer} set fec-ingress [enable|disable] set fec-receive-timeout {integer} set network-overlay [disable|enable] set network-id {integer} next end

config vpn ipsec phase1-interface

Parameter Name

Description

Type

Size

type

Remote gateway type.
static: Remote VPN gateway has fixed IP address.
dynamic: Remote VPN gateway has dynamic IP address.
ddns: Remote VPN gateway has dynamic IP address and is a dynamic DNS client.

option

interface

Local physical, aggregate, or VLAN outgoing interface.

string

Maximum length: 35

ip-version

IP version to use for VPN interface.
4: Use IPv4 addressing for gateways.
6: Use IPv6 addressing for gateways.

option

ike-version

IKE protocol version.
1: Use IKEv1 protocol.
2: Use IKEv2 protocol.

option

local-gw

IPv4 address of the local gateway's external interface.

ipv4-address

Not Specified

local-gw6

IPv6 address of the local gateway's external interface.

ipv6-address

Not Specified

remote-gw

IPv4 address of the remote gateway's external interface.

ipv4-address

Not Specified

remote-gw6

IPv6 address of the remote gateway's external interface.

ipv6-address

Not Specified

remotegw-ddns

Domain name of remote gateway (eg. name.DDNS.com).

string

Maximum length: 63

keylife

Time to wait in seconds before phase 1 encryption key expires.

integer

Minimum value: 120 Maximum value: 172800

certificate <name>

The names of up to 4 signed personal certificates.
Certificate name.

string

Maximum length: 79

authmethod

Authentication method.
psk: PSK authentication method.
signature: Signature authentication method.

option

authmethod-remote

Authentication method (remote side).
psk: PSK authentication method.
signature: Signature authentication method.

option

mode

The ID protection mode used to establish a secure channel.
aggressive: Aggressive mode.
main: Main mode.

option

peertype

Accept this peer type.
any: Accept any peer ID.
one: Accept this peer ID.
dialup: Accept peer ID in dialup group.
peer: Accept this peer certificate.
peergrp: Accept this peer certificate group.

option

peerid

Accept this peer identity.

string

Maximum length: 255

default-gw

IPv4 address of default route gateway to use for traffic exiting the interface.

ipv4-address

Not Specified

default-gw-priority

Priority for default gateway route. A higher priority number signifies a less preferred route.

integer

Minimum value: 0 Maximum value: 4294967295

usrgrp

User group name for dialup peers.

string

Maximum length: 35

peer

Accept this peer certificate.

string

Maximum length: 35

peergrp

Accept this peer certificate group.

string

Maximum length: 35

monitor

IPsec interface as backup for primary interface.

string

Maximum length: 35

monitor-hold-down-type

Recovery time method when primary interface re-establishes.
immediate: Fail back immediately after primary recovers.
delay: Number of seconds to delay fail back after primary recovers.
time: Specify a time at which to fail back after primary recovers.

option

monitor-hold-down-delay

Time to wait in seconds before recovery once primary re-establishes.

integer

Minimum value: 0 Maximum value: 31536000

monitor-hold-down-weekday

Day of the week to recover once primary re-establishes.
everyday: Every Day.
sunday: Sunday.
monday: Monday.
tuesday: Tuesday.
wednesday: Wednesday.
thursday: Thursday.
friday: Friday.
saturday: Saturday.

option

monitor-hold-down-time

Time of day at which to fail back to primary after it re-establishes.

user

Not Specified

net-device

Enable/disable kernel device creation.
enable: Create a kernel device for every tunnel.
disable: Do not create a kernel device for tunnels.

option

tunnel-search

Tunnel search method for when the interface is shared.
selectors: Search for tunnel in selectors.
nexthop: Search for tunnel using nexthop.

option

passive-mode

Enable/disable IPsec passive mode for static tunnels.
enable: Enable IPsec passive mode.
disable: Disable IPsec passive mode.

option

exchange-interface-ip

Enable/disable exchange of IPsec interface IP address.
enable: Enable exchange of IPsec interface IP address.
disable: Disable exchange of IPsec interface IP address.

option

exchange-ip-addr4

IPv4 address to exchange with peers.

ipv4-address

Not Specified

exchange-ip-addr6

IPv6 address to exchange with peers

ipv6-address

Not Specified

aggregate-member

Enable/disable use as an aggregate member.
enable: Enable use as an aggregate member.
disable: Disable use as an aggregate member.

option

aggregate-weight

Link weight for aggregate.

integer

Minimum value: 1 Maximum value: 100

mode-cfg

Enable/disable configuration method.
disable: Disable Configuration Method.
enable: Enable Configuration Method.

option

assign-ip

Enable/disable assignment of IP to IPsec interface via configuration method.
disable: Do not assign an IP address to the IPsec interface.
enable: Assign an IP address to the IPsec interface.

option

assign-ip-from

Method by which the IP address will be assigned.
range: Assign IP address from locally defined range.
usrgrp: Assign IP address via user group.
dhcp: Assign IP address via DHCP.
name: Assign IP address from firewall address or group.

option

ipv4-start-ip

Start of IPv4 range.

ipv4-address

Not Specified

ipv4-end-ip

End of IPv4 range.

ipv4-address

Not Specified

ipv4-netmask

IPv4 Netmask.

ipv4-netmask

Not Specified

dhcp-ra-giaddr

Relay agent gateway IP address to use in the giaddr field of DHCP requests.

ipv4-address

Not Specified

dhcp6-ra-linkaddr

Relay agent IPv6 link address to use in DHCP6 requests.

ipv6-address

Not Specified

dns-mode

DNS server mode.
manual: Manually configure DNS servers.
auto: Use default DNS servers.

option

ipv4-dns-server1

IPv4 DNS server 1.

ipv4-address

Not Specified

ipv4-dns-server2

IPv4 DNS server 2.

ipv4-address

Not Specified

ipv4-dns-server3

IPv4 DNS server 3.

ipv4-address

Not Specified

ipv4-wins-server1

WINS server 1.

ipv4-address

Not Specified

ipv4-wins-server2

WINS server 2.

ipv4-address

Not Specified

ipv4-split-include

IPv4 split-include subnets.

string

Maximum length: 79

split-include-service

Split-include services.

string

Maximum length: 79

ipv4-name

IPv4 address name.

string

Maximum length: 79

ipv6-start-ip

Start of IPv6 range.

ipv6-address

Not Specified

ipv6-end-ip

End of IPv6 range.

ipv6-address

Not Specified

ipv6-prefix

IPv6 prefix.

integer

Minimum value: 1 Maximum value: 128

ipv6-dns-server1

IPv6 DNS server 1.

ipv6-address

Not Specified

ipv6-dns-server2

IPv6 DNS server 2.

ipv6-address

Not Specified

ipv6-dns-server3

IPv6 DNS server 3.

ipv6-address

Not Specified

ipv6-split-include

IPv6 split-include subnets.

string

Maximum length: 79

ipv6-name

IPv6 address name.

string

Maximum length: 79

unity-support

Enable/disable support for Cisco UNITY Configuration Method extensions.
disable: Disable Cisco Unity Configuration Method Extensions.
enable: Enable Cisco Unity Configuration Method Extensions.

option

domain

Instruct unity clients about the default DNS domain.

string

Maximum length: 63

banner

Message that unity client should display after connecting.

var-string

Maximum length: 1024

include-local-lan

Enable/disable allow local LAN access on unity clients.
disable: Disable local LAN access on Unity clients.
enable: Enable local LAN access on Unity clients.

option

ipv4-split-exclude

IPv4 subnets that should not be sent over the IPsec tunnel.

string

Maximum length: 79

ipv6-split-exclude

IPv6 subnets that should not be sent over the IPsec tunnel.

string

Maximum length: 79

save-password

Enable/disable saving XAuth username and password on VPN clients.
disable: Disable saving XAuth username and password on VPN clients.
enable: Enable saving XAuth username and password on VPN clients.

option

client-auto-negotiate

Enable/disable allowing the VPN client to bring up the tunnel when there is no traffic.
disable: Disable allowing the VPN client to bring up the tunnel when there is no traffic.
enable: Enable allowing the VPN client to bring up the tunnel when there is no traffic.

option

client-keep-alive

Enable/disable allowing the VPN client to keep the tunnel up when there is no traffic.
disable: Disable allowing the VPN client to keep the tunnel up when there is no traffic.
enable: Enable allowing the VPN client to keep the tunnel up when there is no traffic.

option

backup-gateway <address>

Instruct unity clients about the backup gateway address(es).
Address of backup gateway.

string

Maximum length: 79

proposal

Phase1 proposal.
des-md5: des-md5
des-sha1: des-sha1
des-sha256: des-sha256
des-sha384: des-sha384
des-sha512: des-sha512
3des-md5: 3des-md5
3des-sha1: 3des-sha1
3des-sha256: 3des-sha256
3des-sha384: 3des-sha384
3des-sha512: 3des-sha512
aes128-md5: aes128-md5
aes128-sha1: aes128-sha1
aes128-sha256: aes128-sha256
aes128-sha384: aes128-sha384
aes128-sha512: aes128-sha512
aes128gcm-prfsha1: aes128gcm-prfsha1
aes128gcm-prfsha256: aes128gcm-prfsha256
aes128gcm-prfsha384: aes128gcm-prfsha384
aes128gcm-prfsha512: aes128gcm-prfsha512
aes192-md5: aes192-md5
aes192-sha1: aes192-sha1
aes192-sha256: aes192-sha256
aes192-sha384: aes192-sha384
aes192-sha512: aes192-sha512
aes256-md5: aes256-md5
aes256-sha1: aes256-sha1
aes256-sha256: aes256-sha256
aes256-sha384: aes256-sha384
aes256-sha512: aes256-sha512
aes256gcm-prfsha1: aes256gcm-prfsha1
aes256gcm-prfsha256: aes256gcm-prfsha256
aes256gcm-prfsha384: aes256gcm-prfsha384
aes256gcm-prfsha512: aes256gcm-prfsha512
chacha20poly1305-prfsha1: chacha20poly1305-prfsha1
chacha20poly1305-prfsha256: chacha20poly1305-prfsha256
chacha20poly1305-prfsha384: chacha20poly1305-prfsha384
chacha20poly1305-prfsha512: chacha20poly1305-prfsha512
aria128-md5: aria128-md5
aria128-sha1: aria128-sha1
aria128-sha256: aria128-sha256
aria128-sha384: aria128-sha384
aria128-sha512: aria128-sha512
aria192-md5: aria192-md5
aria192-sha1: aria192-sha1
aria192-sha256: aria192-sha256
aria192-sha384: aria192-sha384
aria192-sha512: aria192-sha512
aria256-md5: aria256-md5
aria256-sha1: aria256-sha1
aria256-sha256: aria256-sha256
aria256-sha384: aria256-sha384
aria256-sha512: aria256-sha512
seed-md5: seed-md5
seed-sha1: seed-sha1
seed-sha256: seed-sha256
seed-sha384: seed-sha384
seed-sha512: seed-sha512

option

add-route

Enable/disable control addition of a route to peer destination selector.
disable: Do not add a route to destination of peer selector.
enable: Add route to destination of peer selector.

option

add-gw-route

Enable/disable automatically add a route to the remote gateway.
enable: Automatically add a route to the remote gateway.
disable: Do not automatically add a route to the remote gateway.

option

psksecret

Pre-shared secret for PSK authentication (ASCII string or hexadecimal encoded with a leading 0x).

password-3

Not Specified

psksecret-remote

Pre-shared secret for remote side PSK authentication (ASCII string or hexadecimal encoded with a leading 0x).

password-3

Not Specified

keepalive

NAT-T keep alive interval.

integer

Minimum value: 10 Maximum value: 900

distance

Distance for routes added by IKE (1 - 255).

integer

Minimum value: 1 Maximum value: 255

priority

Priority for routes added by IKE (0 - 4294967295).

integer

Minimum value: 0 Maximum value: 4294967295

localid

Local ID.

string

Maximum length: 63

localid-type

Local ID type.
auto: Select ID type automatically.
fqdn: Use fully qualified domain name.
user-fqdn: Use user fully qualified domain name.
keyid: Use key-id string.
address: Use local IP address.
asn1dn: Use ASN.1 distinguished name.

option

auto-negotiate

Enable/disable automatic initiation of IKE SA negotiation.
enable: Enable automatic initiation of IKE SA negotiation.
disable: Disable automatic initiation of IKE SA negotiation.

option

negotiate-timeout

IKE SA negotiation timeout in seconds (1 - 300).

integer

Minimum value: 1 Maximum value: 300

fragmentation

Enable/disable fragment IKE message on re-transmission.
enable: Enable intra-IKE fragmentation support on re-transmission.
disable: Disable intra-IKE fragmentation support.

option

ip-fragmentation

Determine whether IP packets are fragmented before or after IPsec encapsulation.
pre-encapsulation: Fragment before IPsec encapsulation.
post-encapsulation: Fragment after IPsec encapsulation (RFC compliant).

option

dpd

Dead Peer Detection mode.
disable: Disable Dead Peer Detection.
on-idle: Trigger Dead Peer Detection when IPsec is idle.
on-demand: Trigger Dead Peer Detection when IPsec traffic is sent but no reply is received from the peer.

option

dpd-retrycount

Number of DPD retry attempts.

integer

Minimum value: 0 Maximum value: 10

dpd-retryinterval

DPD retry interval.

user

Not Specified

forticlient-enforcement

Enable/disable FortiClient enforcement.
enable: Enable FortiClient enforcement.
disable: Disable FortiClient enforcement.

option

comments

Comment.

var-string

Maximum length: 255

npu-offload

Enable/disable offloading NPU.
enable: Enable NPU offloading.
disable: Disable NPU offloading.

option

send-cert-chain

Enable/disable sending certificate chain.
enable: Enable sending certificate chain.
disable: Disable sending certificate chain.

option

dhgrp

DH group.
1: DH Group 1.
2: DH Group 2.
5: DH Group 5.
14: DH Group 14.
15: DH Group 15.
16: DH Group 16.
17: DH Group 17.
18: DH Group 18.
19: DH Group 19.
20: DH Group 20.
21: DH Group 21.
27: DH Group 27.
28: DH Group 28.
29: DH Group 29.
30: DH Group 30.
31: DH Group 31.
32: DH Group 32.

option

suite-b

Use Suite-B.
disable: Do not use UI suite.
suite-b-gcm-128: Use Suite-B-GCM-128.
suite-b-gcm-256: Use Suite-B-GCM-256.

option

eap

Enable/disable IKEv2 EAP authentication.
enable: Enable IKEv2 EAP authentication.
disable: Disable IKEv2 EAP authentication.

option

eap-identity

IKEv2 EAP peer identity type.
use-id-payload: Use IKEv2 IDi payload to resolve peer identity.
send-request: Use EAP identity request to resolve peer identity.

option

eap-exclude-peergrp

Peer group excluded from EAP authentication.

string

Maximum length: 35

acct-verify

Enable/disable verification of RADIUS accounting record.
enable: Enable verification of RADIUS accounting record.
disable: Disable verification of RADIUS accounting record.

option

ppk

Enable/disable IKEv2 Postquantum Preshared Key (PPK).
disable: Disable use of IKEv2 Postquantum Preshared Key (PPK).
allow: Allow, but do not require, use of IKEv2 Postquantum Preshared Key (PPK).
require: Require use of IKEv2 Postquantum Preshared Key (PPK).

option

ppk-secret

IKEv2 Postquantum Preshared Key (ASCII string or hexadecimal encoded with a leading 0x).

password-3

Not Specified

ppk-identity

IKEv2 Postquantum Preshared Key Identity.

string

Maximum length: 35

wizard-type

GUI VPN Wizard Type.
custom: Custom VPN configuration.
dialup-forticlient: Dial Up - FortiClient Windows, Mac and Android.
dialup-ios: Dial Up - iPhone / iPad Native IPsec Client.
dialup-android: Dial Up - Android Native IPsec Client.
dialup-windows: Dial Up - Windows Native IPsec Client.
dialup-cisco: Dial Up - Cisco IPsec Client.
static-fortigate: Site to Site - FortiGate.
dialup-fortigate: Dial Up - FortiGate.
static-cisco: Site to Site - Cisco.
dialup-cisco-fw: Dialup Up - Cisco Firewall.
simplified-static-fortigate: Site to Site - FortiGate (SD-WAN).
hub-fortigate-auto-discovery: Hub role in a Hub-and-Spoke auto-discovery VPN.
spoke-fortigate-auto-discovery: Spoke role in a Hub-and-Spoke auto-discovery VPN.

option

xauthtype

XAuth type.
disable: Disable.
client: Enable as client.
pap: Enable as server PAP.
chap: Enable as server CHAP.
auto: Enable as server auto.

option

reauth

Enable/disable re-authentication upon IKE SA lifetime expiration.
disable: Disable IKE SA re-authentication.
enable: Enable IKE SA re-authentication.

option

authusr

XAuth user name.

string

Maximum length: 64

authpasswd

XAuth password (max 35 characters).

password

Not Specified

group-authentication

Enable/disable IKEv2 IDi group authentication.
enable: Enable IKEv2 IDi group authentication.
disable: Disable IKEv2 IDi group authentication.

option

group-authentication-secret

Password for IKEv2 IDi group authentication. (ASCII string or hexadecimal indicated by a leading 0x.)

password-3

Not Specified

authusrgrp

Authentication user group.

string

Maximum length: 35

mesh-selector-type

Add selectors containing subsets of the configuration depending on traffic.
disable: Disable.
subnet: Enable addition of matching subnet selector.
host: Enable addition of host to host selector.

option

idle-timeout

Enable/disable IPsec tunnel idle timeout.
enable: Enable IPsec tunnel idle timeout.
disable: Disable IPsec tunnel idle timeout.

option

idle-timeoutinterval

IPsec tunnel idle timeout in minutes (5 - 43200).

integer

Minimum value: 5 Maximum value: 43200

ha-sync-esp-seqno

Enable/disable sequence number jump ahead for IPsec HA.
enable: Enable HA syncing of ESP sequence numbers.
disable: Disable HA syncing of ESP sequence numbers.

option

auto-discovery-sender

Enable/disable sending auto-discovery short-cut messages.
enable: Enable sending auto-discovery short-cut messages.
disable: Disable sending auto-discovery short-cut messages.

option

auto-discovery-receiver

Enable/disable accepting auto-discovery short-cut messages.
enable: Enable receiving auto-discovery short-cut messages.
disable: Disable receiving auto-discovery short-cut messages.

option

auto-discovery-forwarder

Enable/disable forwarding auto-discovery short-cut messages.
enable: Enable forwarding auto-discovery short-cut messages.
disable: Disable forwarding auto-discovery short-cut messages.

option

auto-discovery-psk

Enable/disable use of pre-shared secrets for authentication of auto-discovery tunnels.
enable: Enable use of pre-shared-secret authentication for auto-discovery tunnels.
disable: Disable use of authentication defined by 'authmethod' for auto-discovery tunnels.

option

encapsulation

Enable/disable GRE/VXLAN encapsulation.
none: No additional encapsulation.
gre: GRE encapsulation.
vxlan: VXLAN encapsulation.

option

encapsulation-address

Source for GRE/VXLAN tunnel address.
ike: Use IKE/IPsec gateway addresses.
ipv4: Specify separate GRE/VXLAN tunnel address.
ipv6: Specify separate GRE/VXLAN tunnel address.

option

encap-local-gw4

Local IPv4 address of GRE/VXLAN tunnel.

ipv4-address

Not Specified

encap-local-gw6

Local IPv6 address of GRE/VXLAN tunnel.

ipv6-address

Not Specified

encap-remote-gw4

Remote IPv4 address of GRE/VXLAN tunnel.

ipv4-address

Not Specified

encap-remote-gw6

Remote IPv6 address of GRE/VXLAN tunnel.

ipv6-address

Not Specified

vni

VNI of VXLAN tunnel.

integer

Minimum value: 1 Maximum value: 16777215

nattraversal

Enable/disable NAT traversal.
enable: Enable IPsec NAT traversal.
disable: Disable IPsec NAT traversal.
forced: Force IPsec NAT traversal on.

option

esn

Extended sequence number (ESN) negotiation.
require: Require extended sequence number.
allow: Allow extended sequence number.
disable: Disable extended sequence number.

option

fragmentation-mtu

IKE fragmentation MTU (500 - 16000).

integer

Minimum value: 500 Maximum value: 16000

childless-ike

Enable/disable childless IKEv2 initiation (RFC 6023).
enable: Enable childless IKEv2 initiation (RFC 6023).
disable: Disable childless IKEv2 initiation (RFC 6023).

option

rekey

Enable/disable phase1 rekey.
enable: Enable phase1 rekey.
disable: Disable phase1 rekey.

option

digital-signature-auth

Enable/disable IKEv2 Digital Signature Authentication (RFC 7427).
enable: Enable IKEv2 Digital Signature Authentication (RFC 7427).
disable: Disable IKEv2 Digital Signature Authentication (RFC 7427).

option

signature-hash-alg

Digital Signature Authentication hash algorithms.
sha1: SHA1.
sha2-256: SHA2-256.
sha2-384: SHA2-384.
sha2-512: SHA2-512.

option

rsa-signature-format

Digital Signature Authentication RSA signature format.
pkcs1: RSASSA PKCS#1 v1.5.
pss: RSASSA Probabilistic Signature Scheme (PSS).

option

enforce-unique-id

Enable/disable peer ID uniqueness check.
disable: Disable peer ID uniqueness enforcement.
keep-new: Enforce peer ID uniqueness, keep new connection if collision found.
keep-old: Enforce peer ID uniqueness, keep old connection if collision found.

option

cert-id-validation

Enable/disable cross validation of peer ID and the identity in the peer's certificate as specified in RFC 4945.
enable: Enable cross validation of peer ID and the identity in the peer's certificate as specified in RFC 4945.
disable: Disable cross validation of peer ID and the identity in the peer's certificate as specified in RFC 4945.

option

fec-egress

Enable/disable Forward Error Correction for egress IPsec traffic.
enable: Enable Forward Error Correction for egress IPsec traffic.
disable: Disable Forward Error Correction for egress IPsec traffic.

option

fec-send-timeout

Timeout in milliseconds before sending Forward Error Correction packets (1 - 1000).

integer

Minimum value: 1 Maximum value: 1000

fec-base

Number of base Forward Error Correction packets (1 - 100).

integer

Minimum value: 1 Maximum value: 100

fec-redundant

Number of redundant Forward Error Correction packets (0 - 100).

integer

Minimum value: 0 Maximum value: 100

fec-ingress

Enable/disable Forward Error Correction for ingress IPsec traffic.
enable: Enable Forward Error Correction for ingress IPsec traffic.
disable: Disable Forward Error Correction for ingress IPsec traffic.

option

fec-receive-timeout

Timeout in milliseconds before dropping Forward Error Correction packets (1 - 10000).

integer

Minimum value: 1 Maximum value: 10000

network-overlay

Enable/disable network overlays.
disable: Disable network overlays.
enable: Enable network overlays.

option

network-id

VPN gateway network ID.

integer

Minimum value: 0 Maximum value: 255

Parameter Name

Description

Type

Size

start-ip

Start of IPv4 exclusive range.

ipv4-address

Not Specified

end-ip

End of IPv4 exclusive range.

ipv4-address

Not Specified

config ipv6-exclude-range

Parameter Name

Description

Type

Size

start-ip

Start of IPv6 exclusive range.

ipv6-address

Not Specified

end-ip

End of IPv6 exclusive range.

ipv6-address

Not Specified

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

CLI Reference

vpn ipsec phase1-interface

Configure VPN remote gateway.

config vpn ipsec phase1-interface

config ipv4-exclude-range

config ipv6-exclude-range

vpn ipsec phase1-interface

Configure VPN remote gateway.

config vpn ipsec phase1-interface

config ipv4-exclude-range

config ipv6-exclude-range