Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

CLI Reference

Configure Overlay Controller VPN settings.

  config vpn ocvpn
      Description: Configure Overlay Controller VPN settings.
      set status [enable|disable]
      set role [spoke|primary-hub|...]
      set multipath [enable|disable]
      set sdwan [enable|disable]
      set wan-interface <name1>, <name2>, ...
      set ip-allocation-block {ipv4-classnet-any}
      config overlays
          Description: Network overlays to register with Overlay Controller VPN service.
          edit <overlay-name>
              set inter-overlay [allow|deny]
              set assign-ip [enable|disable]
              set ipv4-start-ip {ipv4-address}
              set ipv4-end-ip {ipv4-address}
              config subnets
                  Description: Internal subnets to register with OCVPN service.
                  edit <id>
                      set type [subnet|interface]
                      set subnet {ipv4-classnet-any}
                      set interface {string}
                  next
              end
          next
      end
      config forticlient-access
          Description: Configure FortiClient settings.
          set status [enable|disable]
          set psksecret {password-3}
          config auth-groups
              Description: FortiClient user authentication groups.
              edit <name>
                  set auth-group {string}
                  set overlays <overlay-name1>, <overlay-name2>, ...
              next
          end
      end
      set auto-discovery [enable|disable]
      set poll-interval {integer}
      set eap [enable|disable]
      set eap-users {string}
      set nat [enable|disable]
  end

config vpn ocvpn

Parameter Name Description Type Size
status Enable/disable Overlay Controller cloud assisted VPN.
enable: Enable Overlay Controller VPN.
disable: Disable Overlay Controller VPN.
option -
role Set device role.
spoke: Register device as static spoke.
primary-hub: Register device as primary hub.
secondary-hub: Register device as secondary hub.
option -
multipath Enable/disable multipath redundancy.
enable: Enable multipath redundancy.
disable: Disable multipath redundancy.
option -
sdwan Enable/disable adding OCVPN tunnels to SDWAN.
enable: Enable adding OCVPN tunnels to SDWAN.
disable: Disable adding OCVPN tunnels to SDWAN.
option -
wan-interface <name> FortiGate WAN interfaces to use with OCVPN.
Interface name.
string Maximum length: 79
ip-allocation-block Class B subnet reserved for private IP address assignment. ipv4-classnet-any Not Specified
auto-discovery Enable/disable auto-discovery shortcuts.
enable: Enable ADVPN auto-discovery shortcuts.
disable: Disable ADVPN auto-discovery shortcuts.
option -
poll-interval Overlay Controller VPN polling interval. integer Minimum value: 30 Maximum value: 120
eap Enable/disable EAP client authentication.
enable: Enable EAP client authentication.
disable: Disable EAP client authentication.
option -
eap-users EAP authentication user group. string Maximum length: 35
nat Enable/disable inter-overlay source NAT.
enable: Enable inter-overlay source NAT.
disable: Disable inter-overlay source NAT.
option -

config overlays

Parameter Name Description Type Size
inter-overlay Allow or deny traffic from other overlays.
allow: Allow traffic from other overlays.
deny: Deny traffic from other overlays.
option -
assign-ip Enable/disable mode-cfg address assignment.
enable: Enable client IPv4 address assignment.
disable: Disable client IPv4 address assignment.
option -
ipv4-start-ip Start of IPv4 range. ipv4-address Not Specified
ipv4-end-ip End of IPv4 range. ipv4-address Not Specified

config subnets

Parameter Name Description Type Size
type Subnet type.
subnet: Configure participating subnet IP and mask.
interface: Configure participating LAN interface.
option -
subnet IPv4 address and subnet mask. ipv4-classnet-any Not Specified
interface LAN interface. string Maximum length: 15

config forticlient-access

Parameter Name Description Type Size
status Enable/disable FortiClient to access OCVPN networks.
enable: Enable FortiClient access to OCVPN overlays.
disable: Disable FortiClient access to OCVPN overlays.
option -
psksecret Pre-shared secret for FortiClient PSK authentication (ASCII string or hexadecimal encoded with a leading 0x). password-3 Not Specified

config auth-groups

Parameter Name Description Type Size
auth-group Authentication user group for FortiClient access. string Maximum length: 35
overlays <overlay-name> OCVPN overlays to allow access to.
Overlay name.
string Maximum length: 79

Configure Overlay Controller VPN settings.

  config vpn ocvpn
      Description: Configure Overlay Controller VPN settings.
      set status [enable|disable]
      set role [spoke|primary-hub|...]
      set multipath [enable|disable]
      set sdwan [enable|disable]
      set wan-interface <name1>, <name2>, ...
      set ip-allocation-block {ipv4-classnet-any}
      config overlays
          Description: Network overlays to register with Overlay Controller VPN service.
          edit <overlay-name>
              set inter-overlay [allow|deny]
              set assign-ip [enable|disable]
              set ipv4-start-ip {ipv4-address}
              set ipv4-end-ip {ipv4-address}
              config subnets
                  Description: Internal subnets to register with OCVPN service.
                  edit <id>
                      set type [subnet|interface]
                      set subnet {ipv4-classnet-any}
                      set interface {string}
                  next
              end
          next
      end
      config forticlient-access
          Description: Configure FortiClient settings.
          set status [enable|disable]
          set psksecret {password-3}
          config auth-groups
              Description: FortiClient user authentication groups.
              edit <name>
                  set auth-group {string}
                  set overlays <overlay-name1>, <overlay-name2>, ...
              next
          end
      end
      set auto-discovery [enable|disable]
      set poll-interval {integer}
      set eap [enable|disable]
      set eap-users {string}
      set nat [enable|disable]
  end

config vpn ocvpn

Parameter Name Description Type Size
status Enable/disable Overlay Controller cloud assisted VPN.
enable: Enable Overlay Controller VPN.
disable: Disable Overlay Controller VPN.
option -
role Set device role.
spoke: Register device as static spoke.
primary-hub: Register device as primary hub.
secondary-hub: Register device as secondary hub.
option -
multipath Enable/disable multipath redundancy.
enable: Enable multipath redundancy.
disable: Disable multipath redundancy.
option -
sdwan Enable/disable adding OCVPN tunnels to SDWAN.
enable: Enable adding OCVPN tunnels to SDWAN.
disable: Disable adding OCVPN tunnels to SDWAN.
option -
wan-interface <name> FortiGate WAN interfaces to use with OCVPN.
Interface name.
string Maximum length: 79
ip-allocation-block Class B subnet reserved for private IP address assignment. ipv4-classnet-any Not Specified
auto-discovery Enable/disable auto-discovery shortcuts.
enable: Enable ADVPN auto-discovery shortcuts.
disable: Disable ADVPN auto-discovery shortcuts.
option -
poll-interval Overlay Controller VPN polling interval. integer Minimum value: 30 Maximum value: 120
eap Enable/disable EAP client authentication.
enable: Enable EAP client authentication.
disable: Disable EAP client authentication.
option -
eap-users EAP authentication user group. string Maximum length: 35
nat Enable/disable inter-overlay source NAT.
enable: Enable inter-overlay source NAT.
disable: Disable inter-overlay source NAT.
option -

config overlays

Parameter Name Description Type Size
inter-overlay Allow or deny traffic from other overlays.
allow: Allow traffic from other overlays.
deny: Deny traffic from other overlays.
option -
assign-ip Enable/disable mode-cfg address assignment.
enable: Enable client IPv4 address assignment.
disable: Disable client IPv4 address assignment.
option -
ipv4-start-ip Start of IPv4 range. ipv4-address Not Specified
ipv4-end-ip End of IPv4 range. ipv4-address Not Specified

config subnets

Parameter Name Description Type Size
type Subnet type.
subnet: Configure participating subnet IP and mask.
interface: Configure participating LAN interface.
option -
subnet IPv4 address and subnet mask. ipv4-classnet-any Not Specified
interface LAN interface. string Maximum length: 15

config forticlient-access

Parameter Name Description Type Size
status Enable/disable FortiClient to access OCVPN networks.
enable: Enable FortiClient access to OCVPN overlays.
disable: Disable FortiClient access to OCVPN overlays.
option -
psksecret Pre-shared secret for FortiClient PSK authentication (ASCII string or hexadecimal encoded with a leading 0x). password-3 Not Specified

config auth-groups

Parameter Name Description Type Size
auth-group Authentication user group for FortiClient access. string Maximum length: 35
overlays <overlay-name> OCVPN overlays to allow access to.
Overlay name.
string Maximum length: 79