Fortinet black logo

CLI Reference

config vpn ocvpn

config vpn ocvpn

Configure Overlay Controller VPN settings.

config vpn ocvpn

Description: Configure Overlay Controller VPN settings.

set status [enable|disable]

set role [spoke|primary-hub|...]

set multipath [enable|disable]

set sdwan [enable|disable]

set sdwan-zone {string}

set wan-interface <name1>, <name2>, ...

set nat [enable|disable]

set ip-allocation-block {ipv4-classnet-any}

config overlays

Description: Network overlays to register with Overlay Controller VPN service.

edit <overlay-name>

set inter-overlay [allow|deny]

config subnets

Description: Internal subnets to register with OCVPN service.

edit <id>

set type [subnet|interface]

set subnet {ipv4-classnet-any}

set interface {string}

next

end

next

end

config forticlient-access

Description: Configure FortiClient settings.

set status [enable|disable]

set psksecret {password-3}

config auth-groups

Description: FortiClient user authentication groups.

edit <name>

set auth-group {string}

set overlays <overlay-name1>, <overlay-name2>, ...

next

end

end

set auto-discovery [enable|disable]

set auto-discovery-shortcut-mode [independent|dependent]

set poll-interval {integer}

set eap [enable|disable]

set eap-users {string}

end

config vpn ocvpn

Parameter

Description

Type

Size

Default

status

Enable/disable Overlay Controller cloud assisted VPN.

option

-

disable

Option

Description

enable

Enable Overlay Controller VPN.

disable

Disable Overlay Controller VPN.

role

Set device role.

option

-

spoke

Option

Description

spoke

Register device as static spoke.

primary-hub

Register device as primary hub.

secondary-hub

Register device as secondary hub.

multipath

Enable/disable multipath redundancy.

option

-

enable

Option

Description

enable

Enable multipath redundancy.

disable

Disable multipath redundancy.

sdwan

Enable/disable adding OCVPN tunnels to SD-WAN.

option

-

disable

Option

Description

enable

Enable adding OCVPN tunnels to SD-WAN.

disable

Disable adding OCVPN tunnels to SD-WAN.

sdwan-zone

Set SD-WAN zone.

string

Maximum length: 35

virtual-wan-link

wan-interface <name>

FortiGate WAN interfaces to use with OCVPN.

Interface name.

string

Maximum length: 79

nat

Enable/disable NAT support.

option

-

enable

Option

Description

enable

Enable NAT support.

disable

Disable NAT support.

ip-allocation-block

Class B subnet reserved for private IP address assignment.

ipv4-classnet-any

Not Specified

10.254.0.0 255.255.0.0

auto-discovery

Enable/disable auto-discovery shortcuts.

option

-

enable

Option

Description

enable

Enable ADVPN auto-discovery shortcuts.

disable

Disable ADVPN auto-discovery shortcuts.

auto-discovery-shortcut-mode

Control deletion of child short-cut tunnels when the parent tunnel goes down.

option

-

independent

Option

Description

independent

Short-cut tunnels remain up if the parent tunnel goes down.

dependent

Short-cut tunnels are brought down if the parent tunnel goes down.

poll-interval

Overlay Controller VPN polling interval.

integer

Minimum value: 30 Maximum value: 120

30

eap

Enable/disable EAP client authentication.

option

-

disable

Option

Description

enable

Enable EAP client authentication.

disable

Disable EAP client authentication.

eap-users

EAP authentication user group.

string

Maximum length: 35

config overlays

Parameter

Description

Type

Size

Default

inter-overlay

Allow or deny traffic from other overlays.

option

-

deny

Option

Description

allow

Allow traffic from other overlays.

deny

Deny traffic from other overlays.

config subnets

Parameter

Description

Type

Size

Default

type

Subnet type.

option

-

subnet

Option

Description

subnet

Configure participating subnet IP and mask.

interface

Configure participating LAN interface.

subnet

IPv4 address and subnet mask.

ipv4-classnet-any

Not Specified

0.0.0.0 0.0.0.0

interface

LAN interface.

string

Maximum length: 15

config forticlient-access

Parameter

Description

Type

Size

Default

status

Enable/disable FortiClient to access OCVPN networks.

option

-

disable

Option

Description

enable

Enable FortiClient access to OCVPN overlays.

disable

Disable FortiClient access to OCVPN overlays.

psksecret

Pre-shared secret for FortiClient PSK authentication (ASCII string or hexadecimal encoded with a leading 0x).

password-3

Not Specified

config auth-groups

Parameter

Description

Type

Size

Default

auth-group

Authentication user group for FortiClient access.

string

Maximum length: 35

overlays <overlay-name>

OCVPN overlays to allow access to.

Overlay name.

string

Maximum length: 79

config vpn ocvpn

Configure Overlay Controller VPN settings.

config vpn ocvpn

Description: Configure Overlay Controller VPN settings.

set status [enable|disable]

set role [spoke|primary-hub|...]

set multipath [enable|disable]

set sdwan [enable|disable]

set sdwan-zone {string}

set wan-interface <name1>, <name2>, ...

set nat [enable|disable]

set ip-allocation-block {ipv4-classnet-any}

config overlays

Description: Network overlays to register with Overlay Controller VPN service.

edit <overlay-name>

set inter-overlay [allow|deny]

config subnets

Description: Internal subnets to register with OCVPN service.

edit <id>

set type [subnet|interface]

set subnet {ipv4-classnet-any}

set interface {string}

next

end

next

end

config forticlient-access

Description: Configure FortiClient settings.

set status [enable|disable]

set psksecret {password-3}

config auth-groups

Description: FortiClient user authentication groups.

edit <name>

set auth-group {string}

set overlays <overlay-name1>, <overlay-name2>, ...

next

end

end

set auto-discovery [enable|disable]

set auto-discovery-shortcut-mode [independent|dependent]

set poll-interval {integer}

set eap [enable|disable]

set eap-users {string}

end

config vpn ocvpn

Parameter

Description

Type

Size

Default

status

Enable/disable Overlay Controller cloud assisted VPN.

option

-

disable

Option

Description

enable

Enable Overlay Controller VPN.

disable

Disable Overlay Controller VPN.

role

Set device role.

option

-

spoke

Option

Description

spoke

Register device as static spoke.

primary-hub

Register device as primary hub.

secondary-hub

Register device as secondary hub.

multipath

Enable/disable multipath redundancy.

option

-

enable

Option

Description

enable

Enable multipath redundancy.

disable

Disable multipath redundancy.

sdwan

Enable/disable adding OCVPN tunnels to SD-WAN.

option

-

disable

Option

Description

enable

Enable adding OCVPN tunnels to SD-WAN.

disable

Disable adding OCVPN tunnels to SD-WAN.

sdwan-zone

Set SD-WAN zone.

string

Maximum length: 35

virtual-wan-link

wan-interface <name>

FortiGate WAN interfaces to use with OCVPN.

Interface name.

string

Maximum length: 79

nat

Enable/disable NAT support.

option

-

enable

Option

Description

enable

Enable NAT support.

disable

Disable NAT support.

ip-allocation-block

Class B subnet reserved for private IP address assignment.

ipv4-classnet-any

Not Specified

10.254.0.0 255.255.0.0

auto-discovery

Enable/disable auto-discovery shortcuts.

option

-

enable

Option

Description

enable

Enable ADVPN auto-discovery shortcuts.

disable

Disable ADVPN auto-discovery shortcuts.

auto-discovery-shortcut-mode

Control deletion of child short-cut tunnels when the parent tunnel goes down.

option

-

independent

Option

Description

independent

Short-cut tunnels remain up if the parent tunnel goes down.

dependent

Short-cut tunnels are brought down if the parent tunnel goes down.

poll-interval

Overlay Controller VPN polling interval.

integer

Minimum value: 30 Maximum value: 120

30

eap

Enable/disable EAP client authentication.

option

-

disable

Option

Description

enable

Enable EAP client authentication.

disable

Disable EAP client authentication.

eap-users

EAP authentication user group.

string

Maximum length: 35

config overlays

Parameter

Description

Type

Size

Default

inter-overlay

Allow or deny traffic from other overlays.

option

-

deny

Option

Description

allow

Allow traffic from other overlays.

deny

Deny traffic from other overlays.

config subnets

Parameter

Description

Type

Size

Default

type

Subnet type.

option

-

subnet

Option

Description

subnet

Configure participating subnet IP and mask.

interface

Configure participating LAN interface.

subnet

IPv4 address and subnet mask.

ipv4-classnet-any

Not Specified

0.0.0.0 0.0.0.0

interface

LAN interface.

string

Maximum length: 15

config forticlient-access

Parameter

Description

Type

Size

Default

status

Enable/disable FortiClient to access OCVPN networks.

option

-

disable

Option

Description

enable

Enable FortiClient access to OCVPN overlays.

disable

Disable FortiClient access to OCVPN overlays.

psksecret

Pre-shared secret for FortiClient PSK authentication (ASCII string or hexadecimal encoded with a leading 0x).

password-3

Not Specified

config auth-groups

Parameter

Description

Type

Size

Default

auth-group

Authentication user group for FortiClient access.

string

Maximum length: 35

overlays <overlay-name>

OCVPN overlays to allow access to.

Overlay name.

string

Maximum length: 79