Fortinet black logo

CLI Reference

config vpn ssl web portal

config vpn ssl web portal

Portal.

config vpn ssl web portal
    Description: Portal.
    edit <name>
        set allow-user-access {option1}, {option2}, ...
        set auto-connect [enable|disable]
        config bookmark-group
            Description: Portal bookmark group.
            edit <name>
                config bookmarks
                    Description: Bookmark table.
                    edit <name>
                        set apptype [ftp|rdp|...]
                        set url {var-string}
                        set host {var-string}
                        set folder {var-string}
                        set domain {var-string}
                        set additional-params {var-string}
                        set description {var-string}
                        set keyboard-layout [ar-101|ar-102|...]
                        set security [any|rdp|...]
                        set send-preconnection-id [enable|disable]
                        set preconnection-id {integer}
                        set preconnection-blob {var-string}
                        set load-balancing-info {var-string}
                        set restricted-admin [enable|disable]
                        set port {integer}
                        set logon-user {var-string}
                        set logon-password {password}
                        set color-depth [32|16|...]
                        set sso [disable|static|...]
                        config form-data
                            Description: Form data.
                            edit <name>
                                set value {var-string}
                            next
                        end
                        set sso-credential [sslvpn-login|alternative]
                        set sso-username {var-string}
                        set sso-password {password}
                        set sso-credential-sent-once [enable|disable]
                        set width {integer}
                        set height {integer}
                        set vnc-keyboard-layout [default|da|...]
                    next
                end
            next
        end
        set client-src-range [enable|disable]
        set clipboard [enable|disable]
        set custom-lang {string}
        set customize-forticlient-download-url [enable|disable]
        set default-window-height {integer}
        set default-window-width {integer}
        set dhcp-ip-overlap [use-new|use-old]
        set dhcp-ra-giaddr {ipv4-address}
        set dhcp6-ra-linkaddr {ipv6-address}
        set display-bookmark [enable|disable]
        set display-connection-tools [enable|disable]
        set display-history [enable|disable]
        set display-status [enable|disable]
        set dns-server1 {ipv4-address}
        set dns-server2 {ipv4-address}
        set dns-suffix {var-string}
        set exclusive-routing [enable|disable]
        set forticlient-download [enable|disable]
        set forticlient-download-method [direct|ssl-vpn]
        set heading {string}
        set hide-sso-credential [enable|disable]
        set host-check [none|av|...]
        set host-check-interval {integer}
        set host-check-policy <name1>, <name2>, ...
        set ip-mode [range|user-group|...]
        set ip-pools <name1>, <name2>, ...
        set ipv6-dns-server1 {ipv6-address}
        set ipv6-dns-server2 {ipv6-address}
        set ipv6-exclusive-routing [enable|disable]
        set ipv6-pools <name1>, <name2>, ...
        set ipv6-service-restriction [enable|disable]
        set ipv6-split-tunneling [enable|disable]
        set ipv6-split-tunneling-routing-address <name1>, <name2>, ...
        set ipv6-split-tunneling-routing-negate [enable|disable]
        set ipv6-tunnel-mode [enable|disable]
        set ipv6-wins-server1 {ipv6-address}
        set ipv6-wins-server2 {ipv6-address}
        set keep-alive [enable|disable]
        config landing-page
            Description: Landing page options.
            set url {var-string}
            set logout-url {var-string}
            set sso [disable|static|...]
            config form-data
                Description: Form data.
                edit <name>
                    set value {var-string}
                next
            end
            set sso-credential [sslvpn-login|alternative]
            set sso-username {var-string}
            set sso-password {password}
        end
        set landing-page-mode [enable|disable]
        set limit-user-logins [enable|disable]
        set mac-addr-action [allow|deny]
        set mac-addr-check [enable|disable]
        config mac-addr-check-rule
            Description: Client MAC address check rule.
            edit <name>
                set mac-addr-mask {integer}
                set mac-addr-list <addr1>, <addr2>, ...
            next
        end
        set macos-forticlient-download-url {var-string}
        set os-check [enable|disable]
        config os-check-list
            Description: SSL-VPN OS checks.
            edit <name>
                set action [deny|allow|...]
                set tolerance {integer}
                set latest-patch-level {user}
            next
        end
        set prefer-ipv6-dns [enable|disable]
        set redir-url {var-string}
        set rewrite-ip-uri-ui [enable|disable]
        set save-password [enable|disable]
        set service-restriction [enable|disable]
        set skip-check-for-browser [enable|disable]
        set skip-check-for-unsupported-os [enable|disable]
        set smb-max-version [smbv1|smbv2|...]
        set smb-min-version [smbv1|smbv2|...]
        set smb-ntlmv1-auth [enable|disable]
        set smbv1 [enable|disable]
        config split-dns
            Description: Split DNS for SSL-VPN.
            edit <id>
                set domains {var-string}
                set dns-server1 {ipv4-address}
                set dns-server2 {ipv4-address}
                set ipv6-dns-server1 {ipv6-address}
                set ipv6-dns-server2 {ipv6-address}
            next
        end
        set split-tunneling [enable|disable]
        set split-tunneling-routing-address <name1>, <name2>, ...
        set split-tunneling-routing-negate [enable|disable]
        set theme [jade|neutrino|...]
        set tunnel-mode [enable|disable]
        set use-sdwan [enable|disable]
        set user-bookmark [enable|disable]
        set user-group-bookmark [enable|disable]
        set web-mode [enable|disable]
        set windows-forticlient-download-url {var-string}
        set wins-server1 {ipv4-address}
        set wins-server2 {ipv4-address}
    next
end

config vpn ssl web portal

Parameter

Description

Type

Size

Default

allow-user-access

Allow user access to SSL-VPN applications.

option

-

web ftp smb sftp telnet ssh vnc rdp ping

Option

Description

web

HTTP/HTTPS access.

ftp

FTP access.

smb

SMB/CIFS access.

sftp

SFTP access.

telnet

TELNET access.

ssh

SSH access.

vnc

VNC access.

rdp

RDP access.

ping

PING access.

auto-connect

Enable/disable automatic connect by client when system is up.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

client-src-range

Allow client to add source range for the tunnel traffic.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

clipboard

Enable to support RDP/VPC clipboard functionality.

option

-

enable

Option

Description

enable

Enable support of RDP/VNC clipboard.

disable

Disable support of RDP/VNC clipboard.

custom-lang

Change the web portal display language. Overrides config system global set language. You can use config system custom-language and execute system custom-language to add custom language files.

string

Maximum length: 35

customize-forticlient-download-url

Enable support of customized download URL for FortiClient.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

default-window-height

Screen height.

integer

Minimum value: 0 Maximum value: 65535

768

default-window-width

Screen width.

integer

Minimum value: 0 Maximum value: 65535

1024

dhcp-ip-overlap

Configure overlapping DHCP IP allocation assignment.

option

-

use-new

Option

Description

use-new

Assign DHCP lease to new client and remove old client lease.

use-old

Preserve previous client IP allocation and disconnect new client.

dhcp-ra-giaddr

Relay agent gateway IP address to use in the giaddr field of DHCP requests.

ipv4-address

Not Specified

0.0.0.0

dhcp6-ra-linkaddr

Relay agent IPv6 link address to use in DHCP6 requests.

ipv6-address

Not Specified

::

display-bookmark

Enable to display the web portal bookmark widget.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

display-connection-tools

Enable to display the web portal connection tools widget.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

display-history

Enable to display the web portal user login history widget.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

display-status

Enable to display the web portal status widget.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

dns-server1

IPv4 DNS server 1.

ipv4-address

Not Specified

0.0.0.0

dns-server2

IPv4 DNS server 2.

ipv4-address

Not Specified

0.0.0.0

dns-suffix

DNS suffix.

var-string

Maximum length: 253

exclusive-routing

Enable/disable all traffic go through tunnel only.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

forticlient-download

Enable/disable download option for FortiClient.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

forticlient-download-method

FortiClient download method.

option

-

direct

Option

Description

direct

Download via direct link.

ssl-vpn

Download via SSL-VPN.

heading

Web portal heading message.

string

Maximum length: 31

SSL-VPN Portal

hide-sso-credential

Enable to prevent SSO credential being sent to client.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

host-check

Type of host checking performed on endpoints.

option

-

none

Option

Description

none

No host checking.

av

AntiVirus software recognized by the Windows Security Center.

fw

Firewall software recognized by the Windows Security Center.

av-fw

AntiVirus and firewall software recognized by the Windows Security Center.

custom

Custom.

host-check-interval

Periodic host check interval. Value of 0 means disabled and host checking only happens when the endpoint connects.

integer

Minimum value: 120 Maximum value: 259200

0

host-check-policy <name>

One or more policies to require the endpoint to have specific security software.

Host check software list name.

string

Maximum length: 79

ip-mode

Method by which users of this SSL-VPN tunnel obtain IP addresses.

option

-

range

Option

Description

range

Use the IP addresses available for all SSL-VPN users as defined by the SSL settings command.

user-group

Use the IP addresses associated with individual users or user groups (usually from external auth servers).

dhcp

Use IP addresses obtained from external DHCP server.

no-ip

Do not assign IP address.

ip-pools <name>

IPv4 firewall source address objects reserved for SSL-VPN tunnel mode clients.

Address name.

string

Maximum length: 79

ipv6-dns-server1

IPv6 DNS server 1.

ipv6-address

Not Specified

::

ipv6-dns-server2

IPv6 DNS server 2.

ipv6-address

Not Specified

::

ipv6-exclusive-routing

Enable/disable all IPv6 traffic go through tunnel only.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

ipv6-pools <name>

IPv6 firewall source address objects reserved for SSL-VPN tunnel mode clients.

Address name.

string

Maximum length: 79

ipv6-service-restriction

Enable/disable IPv6 tunnel service restriction.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

ipv6-split-tunneling

Enable/disable IPv6 split tunneling.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

ipv6-split-tunneling-routing-address <name>

IPv6 SSL-VPN tunnel mode firewall address objects that override firewall policy destination addresses to control split-tunneling access.

Address name.

string

Maximum length: 79

ipv6-split-tunneling-routing-negate

Enable to negate IPv6 split tunneling routing address.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

ipv6-tunnel-mode

Enable/disable IPv6 SSL-VPN tunnel mode.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

ipv6-wins-server1

IPv6 WINS server 1.

ipv6-address

Not Specified

::

ipv6-wins-server2

IPv6 WINS server 2.

ipv6-address

Not Specified

::

keep-alive

Enable/disable automatic reconnect for FortiClient connections.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

landing-page-mode

Enable/disable SSL-VPN landing page mode.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

limit-user-logins

Enable to limit each user to one SSL-VPN session at a time.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

mac-addr-action

Client MAC address action.

option

-

allow

Option

Description

allow

Allow connection when client MAC address is matched.

deny

Deny connection when client MAC address is matched.

mac-addr-check

Enable/disable MAC address host checking.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

macos-forticlient-download-url

Download URL for Mac FortiClient.

var-string

Maximum length: 1023

name

Portal name.

string

Maximum length: 35

os-check

Enable to let the FortiGate decide action based on client OS.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

prefer-ipv6-dns

Prefer to query IPv6 DNS server first if enabled.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

redir-url

Client login redirect URL.

var-string

Maximum length: 255

rewrite-ip-uri-ui

Rewrite contents for URI contains IP and /ui/.

option

-

disable

Option

Description

enable

Enable contents rewrite for URI contains "IP-address/ui/".

disable

Disable contents rewrite for URI contains "IP-address/ui/".

save-password

Enable/disable FortiClient saving the user's password.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

service-restriction

Enable/disable tunnel service restriction.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

skip-check-for-browser

Enable to skip host check for browser support.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

skip-check-for-unsupported-os

Enable to skip host check if client OS does not support it.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

smb-max-version

SMB maximum client protocol version.

option

-

smbv3

Option

Description

smbv1

SMB version 1.

smbv2

SMB version 2.

smbv3

SMB version 3.

smb-min-version

SMB minimum client protocol version.

option

-

smbv2

Option

Description

smbv1

SMB version 1.

smbv2

SMB version 2.

smbv3

SMB version 3.

smb-ntlmv1-auth

Enable support of NTLMv1 for Samba authentication.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

smbv1

SMB version 1.

option

-

disable

Option

Description

enable

enable

disable

disable

split-tunneling

Enable/disable IPv4 split tunneling.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

split-tunneling-routing-address <name>

IPv4 SSL-VPN tunnel mode firewall address objects that override firewall policy destination addresses to control split-tunneling access.

Address name.

string

Maximum length: 79

split-tunneling-routing-negate

Enable to negate split tunneling routing address.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

theme

Web portal color scheme.

option

-

security-fabric

Option

Description

jade

Jade theme.

neutrino

Neutrino theme.

mariner

Mariner theme.

graphite

Graphite theme.

melongene

Melongene theme.

jet-stream

Jet Stream theme.

security-fabric

Security Fabric theme.

dark-matter

Dark Matter theme.

onyx

Onyx theme.

eclipse

Eclipse theme.

tunnel-mode

Enable/disable IPv4 SSL-VPN tunnel mode.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

use-sdwan

Use SD-WAN rules to get output interface.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

user-bookmark

Enable to allow web portal users to create their own bookmarks.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

user-group-bookmark

Enable to allow web portal users to create bookmarks for all users in the same user group.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

web-mode

Enable/disable SSL-VPN web mode.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

windows-forticlient-download-url

Download URL for Windows FortiClient.

var-string

Maximum length: 1023

wins-server1

IPv4 WINS server 1.

ipv4-address

Not Specified

0.0.0.0

wins-server2

IPv4 WINS server 1.

ipv4-address

Not Specified

0.0.0.0

config bookmark-group

Parameter

Description

Type

Size

Default

name

Bookmark group name.

string

Maximum length: 35

config bookmarks

Parameter

Description

Type

Size

Default

name

Bookmark name.

string

Maximum length: 35

apptype

Application type.

option

-

web

Option

Description

ftp

FTP.

rdp

RDP.

sftp

SFTP.

smb

SMB/CIFS.

ssh

SSH.

telnet

Telnet.

vnc

VNC.

web

HTTP/HTTPS.

url

URL parameter.

var-string

Maximum length: 128

host

Host name/IP parameter.

var-string

Maximum length: 128

folder

Network shared file folder parameter.

var-string

Maximum length: 128

domain

Login domain.

var-string

Maximum length: 128

additional-params

Additional parameters.

var-string

Maximum length: 128

description

Description.

var-string

Maximum length: 128

keyboard-layout

Keyboard layout.

option

-

en-us

Option

Description

ar-101

Arabic (101).

ar-102

Arabic (102).

ar-102-azerty

Arabic (102) AZERTY.

can-mul

Canadian Multilingual Standard.

cz

Czech.

cz-qwerty

Czech (QWERTY).

cz-pr

Czech Programmers.

da

Danish.

nl

Dutch.

de

German.

de-ch

German, Switzerland.

de-ibm

German (IBM).

en-uk

English, United Kingdom.

en-uk-ext

English, United Kingdom Extended.

en-us

English, United States.

en-us-dvorak

English, United States-Dvorak.

es

Spanish.

es-var

Spanish Variation.

fi

Finnish.

fi-sami

Finnish with Sami.

fr

French.

fr-apple

French, Apple.

fr-ca

French, Canada.

fr-ch

French, Switzerland.

fr-be

French, Belgium.

hr

Croatian.

hu

Hungarian.

hu-101

Hungarian 101-Key.

it

Italian.

it-142

Italian (142).

ja

Japanese.

ko

Korean.

lt

Lithuanian.

lt-ibm

Lithuanian IBM.

lt-std

Lithuanian Standard.

lav-std

Latvian (Standard).

lav-leg

Latvian (Legacy).

mk

Macedonian (FYROM).

mk-std

Macedonia (FYROM) - Standard.

no

Norwegian.

no-sami

Norwegian with Sami.

pol-214

Polish (214).

pol-pr

Polish (Programmers).

pt

Portuguese.

pt-br

Portuguese (Brazilian ABNT).

pt-br-abnt2

Portuguese (Brazilian ABNT2).

ru

Russian.

ru-mne

Russian - Mnemonic.

ru-t

Russian (Typewriter).

sl

Slovenian.

sv

Swedish.

sv-sami

Swedish with Sami.

tuk

Turkmen.

tur-f

Turkish F.

tur-q

Turkish Q.

zh-sym-sg-us

Chinese (Simplified, Singapore) - US keyboard.

zh-sym-us

Chinese (Simplified) - US Keyboard.

zh-tr-hk

Chinese (Traditional, Hong Kong S.A.R.).

zh-tr-mo

Chinese (Traditional Macao S.A.R.) - US Keyboard.

zh-tr-us

Chinese (Traditional) - US keyboard.

security

Security mode for RDP connection.

option

-

rdp

Option

Description

any

Allow the server to choose the type of security.

rdp

Standard RDP encryption.

nla

Network Level Authentication.

tls

TLS encryption.

send-preconnection-id

Enable/disable sending of preconnection ID.

option

-

disable

Option

Description

enable

Enable sending of preconnection ID.

disable

Disable sending of preconnection ID.

preconnection-id

The numeric ID of the RDP source.

integer

Minimum value: 0 Maximum value: 4294967295

0

preconnection-blob

An arbitrary string which identifies the RDP source.

var-string

Maximum length: 511

load-balancing-info

The load balancing information or cookie which should be provided to the connection broker.

var-string

Maximum length: 511

restricted-admin

Enable/disable restricted admin mode for RDP.

option

-

disable

Option

Description

enable

Enable restricted admin mode for RDP.

disable

Disable restricted admin mode for RDP.

port

Remote port.

integer

Minimum value: 0 Maximum value: 65535

0

logon-user

Logon user.

var-string

Maximum length: 35

logon-password

Logon password.

password

Not Specified

color-depth

Color depth per pixel.

option

-

16

Option

Description

32

32bits per pixel.

16

16bits per pixel.

8

8bits per pixel.

sso

Single sign-on.

option

-

disable

Option

Description

disable

Disable SSO.

static

Static SSO.

auto

Auto SSO.

sso-credential

Single sign-on credentials.

option

-

sslvpn-login

Option

Description

sslvpn-login

SSL-VPN login.

alternative

Alternative.

sso-username

SSO user name.

var-string

Maximum length: 35

sso-password

SSO password.

password

Not Specified

sso-credential-sent-once

Single sign-on credentials are only sent once to remote server.

option

-

disable

Option

Description

enable

Single sign-on credentials are only sent once to remote server.

disable

Single sign-on credentials are sent to remote server for every HTTP request.

width

Screen width.

integer

Minimum value: 0 Maximum value: 65535

0

height

Screen height.

integer

Minimum value: 0 Maximum value: 65535

0

vnc-keyboard-layout

Keyboard layout.

option

-

default

Option

Description

default

Default.

da

Danish.

nl

Dutch.

en-uk

English, United Kingdom.

en-uk-ext

English, United Kingdom Extended.

fi

Finnish.

fr

French.

fr-be

French, Belgium.

fr-ca-mul

French, Canadian Multilingual Std.

de

German.

de-ch

German, Switzerland.

it

Italian.

it-142

Italian (142).

pt

Portuguese.

pt-br-abnt2

Portuguese (Brazilian ABNT2).

no

Norwegian.

gd

Scottish Gaelic.

es

Spanish.

sv

Swedish.

us-intl

United States-International.

config form-data

Parameter

Description

Type

Size

Default

name

Name.

string

Maximum length: 35

value

Value.

var-string

Maximum length: 63

config form-data

Parameter

Description

Type

Size

Default

name

Name.

string

Maximum length: 35

value

Value.

var-string

Maximum length: 63

config landing-page

Parameter

Description

Type

Size

Default

url

Landing page URL.

var-string

Maximum length: 511

logout-url

Landing page log out URL.

var-string

Maximum length: 511

sso

Single sign-on.

option

-

disable

Option

Description

disable

Disable SSO.

static

Static SSO.

auto

Auto SSO.

sso-credential

Single sign-on credentials.

option

-

sslvpn-login

Option

Description

sslvpn-login

SSL-VPN login.

alternative

Alternative.

sso-username

SSO user name.

var-string

Maximum length: 35

sso-password

SSO password.

password

Not Specified

config form-data

Parameter

Description

Type

Size

Default

name

Name.

string

Maximum length: 35

value

Value.

var-string

Maximum length: 63

config form-data

Parameter

Description

Type

Size

Default

name

Name.

string

Maximum length: 35

value

Value.

var-string

Maximum length: 63

config mac-addr-check-rule

Parameter

Description

Type

Size

Default

name

Client MAC address check rule name.

string

Maximum length: 35

mac-addr-mask

Client MAC address mask.

integer

Minimum value: 1 Maximum value: 48

48

mac-addr-list <addr>

Client MAC address list.

Client MAC address.

mac-address

Not Specified

config os-check-list

Parameter

Description

Type

Size

Default

name

Name.

string

Maximum length: 35

action

OS check options.

option

-

allow

Option

Description

deny

Deny all OS versions.

allow

Allow any OS version.

check-up-to-date

Verify OS is up-to-date.

tolerance

OS patch level tolerance.

integer

Minimum value: 0 Maximum value: 65535

0

latest-patch-level

Latest OS patch level.

user

Not Specified

0

config split-dns

Parameter

Description

Type

Size

Default

id

ID.

integer

Minimum value: 0 Maximum value: 4294967294

0

domains

Split DNS domains used for SSL-VPN clients separated by comma.

var-string

Maximum length: 1024

dns-server1

DNS server 1.

ipv4-address

Not Specified

0.0.0.0

dns-server2

DNS server 2.

ipv4-address

Not Specified

0.0.0.0

ipv6-dns-server1

IPv6 DNS server 1.

ipv6-address

Not Specified

::

ipv6-dns-server2

IPv6 DNS server 2.

ipv6-address

Not Specified

::

config vpn ssl web portal

Portal.

config vpn ssl web portal
    Description: Portal.
    edit <name>
        set allow-user-access {option1}, {option2}, ...
        set auto-connect [enable|disable]
        config bookmark-group
            Description: Portal bookmark group.
            edit <name>
                config bookmarks
                    Description: Bookmark table.
                    edit <name>
                        set apptype [ftp|rdp|...]
                        set url {var-string}
                        set host {var-string}
                        set folder {var-string}
                        set domain {var-string}
                        set additional-params {var-string}
                        set description {var-string}
                        set keyboard-layout [ar-101|ar-102|...]
                        set security [any|rdp|...]
                        set send-preconnection-id [enable|disable]
                        set preconnection-id {integer}
                        set preconnection-blob {var-string}
                        set load-balancing-info {var-string}
                        set restricted-admin [enable|disable]
                        set port {integer}
                        set logon-user {var-string}
                        set logon-password {password}
                        set color-depth [32|16|...]
                        set sso [disable|static|...]
                        config form-data
                            Description: Form data.
                            edit <name>
                                set value {var-string}
                            next
                        end
                        set sso-credential [sslvpn-login|alternative]
                        set sso-username {var-string}
                        set sso-password {password}
                        set sso-credential-sent-once [enable|disable]
                        set width {integer}
                        set height {integer}
                        set vnc-keyboard-layout [default|da|...]
                    next
                end
            next
        end
        set client-src-range [enable|disable]
        set clipboard [enable|disable]
        set custom-lang {string}
        set customize-forticlient-download-url [enable|disable]
        set default-window-height {integer}
        set default-window-width {integer}
        set dhcp-ip-overlap [use-new|use-old]
        set dhcp-ra-giaddr {ipv4-address}
        set dhcp6-ra-linkaddr {ipv6-address}
        set display-bookmark [enable|disable]
        set display-connection-tools [enable|disable]
        set display-history [enable|disable]
        set display-status [enable|disable]
        set dns-server1 {ipv4-address}
        set dns-server2 {ipv4-address}
        set dns-suffix {var-string}
        set exclusive-routing [enable|disable]
        set forticlient-download [enable|disable]
        set forticlient-download-method [direct|ssl-vpn]
        set heading {string}
        set hide-sso-credential [enable|disable]
        set host-check [none|av|...]
        set host-check-interval {integer}
        set host-check-policy <name1>, <name2>, ...
        set ip-mode [range|user-group|...]
        set ip-pools <name1>, <name2>, ...
        set ipv6-dns-server1 {ipv6-address}
        set ipv6-dns-server2 {ipv6-address}
        set ipv6-exclusive-routing [enable|disable]
        set ipv6-pools <name1>, <name2>, ...
        set ipv6-service-restriction [enable|disable]
        set ipv6-split-tunneling [enable|disable]
        set ipv6-split-tunneling-routing-address <name1>, <name2>, ...
        set ipv6-split-tunneling-routing-negate [enable|disable]
        set ipv6-tunnel-mode [enable|disable]
        set ipv6-wins-server1 {ipv6-address}
        set ipv6-wins-server2 {ipv6-address}
        set keep-alive [enable|disable]
        config landing-page
            Description: Landing page options.
            set url {var-string}
            set logout-url {var-string}
            set sso [disable|static|...]
            config form-data
                Description: Form data.
                edit <name>
                    set value {var-string}
                next
            end
            set sso-credential [sslvpn-login|alternative]
            set sso-username {var-string}
            set sso-password {password}
        end
        set landing-page-mode [enable|disable]
        set limit-user-logins [enable|disable]
        set mac-addr-action [allow|deny]
        set mac-addr-check [enable|disable]
        config mac-addr-check-rule
            Description: Client MAC address check rule.
            edit <name>
                set mac-addr-mask {integer}
                set mac-addr-list <addr1>, <addr2>, ...
            next
        end
        set macos-forticlient-download-url {var-string}
        set os-check [enable|disable]
        config os-check-list
            Description: SSL-VPN OS checks.
            edit <name>
                set action [deny|allow|...]
                set tolerance {integer}
                set latest-patch-level {user}
            next
        end
        set prefer-ipv6-dns [enable|disable]
        set redir-url {var-string}
        set rewrite-ip-uri-ui [enable|disable]
        set save-password [enable|disable]
        set service-restriction [enable|disable]
        set skip-check-for-browser [enable|disable]
        set skip-check-for-unsupported-os [enable|disable]
        set smb-max-version [smbv1|smbv2|...]
        set smb-min-version [smbv1|smbv2|...]
        set smb-ntlmv1-auth [enable|disable]
        set smbv1 [enable|disable]
        config split-dns
            Description: Split DNS for SSL-VPN.
            edit <id>
                set domains {var-string}
                set dns-server1 {ipv4-address}
                set dns-server2 {ipv4-address}
                set ipv6-dns-server1 {ipv6-address}
                set ipv6-dns-server2 {ipv6-address}
            next
        end
        set split-tunneling [enable|disable]
        set split-tunneling-routing-address <name1>, <name2>, ...
        set split-tunneling-routing-negate [enable|disable]
        set theme [jade|neutrino|...]
        set tunnel-mode [enable|disable]
        set use-sdwan [enable|disable]
        set user-bookmark [enable|disable]
        set user-group-bookmark [enable|disable]
        set web-mode [enable|disable]
        set windows-forticlient-download-url {var-string}
        set wins-server1 {ipv4-address}
        set wins-server2 {ipv4-address}
    next
end

config vpn ssl web portal

Parameter

Description

Type

Size

Default

allow-user-access

Allow user access to SSL-VPN applications.

option

-

web ftp smb sftp telnet ssh vnc rdp ping

Option

Description

web

HTTP/HTTPS access.

ftp

FTP access.

smb

SMB/CIFS access.

sftp

SFTP access.

telnet

TELNET access.

ssh

SSH access.

vnc

VNC access.

rdp

RDP access.

ping

PING access.

auto-connect

Enable/disable automatic connect by client when system is up.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

client-src-range

Allow client to add source range for the tunnel traffic.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

clipboard

Enable to support RDP/VPC clipboard functionality.

option

-

enable

Option

Description

enable

Enable support of RDP/VNC clipboard.

disable

Disable support of RDP/VNC clipboard.

custom-lang

Change the web portal display language. Overrides config system global set language. You can use config system custom-language and execute system custom-language to add custom language files.

string

Maximum length: 35

customize-forticlient-download-url

Enable support of customized download URL for FortiClient.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

default-window-height

Screen height.

integer

Minimum value: 0 Maximum value: 65535

768

default-window-width

Screen width.

integer

Minimum value: 0 Maximum value: 65535

1024

dhcp-ip-overlap

Configure overlapping DHCP IP allocation assignment.

option

-

use-new

Option

Description

use-new

Assign DHCP lease to new client and remove old client lease.

use-old

Preserve previous client IP allocation and disconnect new client.

dhcp-ra-giaddr

Relay agent gateway IP address to use in the giaddr field of DHCP requests.

ipv4-address

Not Specified

0.0.0.0

dhcp6-ra-linkaddr

Relay agent IPv6 link address to use in DHCP6 requests.

ipv6-address

Not Specified

::

display-bookmark

Enable to display the web portal bookmark widget.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

display-connection-tools

Enable to display the web portal connection tools widget.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

display-history

Enable to display the web portal user login history widget.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

display-status

Enable to display the web portal status widget.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

dns-server1

IPv4 DNS server 1.

ipv4-address

Not Specified

0.0.0.0

dns-server2

IPv4 DNS server 2.

ipv4-address

Not Specified

0.0.0.0

dns-suffix

DNS suffix.

var-string

Maximum length: 253

exclusive-routing

Enable/disable all traffic go through tunnel only.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

forticlient-download

Enable/disable download option for FortiClient.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

forticlient-download-method

FortiClient download method.

option

-

direct

Option

Description

direct

Download via direct link.

ssl-vpn

Download via SSL-VPN.

heading

Web portal heading message.

string

Maximum length: 31

SSL-VPN Portal

hide-sso-credential

Enable to prevent SSO credential being sent to client.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

host-check

Type of host checking performed on endpoints.

option

-

none

Option

Description

none

No host checking.

av

AntiVirus software recognized by the Windows Security Center.

fw

Firewall software recognized by the Windows Security Center.

av-fw

AntiVirus and firewall software recognized by the Windows Security Center.

custom

Custom.

host-check-interval

Periodic host check interval. Value of 0 means disabled and host checking only happens when the endpoint connects.

integer

Minimum value: 120 Maximum value: 259200

0

host-check-policy <name>

One or more policies to require the endpoint to have specific security software.

Host check software list name.

string

Maximum length: 79

ip-mode

Method by which users of this SSL-VPN tunnel obtain IP addresses.

option

-

range

Option

Description

range

Use the IP addresses available for all SSL-VPN users as defined by the SSL settings command.

user-group

Use the IP addresses associated with individual users or user groups (usually from external auth servers).

dhcp

Use IP addresses obtained from external DHCP server.

no-ip

Do not assign IP address.

ip-pools <name>

IPv4 firewall source address objects reserved for SSL-VPN tunnel mode clients.

Address name.

string

Maximum length: 79

ipv6-dns-server1

IPv6 DNS server 1.

ipv6-address

Not Specified

::

ipv6-dns-server2

IPv6 DNS server 2.

ipv6-address

Not Specified

::

ipv6-exclusive-routing

Enable/disable all IPv6 traffic go through tunnel only.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

ipv6-pools <name>

IPv6 firewall source address objects reserved for SSL-VPN tunnel mode clients.

Address name.

string

Maximum length: 79

ipv6-service-restriction

Enable/disable IPv6 tunnel service restriction.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

ipv6-split-tunneling

Enable/disable IPv6 split tunneling.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

ipv6-split-tunneling-routing-address <name>

IPv6 SSL-VPN tunnel mode firewall address objects that override firewall policy destination addresses to control split-tunneling access.

Address name.

string

Maximum length: 79

ipv6-split-tunneling-routing-negate

Enable to negate IPv6 split tunneling routing address.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

ipv6-tunnel-mode

Enable/disable IPv6 SSL-VPN tunnel mode.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

ipv6-wins-server1

IPv6 WINS server 1.

ipv6-address

Not Specified

::

ipv6-wins-server2

IPv6 WINS server 2.

ipv6-address

Not Specified

::

keep-alive

Enable/disable automatic reconnect for FortiClient connections.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

landing-page-mode

Enable/disable SSL-VPN landing page mode.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

limit-user-logins

Enable to limit each user to one SSL-VPN session at a time.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

mac-addr-action

Client MAC address action.

option

-

allow

Option

Description

allow

Allow connection when client MAC address is matched.

deny

Deny connection when client MAC address is matched.

mac-addr-check

Enable/disable MAC address host checking.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

macos-forticlient-download-url

Download URL for Mac FortiClient.

var-string

Maximum length: 1023

name

Portal name.

string

Maximum length: 35

os-check

Enable to let the FortiGate decide action based on client OS.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

prefer-ipv6-dns

Prefer to query IPv6 DNS server first if enabled.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

redir-url

Client login redirect URL.

var-string

Maximum length: 255

rewrite-ip-uri-ui

Rewrite contents for URI contains IP and /ui/.

option

-

disable

Option

Description

enable

Enable contents rewrite for URI contains "IP-address/ui/".

disable

Disable contents rewrite for URI contains "IP-address/ui/".

save-password

Enable/disable FortiClient saving the user's password.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

service-restriction

Enable/disable tunnel service restriction.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

skip-check-for-browser

Enable to skip host check for browser support.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

skip-check-for-unsupported-os

Enable to skip host check if client OS does not support it.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

smb-max-version

SMB maximum client protocol version.

option

-

smbv3

Option

Description

smbv1

SMB version 1.

smbv2

SMB version 2.

smbv3

SMB version 3.

smb-min-version

SMB minimum client protocol version.

option

-

smbv2

Option

Description

smbv1

SMB version 1.

smbv2

SMB version 2.

smbv3

SMB version 3.

smb-ntlmv1-auth

Enable support of NTLMv1 for Samba authentication.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

smbv1

SMB version 1.

option

-

disable

Option

Description

enable

enable

disable

disable

split-tunneling

Enable/disable IPv4 split tunneling.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

split-tunneling-routing-address <name>

IPv4 SSL-VPN tunnel mode firewall address objects that override firewall policy destination addresses to control split-tunneling access.

Address name.

string

Maximum length: 79

split-tunneling-routing-negate

Enable to negate split tunneling routing address.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

theme

Web portal color scheme.

option

-

security-fabric

Option

Description

jade

Jade theme.

neutrino

Neutrino theme.

mariner

Mariner theme.

graphite

Graphite theme.

melongene

Melongene theme.

jet-stream

Jet Stream theme.

security-fabric

Security Fabric theme.

dark-matter

Dark Matter theme.

onyx

Onyx theme.

eclipse

Eclipse theme.

tunnel-mode

Enable/disable IPv4 SSL-VPN tunnel mode.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

use-sdwan

Use SD-WAN rules to get output interface.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

user-bookmark

Enable to allow web portal users to create their own bookmarks.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

user-group-bookmark

Enable to allow web portal users to create bookmarks for all users in the same user group.

option

-

enable

Option

Description

enable

Enable setting.

disable

Disable setting.

web-mode

Enable/disable SSL-VPN web mode.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

windows-forticlient-download-url

Download URL for Windows FortiClient.

var-string

Maximum length: 1023

wins-server1

IPv4 WINS server 1.

ipv4-address

Not Specified

0.0.0.0

wins-server2

IPv4 WINS server 1.

ipv4-address

Not Specified

0.0.0.0

config bookmark-group

Parameter

Description

Type

Size

Default

name

Bookmark group name.

string

Maximum length: 35

config bookmarks

Parameter

Description

Type

Size

Default

name

Bookmark name.

string

Maximum length: 35

apptype

Application type.

option

-

web

Option

Description

ftp

FTP.

rdp

RDP.

sftp

SFTP.

smb

SMB/CIFS.

ssh

SSH.

telnet

Telnet.

vnc

VNC.

web

HTTP/HTTPS.

url

URL parameter.

var-string

Maximum length: 128

host

Host name/IP parameter.

var-string

Maximum length: 128

folder

Network shared file folder parameter.

var-string

Maximum length: 128

domain

Login domain.

var-string

Maximum length: 128

additional-params

Additional parameters.

var-string

Maximum length: 128

description

Description.

var-string

Maximum length: 128

keyboard-layout

Keyboard layout.

option

-

en-us

Option

Description

ar-101

Arabic (101).

ar-102

Arabic (102).

ar-102-azerty

Arabic (102) AZERTY.

can-mul

Canadian Multilingual Standard.

cz

Czech.

cz-qwerty

Czech (QWERTY).

cz-pr

Czech Programmers.

da

Danish.

nl

Dutch.

de

German.

de-ch

German, Switzerland.

de-ibm

German (IBM).

en-uk

English, United Kingdom.

en-uk-ext

English, United Kingdom Extended.

en-us

English, United States.

en-us-dvorak

English, United States-Dvorak.

es

Spanish.

es-var

Spanish Variation.

fi

Finnish.

fi-sami

Finnish with Sami.

fr

French.

fr-apple

French, Apple.

fr-ca

French, Canada.

fr-ch

French, Switzerland.

fr-be

French, Belgium.

hr

Croatian.

hu

Hungarian.

hu-101

Hungarian 101-Key.

it

Italian.

it-142

Italian (142).

ja

Japanese.

ko

Korean.

lt

Lithuanian.

lt-ibm

Lithuanian IBM.

lt-std

Lithuanian Standard.

lav-std

Latvian (Standard).

lav-leg

Latvian (Legacy).

mk

Macedonian (FYROM).

mk-std

Macedonia (FYROM) - Standard.

no

Norwegian.

no-sami

Norwegian with Sami.

pol-214

Polish (214).

pol-pr

Polish (Programmers).

pt

Portuguese.

pt-br

Portuguese (Brazilian ABNT).

pt-br-abnt2

Portuguese (Brazilian ABNT2).

ru

Russian.

ru-mne

Russian - Mnemonic.

ru-t

Russian (Typewriter).

sl

Slovenian.

sv

Swedish.

sv-sami

Swedish with Sami.

tuk

Turkmen.

tur-f

Turkish F.

tur-q

Turkish Q.

zh-sym-sg-us

Chinese (Simplified, Singapore) - US keyboard.

zh-sym-us

Chinese (Simplified) - US Keyboard.

zh-tr-hk

Chinese (Traditional, Hong Kong S.A.R.).

zh-tr-mo

Chinese (Traditional Macao S.A.R.) - US Keyboard.

zh-tr-us

Chinese (Traditional) - US keyboard.

security

Security mode for RDP connection.

option

-

rdp

Option

Description

any

Allow the server to choose the type of security.

rdp

Standard RDP encryption.

nla

Network Level Authentication.

tls

TLS encryption.

send-preconnection-id

Enable/disable sending of preconnection ID.

option

-

disable

Option

Description

enable

Enable sending of preconnection ID.

disable

Disable sending of preconnection ID.

preconnection-id

The numeric ID of the RDP source.

integer

Minimum value: 0 Maximum value: 4294967295

0

preconnection-blob

An arbitrary string which identifies the RDP source.

var-string

Maximum length: 511

load-balancing-info

The load balancing information or cookie which should be provided to the connection broker.

var-string

Maximum length: 511

restricted-admin

Enable/disable restricted admin mode for RDP.

option

-

disable

Option

Description

enable

Enable restricted admin mode for RDP.

disable

Disable restricted admin mode for RDP.

port

Remote port.

integer

Minimum value: 0 Maximum value: 65535

0

logon-user

Logon user.

var-string

Maximum length: 35

logon-password

Logon password.

password

Not Specified

color-depth

Color depth per pixel.

option

-

16

Option

Description

32

32bits per pixel.

16

16bits per pixel.

8

8bits per pixel.

sso

Single sign-on.

option

-

disable

Option

Description

disable

Disable SSO.

static

Static SSO.

auto

Auto SSO.

sso-credential

Single sign-on credentials.

option

-

sslvpn-login

Option

Description

sslvpn-login

SSL-VPN login.

alternative

Alternative.

sso-username

SSO user name.

var-string

Maximum length: 35

sso-password

SSO password.

password

Not Specified

sso-credential-sent-once

Single sign-on credentials are only sent once to remote server.

option

-

disable

Option

Description

enable

Single sign-on credentials are only sent once to remote server.

disable

Single sign-on credentials are sent to remote server for every HTTP request.

width

Screen width.

integer

Minimum value: 0 Maximum value: 65535

0

height

Screen height.

integer

Minimum value: 0 Maximum value: 65535

0

vnc-keyboard-layout

Keyboard layout.

option

-

default

Option

Description

default

Default.

da

Danish.

nl

Dutch.

en-uk

English, United Kingdom.

en-uk-ext

English, United Kingdom Extended.

fi

Finnish.

fr

French.

fr-be

French, Belgium.

fr-ca-mul

French, Canadian Multilingual Std.

de

German.

de-ch

German, Switzerland.

it

Italian.

it-142

Italian (142).

pt

Portuguese.

pt-br-abnt2

Portuguese (Brazilian ABNT2).

no

Norwegian.

gd

Scottish Gaelic.

es

Spanish.

sv

Swedish.

us-intl

United States-International.

config form-data

Parameter

Description

Type

Size

Default

name

Name.

string

Maximum length: 35

value

Value.

var-string

Maximum length: 63

config form-data

Parameter

Description

Type

Size

Default

name

Name.

string

Maximum length: 35

value

Value.

var-string

Maximum length: 63

config landing-page

Parameter

Description

Type

Size

Default

url

Landing page URL.

var-string

Maximum length: 511

logout-url

Landing page log out URL.

var-string

Maximum length: 511

sso

Single sign-on.

option

-

disable

Option

Description

disable

Disable SSO.

static

Static SSO.

auto

Auto SSO.

sso-credential

Single sign-on credentials.

option

-

sslvpn-login

Option

Description

sslvpn-login

SSL-VPN login.

alternative

Alternative.

sso-username

SSO user name.

var-string

Maximum length: 35

sso-password

SSO password.

password

Not Specified

config form-data

Parameter

Description

Type

Size

Default

name

Name.

string

Maximum length: 35

value

Value.

var-string

Maximum length: 63

config form-data

Parameter

Description

Type

Size

Default

name

Name.

string

Maximum length: 35

value

Value.

var-string

Maximum length: 63

config mac-addr-check-rule

Parameter

Description

Type

Size

Default

name

Client MAC address check rule name.

string

Maximum length: 35

mac-addr-mask

Client MAC address mask.

integer

Minimum value: 1 Maximum value: 48

48

mac-addr-list <addr>

Client MAC address list.

Client MAC address.

mac-address

Not Specified

config os-check-list

Parameter

Description

Type

Size

Default

name

Name.

string

Maximum length: 35

action

OS check options.

option

-

allow

Option

Description

deny

Deny all OS versions.

allow

Allow any OS version.

check-up-to-date

Verify OS is up-to-date.

tolerance

OS patch level tolerance.

integer

Minimum value: 0 Maximum value: 65535

0

latest-patch-level

Latest OS patch level.

user

Not Specified

0

config split-dns

Parameter

Description

Type

Size

Default

id

ID.

integer

Minimum value: 0 Maximum value: 4294967294

0

domains

Split DNS domains used for SSL-VPN clients separated by comma.

var-string

Maximum length: 1024

dns-server1

DNS server 1.

ipv4-address

Not Specified

0.0.0.0

dns-server2

DNS server 2.

ipv4-address

Not Specified

0.0.0.0

ipv6-dns-server1

IPv6 DNS server 1.

ipv6-address

Not Specified

::

ipv6-dns-server2

IPv6 DNS server 2.

ipv6-address

Not Specified

::