Fortinet black logo

CLI Reference

Home FortiProxy 2.0.13 CLI Reference
2.0.13
7.4.4
7.4.3
7.4.2
7.4.1
7.4.0
7.2.10
7.2.9
7.2.8
7.2.7
7.2.6
7.2.5
7.2.4
7.2.3
7.2.2
7.2.1
7.0.17
7.0.15
7.0.14
7.0.13
7.0.12
7.0.11
7.0.10
7.0.9
7.0.8
7.0.7
2.0.13
2.0.12
2.0.0
1.2.4

config vpn ipsec phase1-interface

config vpn ipsec phase1-interface

Configure VPN remote gateway.

config vpn ipsec phase1-interface
    Description: Configure VPN remote gateway.
    edit <name>
        set interface {string}
        set ike-version [1|2]
        set local-gw {ipv4-address}
        set remote-gw {ipv4-address}
        set keylife {integer}
        config certificate
            Description: The names of up to 4 signed personal certificates.
            edit <name>
            next
        end
        set authmethod [psk|signature]
        set mode [aggressive|main]
        set peertype {option}
        set peerid {string}
        set peer {string}
        set proposal [des-md5|des-sha1|...]
        set psksecret {password-3}
        set keepalive {integer}
        set distance {integer}
        set priority {integer}
        set localid {string}
        set localid-type [auto|fqdn|...]
        set negotiate-timeout {integer}
        set fragmentation [enable|disable]
        set comments {var-string}
        set send-cert-chain [enable|disable]
        set dhgrp [1|2|...]
        set eap [enable|disable]
        set eap-identity [use-id-payload|send-request]
        set acct-verify [enable|disable]
        set wizard-type [custom|dialup-forticlient|...]
        set xauthtype [disable|client|...]
        set reauth [disable|enable]
        set authusr {string}
        set authpasswd {password}
        set group-authentication [enable|disable]
        set group-authentication-secret {password-3}
        set authusrgrp {string}
        set idle-timeout [enable|disable]
        set idle-timeoutinterval {integer}
        set auto-discovery-sender [enable|disable]
        set auto-discovery-receiver [enable|disable]
        set auto-discovery-forwarder [enable|disable]
        set auto-discovery-psk [enable|disable]
        set fragmentation-mtu {integer}
        set childless-ike [enable|disable]
        set rekey [enable|disable]
        set digital-signature-auth [enable|disable]
        set signature-hash-alg [sha1|sha2-256|...]
        set rsa-signature-format [pkcs1|pss]
        set enforce-unique-id [disable|keep-new|...]
    next
end

config vpn ipsec phase1-interface

Parameter

Description

Type

Size

name

IPsec remote gateway name.

string

Maximum length: 15

interface

Local physical, aggregate, or VLAN outgoing interface.

string

Maximum length: 35

ike-version

IKE protocol version.

option

-

Option

Description

1

Use IKEv1 protocol.

2

Use IKEv2 protocol.

local-gw

IPv4 address of the local gateway's external interface.

ipv4-address

Not Specified

remote-gw

IPv4 address of the remote gateway's external interface.

ipv4-address

Not Specified

keylife

Time to wait in seconds before phase 1 encryption key expires.

integer

Minimum value: 120 Maximum value: 172800

authmethod

Authentication method.

option

-

Option

Description

psk

PSK authentication method.

signature

Signature authentication method.

mode

The ID protection mode used to establish a secure channel.

option

-

Option

Description

aggressive

Aggressive mode.

main

Main mode.

peertype

Accept this peer type.

option

-

Option

Description

any

Accept any peer ID.

peerid

Accept this peer identity.

string

Maximum length: 255

peer

Accept this peer certificate.

string

Maximum length: 35

proposal

Phase1 proposal.

option

-

Option

Description

des-md5

des-md5

des-sha1

des-sha1

des-sha256

des-sha256

des-sha384

des-sha384

des-sha512

des-sha512

3des-md5

3des-md5

3des-sha1

3des-sha1

3des-sha256

3des-sha256

3des-sha384

3des-sha384

3des-sha512

3des-sha512

aes128-md5

aes128-md5

aes128-sha1

aes128-sha1

aes128-sha256

aes128-sha256

aes128-sha384

aes128-sha384

aes128-sha512

aes128-sha512

aes192-md5

aes192-md5

aes192-sha1

aes192-sha1

aes192-sha256

aes192-sha256

aes192-sha384

aes192-sha384

aes192-sha512

aes192-sha512

aes256-md5

aes256-md5

aes256-sha1

aes256-sha1

aes256-sha256

aes256-sha256

aes256-sha384

aes256-sha384

aes256-sha512

aes256-sha512

psksecret

Pre-shared secret for PSK authentication (ASCII string or hexadecimal encoded with a leading 0x).

password-3

Not Specified

keepalive

NAT-T keep alive interval.

integer

Minimum value: 10 Maximum value: 900

distance

Distance for routes added by IKE.

integer

Minimum value: 1 Maximum value: 255

priority

Priority for routes added by IKE.

integer

Minimum value: 0 Maximum value: 4294967295

localid

Local ID.

string

Maximum length: 63

localid-type

Local ID type.

option

-

Option

Description

auto

Select ID type automatically.

fqdn

Use fully qualified domain name.

user-fqdn

Use user fully qualified domain name.

keyid

Use key-id string.

address

Use local IP address.

asn1dn

Use ASN.1 distinguished name.

negotiate-timeout

IKE SA negotiation timeout in seconds.

integer

Minimum value: 1 Maximum value: 300

fragmentation

Enable/disable fragment IKE message on re-transmission.

option

-

Option

Description

enable

Enable intra-IKE fragmentation support on re-transmission.

disable

Disable intra-IKE fragmentation support.

comments

Comment.

var-string

Maximum length: 255

send-cert-chain

Enable/disable sending certificate chain.

option

-

Option

Description

enable

Enable sending certificate chain.

disable

Disable sending certificate chain.

dhgrp

DH group.

option

-

Option

Description

1

DH Group 1.

2

DH Group 2.

5

DH Group 5.

14

DH Group 14.

15

DH Group 15.

16

DH Group 16.

17

DH Group 17.

18

DH Group 18.

19

DH Group 19.

20

DH Group 20.

21

DH Group 21.

27

DH Group 27.

28

DH Group 28.

29

DH Group 29.

30

DH Group 30.

eap

Enable/disable IKEv2 EAP authentication.

option

-

Option

Description

enable

Enable IKEv2 EAP authentication.

disable

Disable IKEv2 EAP authentication.

eap-identity

IKEv2 EAP peer identity type.

option

-

Option

Description

use-id-payload

Use IKEv2 IDi payload to resolve peer identity.

send-request

Use EAP identity request to resolve peer identity.

acct-verify

Enable/disable verification of RADIUS accounting record.

option

-

Option

Description

enable

Enable verification of RADIUS accounting record.

disable

Disable verification of RADIUS accounting record.

wizard-type

GUI VPN Wizard Type.

option

-

Option

Description

custom

Custom VPN configuration.

dialup-forticlient

Dial Up - FortiClient Windows, Mac and Android.

dialup-ios

Dial Up - iPhone / iPad Native IPsec Client.

dialup-android

Dial Up - Android Native IPsec Client.

dialup-windows

Dial Up - Windows Native IPsec Client.

dialup-cisco

Dial Up - Cisco IPsec Client.

static-fortiproxy

Site to Site - FortiProxy.

dialup-fortiproxy

Dial Up - FortiProxy.

static-cisco

Site to Site - Cisco.

dialup-cisco-fw

Dialup Up - Cisco Firewall.

xauthtype

XAuth type.

option

-

Option

Description

disable

Disable.

client

Enable as client.

pap

Enable as server PAP.

chap

Enable as server CHAP.

auto

Enable as server auto.

reauth

Enable/disable re-authentication upon IKE SA lifetime expiration.

option

-

Option

Description

disable

Disable IKE SA re-authentication.

enable

Enable IKE SA re-authentication.

authusr

XAuth user name.

string

Maximum length: 64

authpasswd

XAuth password (max 35 characters).

password

Not Specified

group-authentication

Enable/disable IKEv2 IDi group authentication.

option

-

Option

Description

enable

Enable IKEv2 IDi group authentication.

disable

Disable IKEv2 IDi group authentication.

group-authentication-secret

Password for IKEv2 IDi group authentication. (ASCII string or hexadecimal indicated by a leading 0x.)

password-3

Not Specified

authusrgrp

Authentication user group.

string

Maximum length: 35

idle-timeout

Enable/disable IPsec tunnel idle timeout.

option

-

Option

Description

enable

Enable IPsec tunnel idle timeout.

disable

Disable IPsec tunnel idle timeout.

idle-timeoutinterval

IPsec tunnel idle timeout in minutes.

integer

Minimum value: 5 Maximum value: 43200

auto-discovery-sender

Enable/disable sending auto-discovery short-cut messages.

option

-

Option

Description

enable

Enable sending auto-discovery short-cut messages.

disable

Disable sending auto-discovery short-cut messages.

auto-discovery-receiver

Enable/disable accepting auto-discovery short-cut messages.

option

-

Option

Description

enable

Enable receiving auto-discovery short-cut messages.

disable

Disable receiving auto-discovery short-cut messages.

auto-discovery-forwarder

Enable/disable forwarding auto-discovery short-cut messages.

option

-

Option

Description

enable

Enable forwarding auto-discovery short-cut messages.

disable

Disable forwarding auto-discovery short-cut messages.

auto-discovery-psk

Enable/disable use of pre-shared secrets for authentication of auto-discovery tunnels.

option

-

Option

Description

enable

Enable use of pre-shared-secret authentication for auto-discovery tunnels.

disable

Disable use of authentication defined by 'authmethod' for auto-discovery tunnels.

fragmentation-mtu

IKE fragmentation MTU.

integer

Minimum value: 500 Maximum value: 16000

childless-ike

Enable/disable childless IKEv2 initiation (RFC 6023).

option

-

Option

Description

enable

Enable childless IKEv2 initiation (RFC 6023).

disable

Disable childless IKEv2 initiation (RFC 6023).

rekey

Enable/disable phase1 rekey.

option

-

Option

Description

enable

Enable phase1 rekey.

disable

Disable phase1 rekey.

digital-signature-auth

Enable/disable IKEv2 Digital Signature Authentication (RFC 7427).

option

-

Option

Description

enable

Enable IKEv2 Digital Signature Authentication (RFC 7427).

disable

Disable IKEv2 Digital Signature Authentication (RFC 7427).

signature-hash-alg

Digital Signature Authentication hash algorithms.

option

-

Option

Description

sha1

SHA1.

sha2-256

SHA2-256.

sha2-384

SHA2-384.

sha2-512

SHA2-512.

rsa-signature-format

Digital Signature Authentication RSA signature format.

option

-

Option

Description

pkcs1

RSASSA PKCS#1 v1.5.

pss

RSASSA Probabilistic Signature Scheme (PSS).

enforce-unique-id

Enable/disable peer ID uniqueness check.

option

-

Option

Description

disable

Disable peer ID uniqueness enforcement.

keep-new

Enforce peer ID uniqueness, keep new connection if collision found.

keep-old

Enforce peer ID uniqueness, keep old connection if collision found.

config certificate

Parameter

Description

Type

Size

name

Certificate name.

string

Maximum length: 64
Previous
Next

config vpn ipsec phase1-interface

Configure VPN remote gateway.

config vpn ipsec phase1-interface
    Description: Configure VPN remote gateway.
    edit <name>
        set interface {string}
        set ike-version [1|2]
        set local-gw {ipv4-address}
        set remote-gw {ipv4-address}
        set keylife {integer}
        config certificate
            Description: The names of up to 4 signed personal certificates.
            edit <name>
            next
        end
        set authmethod [psk|signature]
        set mode [aggressive|main]
        set peertype {option}
        set peerid {string}
        set peer {string}
        set proposal [des-md5|des-sha1|...]
        set psksecret {password-3}
        set keepalive {integer}
        set distance {integer}
        set priority {integer}
        set localid {string}
        set localid-type [auto|fqdn|...]
        set negotiate-timeout {integer}
        set fragmentation [enable|disable]
        set comments {var-string}
        set send-cert-chain [enable|disable]
        set dhgrp [1|2|...]
        set eap [enable|disable]
        set eap-identity [use-id-payload|send-request]
        set acct-verify [enable|disable]
        set wizard-type [custom|dialup-forticlient|...]
        set xauthtype [disable|client|...]
        set reauth [disable|enable]
        set authusr {string}
        set authpasswd {password}
        set group-authentication [enable|disable]
        set group-authentication-secret {password-3}
        set authusrgrp {string}
        set idle-timeout [enable|disable]
        set idle-timeoutinterval {integer}
        set auto-discovery-sender [enable|disable]
        set auto-discovery-receiver [enable|disable]
        set auto-discovery-forwarder [enable|disable]
        set auto-discovery-psk [enable|disable]
        set fragmentation-mtu {integer}
        set childless-ike [enable|disable]
        set rekey [enable|disable]
        set digital-signature-auth [enable|disable]
        set signature-hash-alg [sha1|sha2-256|...]
        set rsa-signature-format [pkcs1|pss]
        set enforce-unique-id [disable|keep-new|...]
    next
end

config vpn ipsec phase1-interface

Parameter

Description

Type

Size

name

IPsec remote gateway name.

string

Maximum length: 15

interface

Local physical, aggregate, or VLAN outgoing interface.

string

Maximum length: 35

ike-version

IKE protocol version.

option

-

Option

Description

1

Use IKEv1 protocol.

2

Use IKEv2 protocol.

local-gw

IPv4 address of the local gateway's external interface.

ipv4-address

Not Specified

remote-gw

IPv4 address of the remote gateway's external interface.

ipv4-address

Not Specified

keylife

Time to wait in seconds before phase 1 encryption key expires.

integer

Minimum value: 120 Maximum value: 172800

authmethod

Authentication method.

option

-

Option

Description

psk

PSK authentication method.

signature

Signature authentication method.

mode

The ID protection mode used to establish a secure channel.

option

-

Option

Description

aggressive

Aggressive mode.

main

Main mode.

peertype

Accept this peer type.

option

-

Option

Description

any

Accept any peer ID.

peerid

Accept this peer identity.

string

Maximum length: 255

peer

Accept this peer certificate.

string

Maximum length: 35

proposal

Phase1 proposal.

option

-

Option

Description

des-md5

des-md5

des-sha1

des-sha1

des-sha256

des-sha256

des-sha384

des-sha384

des-sha512

des-sha512

3des-md5

3des-md5

3des-sha1

3des-sha1

3des-sha256

3des-sha256

3des-sha384

3des-sha384

3des-sha512

3des-sha512

aes128-md5

aes128-md5

aes128-sha1

aes128-sha1

aes128-sha256

aes128-sha256

aes128-sha384

aes128-sha384

aes128-sha512

aes128-sha512

aes192-md5

aes192-md5

aes192-sha1

aes192-sha1

aes192-sha256

aes192-sha256

aes192-sha384

aes192-sha384

aes192-sha512

aes192-sha512

aes256-md5

aes256-md5

aes256-sha1

aes256-sha1

aes256-sha256

aes256-sha256

aes256-sha384

aes256-sha384

aes256-sha512

aes256-sha512

psksecret

Pre-shared secret for PSK authentication (ASCII string or hexadecimal encoded with a leading 0x).

password-3

Not Specified

keepalive

NAT-T keep alive interval.

integer

Minimum value: 10 Maximum value: 900

distance

Distance for routes added by IKE.

integer

Minimum value: 1 Maximum value: 255

priority

Priority for routes added by IKE.

integer

Minimum value: 0 Maximum value: 4294967295

localid

Local ID.

string

Maximum length: 63

localid-type

Local ID type.

option

-

Option

Description

auto

Select ID type automatically.

fqdn

Use fully qualified domain name.

user-fqdn

Use user fully qualified domain name.

keyid

Use key-id string.

address

Use local IP address.

asn1dn

Use ASN.1 distinguished name.

negotiate-timeout

IKE SA negotiation timeout in seconds.

integer

Minimum value: 1 Maximum value: 300

fragmentation

Enable/disable fragment IKE message on re-transmission.

option

-

Option

Description

enable

Enable intra-IKE fragmentation support on re-transmission.

disable

Disable intra-IKE fragmentation support.

comments

Comment.

var-string

Maximum length: 255

send-cert-chain

Enable/disable sending certificate chain.

option

-

Option

Description

enable

Enable sending certificate chain.

disable

Disable sending certificate chain.

dhgrp

DH group.

option

-

Option

Description

1

DH Group 1.

2

DH Group 2.

5

DH Group 5.

14

DH Group 14.

15

DH Group 15.

16

DH Group 16.

17

DH Group 17.

18

DH Group 18.

19

DH Group 19.

20

DH Group 20.

21

DH Group 21.

27

DH Group 27.

28

DH Group 28.

29

DH Group 29.

30

DH Group 30.

eap

Enable/disable IKEv2 EAP authentication.

option

-

Option

Description

enable

Enable IKEv2 EAP authentication.

disable

Disable IKEv2 EAP authentication.

eap-identity

IKEv2 EAP peer identity type.

option

-

Option

Description

use-id-payload

Use IKEv2 IDi payload to resolve peer identity.

send-request

Use EAP identity request to resolve peer identity.

acct-verify

Enable/disable verification of RADIUS accounting record.

option

-

Option

Description

enable

Enable verification of RADIUS accounting record.

disable

Disable verification of RADIUS accounting record.

wizard-type

GUI VPN Wizard Type.

option

-

Option

Description

custom

Custom VPN configuration.

dialup-forticlient

Dial Up - FortiClient Windows, Mac and Android.

dialup-ios

Dial Up - iPhone / iPad Native IPsec Client.

dialup-android

Dial Up - Android Native IPsec Client.

dialup-windows

Dial Up - Windows Native IPsec Client.

dialup-cisco

Dial Up - Cisco IPsec Client.

static-fortiproxy

Site to Site - FortiProxy.

dialup-fortiproxy

Dial Up - FortiProxy.

static-cisco

Site to Site - Cisco.

dialup-cisco-fw

Dialup Up - Cisco Firewall.

xauthtype

XAuth type.

option

-

Option

Description

disable

Disable.

client

Enable as client.

pap

Enable as server PAP.

chap

Enable as server CHAP.

auto

Enable as server auto.

reauth

Enable/disable re-authentication upon IKE SA lifetime expiration.

option

-

Option

Description

disable

Disable IKE SA re-authentication.

enable

Enable IKE SA re-authentication.

authusr

XAuth user name.

string

Maximum length: 64

authpasswd

XAuth password (max 35 characters).

password

Not Specified

group-authentication

Enable/disable IKEv2 IDi group authentication.

option

-

Option

Description

enable

Enable IKEv2 IDi group authentication.

disable

Disable IKEv2 IDi group authentication.

group-authentication-secret

Password for IKEv2 IDi group authentication. (ASCII string or hexadecimal indicated by a leading 0x.)

password-3

Not Specified

authusrgrp

Authentication user group.

string

Maximum length: 35

idle-timeout

Enable/disable IPsec tunnel idle timeout.

option

-

Option

Description

enable

Enable IPsec tunnel idle timeout.

disable

Disable IPsec tunnel idle timeout.

idle-timeoutinterval

IPsec tunnel idle timeout in minutes.

integer

Minimum value: 5 Maximum value: 43200

auto-discovery-sender

Enable/disable sending auto-discovery short-cut messages.

option

-

Option

Description

enable

Enable sending auto-discovery short-cut messages.

disable

Disable sending auto-discovery short-cut messages.

auto-discovery-receiver

Enable/disable accepting auto-discovery short-cut messages.

option

-

Option

Description

enable

Enable receiving auto-discovery short-cut messages.

disable

Disable receiving auto-discovery short-cut messages.

auto-discovery-forwarder

Enable/disable forwarding auto-discovery short-cut messages.

option

-

Option

Description

enable

Enable forwarding auto-discovery short-cut messages.

disable

Disable forwarding auto-discovery short-cut messages.

auto-discovery-psk

Enable/disable use of pre-shared secrets for authentication of auto-discovery tunnels.

option

-

Option

Description

enable

Enable use of pre-shared-secret authentication for auto-discovery tunnels.

disable

Disable use of authentication defined by 'authmethod' for auto-discovery tunnels.

fragmentation-mtu

IKE fragmentation MTU.

integer

Minimum value: 500 Maximum value: 16000

childless-ike

Enable/disable childless IKEv2 initiation (RFC 6023).

option

-

Option

Description

enable

Enable childless IKEv2 initiation (RFC 6023).

disable

Disable childless IKEv2 initiation (RFC 6023).

rekey

Enable/disable phase1 rekey.

option

-

Option

Description

enable

Enable phase1 rekey.

disable

Disable phase1 rekey.

digital-signature-auth

Enable/disable IKEv2 Digital Signature Authentication (RFC 7427).

option

-

Option

Description

enable

Enable IKEv2 Digital Signature Authentication (RFC 7427).

disable

Disable IKEv2 Digital Signature Authentication (RFC 7427).

signature-hash-alg

Digital Signature Authentication hash algorithms.

option

-

Option

Description

sha1

SHA1.

sha2-256

SHA2-256.

sha2-384

SHA2-384.

sha2-512

SHA2-512.

rsa-signature-format

Digital Signature Authentication RSA signature format.

option

-

Option

Description

pkcs1

RSASSA PKCS#1 v1.5.

pss

RSASSA Probabilistic Signature Scheme (PSS).

enforce-unique-id

Enable/disable peer ID uniqueness check.

option

-

Option

Description

disable

Disable peer ID uniqueness enforcement.

keep-new

Enforce peer ID uniqueness, keep new connection if collision found.

keep-old

Enforce peer ID uniqueness, keep old connection if collision found.

config certificate

Parameter

Description

Type

Size

name

Certificate name.

string

Maximum length: 64
Previous
Next