config vpn ocvpn

Configure Overlay Controller VPN settings.

config vpn ocvpn

Description: Configure Overlay Controller VPN settings.

set status [enable|disable]

set role [spoke|primary-hub|...]

set multipath [enable|disable]

set sdwan [enable|disable]

set sdwan-zone {string}

set wan-interface <name1>, <name2>, ...

set nat [enable|disable]

set ip-allocation-block {ipv4-classnet-any}

config overlays

Description: Network overlays to register with Overlay Controller VPN service.

edit <overlay-name>

set inter-overlay [allow|deny]

config subnets

Description: Internal subnets to register with OCVPN service.

edit <id>

set type [subnet|interface]

set subnet {ipv4-classnet-any}

set interface {string}

next

end

next

end

config forticlient-access

Description: Configure FortiClient settings.

set status [enable|disable]

set psksecret {password-3}

config auth-groups

Description: FortiClient user authentication groups.

edit <name>

set auth-group {string}

set overlays <overlay-name1>, <overlay-name2>, ...

next

end

end

set auto-discovery [enable|disable]

set auto-discovery-shortcut-mode [independent|dependent]

set poll-interval {integer}

set eap [enable|disable]

set eap-users {string}

end

config vpn ocvpn

Parameter	Description	Type	Size	Default
status	Enable/disable Overlay Controller cloud assisted VPN.	option	-	disable
	Option Description enable Enable Overlay Controller VPN. disable Disable Overlay Controller VPN.
role	Set device role.	option	-	spoke
	Option Description spoke Register device as static spoke. primary-hub Register device as primary hub. secondary-hub Register device as secondary hub.
multipath	Enable/disable multipath redundancy.	option	-	enable
	Option Description enable Enable multipath redundancy. disable Disable multipath redundancy.
sdwan	Enable/disable adding OCVPN tunnels to SD-WAN.	option	-	disable
	Option Description enable Enable adding OCVPN tunnels to SD-WAN. disable Disable adding OCVPN tunnels to SD-WAN.
sdwan-zone	Set SD-WAN zone.	string	Not Specified	virtual-wan-link
wan-interface <name>	FortiGate WAN interfaces to use with OCVPN. Interface name.	string	Maximum length: 79
nat	Enable/disable NAT support.	option	-	enable
	Option Description enable Enable NAT support. disable Disable NAT support.
ip-allocation-block	Class B subnet reserved for private IP address assignment.	ipv4-classnet-any	Not Specified	10.254.0.0 255.255.0.0
auto-discovery	Enable/disable auto-discovery shortcuts.	option	-	enable
	Option Description enable Enable ADVPN auto-discovery shortcuts. disable Disable ADVPN auto-discovery shortcuts.
auto-discovery-shortcut-mode	Control deletion of child short-cut tunnels when the parent tunnel goes down.	option	-	independent
	Option Description independent Short-cut tunnels remain up if the parent tunnel goes down. dependent Short-cut tunnels are brought down if the parent tunnel goes down.
poll-interval	Overlay Controller VPN polling interval.	integer	Minimum value: 30 Maximum value: 120	30
eap	Enable/disable EAP client authentication.	option	-	disable
	Option Description enable Enable EAP client authentication. disable Disable EAP client authentication.
eap-users	EAP authentication user group.	string	Not Specified

config overlays

Parameter	Description	Type	Size	Default
inter-overlay	Allow or deny traffic from other overlays.	option	-	deny
	Option Description allow Allow traffic from other overlays. deny Deny traffic from other overlays.

config subnets

Parameter	Description	Type	Size	Default
type	Subnet type.	option	-	subnet
	Option Description subnet Configure participating subnet IP and mask. interface Configure participating LAN interface.
subnet	IPv4 address and subnet mask.	ipv4-classnet-any	Not Specified	0.0.0.0 0.0.0.0
interface	LAN interface.	string	Not Specified

config forticlient-access

Parameter	Description	Type	Size	Default
status	Enable/disable FortiClient to access OCVPN networks.	option	-	disable
	Option Description enable Enable FortiClient access to OCVPN overlays. disable Disable FortiClient access to OCVPN overlays.
psksecret	Pre-shared secret for FortiClient PSK authentication (ASCII string or hexadecimal encoded with a leading 0x).	password-3	Not Specified

config auth-groups

Parameter	Description	Type	Size	Default
auth-group	Authentication user group for FortiClient access.	string	Not Specified
overlays <overlay-name>	OCVPN overlays to allow access to. Overlay name.	string	Maximum length: 79