IPsec settings

The following table provides the XML tags for IPsec settings, as well as the descriptions and default values where applicable.

XML tag Description Default value

<remote_networks> elements

<network>

 Specifies a network address <addr> with subnet mask <mask>.

<addr>

 Network IP address.

<mask>

 Subnet mask to apply to network address <addr>.

<ipv4_split_exclude_networks>

Configure negative split tunnel or network exclusion for IPsec VPN using the <subnetwork> subelement. This feature supports FQDN, resolved from the client and expanded into a list of networks.

If negative split tunnel configuration is also received from FortiOS, FortiClient uses the settings from FortiOS and ignores the <ipv4_split_exclude_networks> settings. See Configure VPN remote gateway.

<dhgroup>

 A list of possible DH protocol groups, separated by semicolons.

<key_life_type>

Phase 2 key re-key duration type. Select one of the following:

  • seconds
  • kbytes
  • both

<key_life_seconds>

 Phase 2 key maximum life in seconds. 1800

<key_life_Kbytes>

 Phase 2 key maximum life in KB. 5120

<replay_detection>

 Detect an attempt to replay a previous VPN session.

<pfs>

Enable perfect forward secrecy (PFS).

Boolean value: [0 | 1]

<use_vip>

Use a virtual IP address.

Boolean value: [0 | 1]

<virtualip> elements

<type>

Enter the virtual IP address type: [modeconfig | dhcpoveripsec]

<ip>

 Enter the IP address.

<mask>

 Enter the Network mask.

<dnsserver>

 Enter the DNS server IP address.

<dnsserver_secondary>

 Enter the secondary DNS server IP address.

<winserver>

 Enter the Windows server IP address.

<proposals> elements

<proposal>

Encryption and authentication types to use, separated by a pipe.

Example:

<proposal>3DES|MD5<proposal>

Multiple elements accepted.

First setting: Encryption type: DES, 3DES, AES128, AES192, AES256

Second setting: Authentication type: MD5, SHA1, SHA256, SHA384, SHA512

The on_connect and on_disconnect structure and scripting format are similar to those described in SSL VPN.