Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • CLI Reference

    6.4.0
    7.6.0
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.16
    7.0.15
    7.0.14
    7.0.13
    7.0.12
    7.0.11
    7.0.10
    7.0.9
    7.0.8
    7.0.7
    7.0.6
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.4.15
    6.4.14
    6.4.13
    6.4.12
    6.4.11
    6.4.10
    6.4.9
    6.4.8
    6.4.7
    6.4.6
    6.4.5
    6.4.4
    6.4.3
    6.4.2
    6.4.1
    6.4.0
    6.2.16
    6.2.15
    6.2.14
    6.2.13
    6.2.12
    6.2.11
    6.2.10
    6.2.9
    6.2.8
    6.2.7
    6.2.6
    6.2.5
    6.2.4
    6.2.3
    6.2.2
    6.2.1
    6.0.0
    5.6.0
    5.4.0
    5.2.0
    5.0.0

    vpn ocvpn

    Configure Overlay Controller VPN settings.

      config vpn ocvpn
      Description: Configure Overlay Controller VPN settings.
      set status [enable|disable]
      set role [spoke|primary-hub|...]
      set multipath [enable|disable]
      set sdwan [enable|disable]
      set wan-interface <name1>, <name2>, ...
      set ip-allocation-block {ipv4-classnet-any}
      config overlays
          Description: Network overlays to register with Overlay Controller VPN service.
          edit <overlay-name>
              set inter-overlay [allow|deny]
              set assign-ip [enable|disable]
              set ipv4-start-ip {ipv4-address}
              set ipv4-end-ip {ipv4-address}
              config subnets
                  Description: Internal subnets to register with OCVPN service.
                  edit <id>
                      set type [subnet|interface]
                      set subnet {ipv4-classnet-any}
                      set interface {string}
                  next
              end
          next
      end
      config forticlient-access
          Description: Configure FortiClient settings.
          set status [enable|disable]
          set psksecret {password-3}
          config auth-groups
              Description: FortiClient user authentication groups.
              edit <name>
                  set auth-group {string}
                  set overlays <overlay-name1>, <overlay-name2>, ...
              next
          end
      end
      set auto-discovery [enable|disable]
      set poll-interval {integer}
      set eap [enable|disable]
      set eap-users {string}
      set nat [enable|disable]
  end

    config vpn ocvpn

    Parameter Name Description Type Size
    status Enable/disable Overlay Controller cloud assisted VPN.
    enable: Enable Overlay Controller VPN.
    disable: Disable Overlay Controller VPN.
    		 option -
    role Set device role.
    spoke: Register device as static spoke.
    primary-hub: Register device as primary hub.
    secondary-hub: Register device as secondary hub.
    		 option -
    multipath Enable/disable multipath redundancy.
    enable: Enable multipath redundancy.
    disable: Disable multipath redundancy.
    		 option -
    sdwan Enable/disable adding OCVPN tunnels to SDWAN.
    enable: Enable adding OCVPN tunnels to SDWAN.
    disable: Disable adding OCVPN tunnels to SDWAN.
    		 option -
    wan-interface <name> FortiGate WAN interfaces to use with OCVPN.
    Interface name.    		 string Maximum length: 79
    ip-allocation-block Class B subnet reserved for private IP address assignment. ipv4-classnet-any Not Specified
    auto-discovery Enable/disable auto-discovery shortcuts.
    enable: Enable ADVPN auto-discovery shortcuts.
    disable: Disable ADVPN auto-discovery shortcuts.
    		 option -
    poll-interval Overlay Controller VPN polling interval. integer Minimum value: 30 Maximum value: 120
    eap Enable/disable EAP client authentication.
    enable: Enable EAP client authentication.
    disable: Disable EAP client authentication.
    		 option -
    eap-users EAP authentication user group. string Maximum length: 35
    nat Enable/disable inter-overlay source NAT.
    enable: Enable inter-overlay source NAT.
    disable: Disable inter-overlay source NAT.
    		 option -

    config overlays

    Parameter Name Description Type Size
    inter-overlay Allow or deny traffic from other overlays.
    allow: Allow traffic from other overlays.
    deny: Deny traffic from other overlays.
    		 option -
    assign-ip Enable/disable mode-cfg address assignment.
    enable: Enable client IPv4 address assignment.
    disable: Disable client IPv4 address assignment.
    		 option -
    ipv4-start-ip Start of IPv4 range. ipv4-address Not Specified
    ipv4-end-ip End of IPv4 range. ipv4-address Not Specified

    config subnets

    Parameter Name Description Type Size
    type Subnet type.
    subnet: Configure participating subnet IP and mask.
    interface: Configure participating LAN interface.
    		 option -
    subnet IPv4 address and subnet mask. ipv4-classnet-any Not Specified
    interface LAN interface. string Maximum length: 15

    config forticlient-access

    Parameter Name Description Type Size
    status Enable/disable FortiClient to access OCVPN networks.
    enable: Enable FortiClient access to OCVPN overlays.
    disable: Disable FortiClient access to OCVPN overlays.
    		 option -
    psksecret Pre-shared secret for FortiClient PSK authentication (ASCII string or hexadecimal encoded with a leading 0x). password-3 Not Specified

    config auth-groups

    Parameter Name Description Type Size
    auth-group Authentication user group for FortiClient access. string Maximum length: 35
    overlays <overlay-name> OCVPN overlays to allow access to.
    Overlay name.    		 string Maximum length: 79
    Previous
    Next

    vpn ocvpn

    Configure Overlay Controller VPN settings.

      config vpn ocvpn
      Description: Configure Overlay Controller VPN settings.
      set status [enable|disable]
      set role [spoke|primary-hub|...]
      set multipath [enable|disable]
      set sdwan [enable|disable]
      set wan-interface <name1>, <name2>, ...
      set ip-allocation-block {ipv4-classnet-any}
      config overlays
          Description: Network overlays to register with Overlay Controller VPN service.
          edit <overlay-name>
              set inter-overlay [allow|deny]
              set assign-ip [enable|disable]
              set ipv4-start-ip {ipv4-address}
              set ipv4-end-ip {ipv4-address}
              config subnets
                  Description: Internal subnets to register with OCVPN service.
                  edit <id>
                      set type [subnet|interface]
                      set subnet {ipv4-classnet-any}
                      set interface {string}
                  next
              end
          next
      end
      config forticlient-access
          Description: Configure FortiClient settings.
          set status [enable|disable]
          set psksecret {password-3}
          config auth-groups
              Description: FortiClient user authentication groups.
              edit <name>
                  set auth-group {string}
                  set overlays <overlay-name1>, <overlay-name2>, ...
              next
          end
      end
      set auto-discovery [enable|disable]
      set poll-interval {integer}
      set eap [enable|disable]
      set eap-users {string}
      set nat [enable|disable]
  end

    config vpn ocvpn

    Parameter Name Description Type Size
    status Enable/disable Overlay Controller cloud assisted VPN.
    enable: Enable Overlay Controller VPN.
    disable: Disable Overlay Controller VPN.
    		 option -
    role Set device role.
    spoke: Register device as static spoke.
    primary-hub: Register device as primary hub.
    secondary-hub: Register device as secondary hub.
    		 option -
    multipath Enable/disable multipath redundancy.
    enable: Enable multipath redundancy.
    disable: Disable multipath redundancy.
    		 option -
    sdwan Enable/disable adding OCVPN tunnels to SDWAN.
    enable: Enable adding OCVPN tunnels to SDWAN.
    disable: Disable adding OCVPN tunnels to SDWAN.
    		 option -
    wan-interface <name> FortiGate WAN interfaces to use with OCVPN.
    Interface name.    		 string Maximum length: 79
    ip-allocation-block Class B subnet reserved for private IP address assignment. ipv4-classnet-any Not Specified
    auto-discovery Enable/disable auto-discovery shortcuts.
    enable: Enable ADVPN auto-discovery shortcuts.
    disable: Disable ADVPN auto-discovery shortcuts.
    		 option -
    poll-interval Overlay Controller VPN polling interval. integer Minimum value: 30 Maximum value: 120
    eap Enable/disable EAP client authentication.
    enable: Enable EAP client authentication.
    disable: Disable EAP client authentication.
    		 option -
    eap-users EAP authentication user group. string Maximum length: 35
    nat Enable/disable inter-overlay source NAT.
    enable: Enable inter-overlay source NAT.
    disable: Disable inter-overlay source NAT.
    		 option -

    config overlays

    Parameter Name Description Type Size
    inter-overlay Allow or deny traffic from other overlays.
    allow: Allow traffic from other overlays.
    deny: Deny traffic from other overlays.
    		 option -
    assign-ip Enable/disable mode-cfg address assignment.
    enable: Enable client IPv4 address assignment.
    disable: Disable client IPv4 address assignment.
    		 option -
    ipv4-start-ip Start of IPv4 range. ipv4-address Not Specified
    ipv4-end-ip End of IPv4 range. ipv4-address Not Specified

    config subnets

    Parameter Name Description Type Size
    type Subnet type.
    subnet: Configure participating subnet IP and mask.
    interface: Configure participating LAN interface.
    		 option -
    subnet IPv4 address and subnet mask. ipv4-classnet-any Not Specified
    interface LAN interface. string Maximum length: 15

    config forticlient-access

    Parameter Name Description Type Size
    status Enable/disable FortiClient to access OCVPN networks.
    enable: Enable FortiClient access to OCVPN overlays.
    disable: Disable FortiClient access to OCVPN overlays.
    		 option -
    psksecret Pre-shared secret for FortiClient PSK authentication (ASCII string or hexadecimal encoded with a leading 0x). password-3 Not Specified

    config auth-groups

    Parameter Name Description Type Size
    auth-group Authentication user group for FortiClient access. string Maximum length: 35
    overlays <overlay-name> OCVPN overlays to allow access to.
    Overlay name.    		 string Maximum length: 79
    Previous
    Next