reqclientcert

Enable/disable to require client certificates for all SSL VPN users.

option

-

user-peer

Name of user peer.

string

Maximum length: 35

ssl-max-proto-ver

SSL maximum protocol version.

option

-

ssl-min-proto-ver

SSL minimum protocol version.

option

-

banned-cipher

Select one or more cipher technologies that cannot be used in SSL VPN negotiations.

option

-

ssl-insert-empty-fragment

Enable/disable insertion of empty fragment.

option

-

https-redirect

Enable/disable redirect of port 80 to SSL VPN port.

option

-

x-content-type-options

Add HTTP X-Content-Type-Options header.

option

-

ssl-client-renegotiation

Enable/disable to allow client renegotiation by the server if the tunnel goes down.

option

-

force-two-factor-auth

Enable/disable only PKI users with two-factor authentication for SSL VPNs.

option

-

unsafe-legacy-renegotiation

Enable/disable unsafe legacy re-negotiation.

option

-

servercert

Name of the server certificate to be used for SSL VPNs.

string

Maximum length: 35

algorithm

Force the SSL VPN security level. High allows only high. Medium allows medium and high. Low allows any.

option

-

idle-timeout

SSL VPN disconnects if idle for specified time in seconds.

integer

Minimum value: 0 Maximum value: 259200

auth-timeout

SSL VPN authentication timeout (1 - 259200 sec (3 days), 0 for no timeout).

integer

Minimum value: 0 Maximum value: 259200

login-attempt-limit

SSL VPN maximum login attempt times before block (0 - 10, default = 2, 0 = no limit).

integer

Minimum value: 0 Maximum value: 4294967295

login-block-time

Time for which a user is blocked from logging in after too many failed login attempts (0 - 86400 sec, default = 60).

integer

Minimum value: 0 Maximum value: 4294967295

login-timeout

SSLVPN maximum login timeout (10 - 180 sec, default = 30).

integer

Minimum value: 10 Maximum value: 180

dtls-hello-timeout

SSLVPN maximum DTLS hello timeout (10 - 60 sec, default = 10).

integer

Minimum value: 10 Maximum value: 60

tunnel-ip-pools <name>

Names of the IPv4 IP Pool firewall objects that define the IP addresses reserved for remote clients.

Address name.

string

Maximum length: 79

tunnel-ipv6-pools <name>

Names of the IPv6 IP Pool firewall objects that define the IP addresses reserved for remote clients.

Address name.

string

Maximum length: 79

dns-suffix

DNS suffix used for SSL VPN clients.

var-string

Maximum length: 253

dns-server1

DNS server 1.

ipv4-address

Not Specified

dns-server2

DNS server 2.

ipv4-address

Not Specified

wins-server1

WINS server 1.

ipv4-address

Not Specified

wins-server2

WINS server 2.

ipv4-address

Not Specified

ipv6-dns-server1

IPv6 DNS server 1.

ipv6-address

Not Specified

ipv6-dns-server2

IPv6 DNS server 2.

ipv6-address

Not Specified

ipv6-wins-server1

IPv6 WINS server 1.

ipv6-address

Not Specified

ipv6-wins-server2

IPv6 WINS server 2.

ipv6-address

Not Specified

url-obscuration

Enable/disable to obscure the host name of the URL of the web browser display.

option

-

http-compression

Enable/disable to allow HTTP compression over SSL VPN tunnels.

option

-

http-only-cookie

Enable/disable SSL VPN support for HttpOnly cookies.

option

-

deflate-compression-level

Compression level (0~9).

integer

Minimum value: 0 Maximum value: 9

deflate-min-data-size

Minimum amount of data that triggers compression (200 - 65535 bytes).

integer

Minimum value: 200 Maximum value: 65535

port

SSL VPN access port (1 - 65535).

integer

Minimum value: 1 Maximum value: 65535

port-precedence

Enable/disable, Enable means that if SSL VPN connections are allowed on an interface admin GUI connections are blocked on that interface.

option

-

auto-tunnel-static-route

Enable/disable to auto-create static routes for the SSL VPN tunnel IP addresses.

option

-

header-x-forwarded-for

Forward the same, add, or remove HTTP header.

option

-

source-interface <name>

SSL VPN source interface of incoming traffic.

Interface name.

string

Maximum length: 35

source-address <name>

Source address of incoming traffic.

Address name.

string

Maximum length: 79

source-address-negate

Enable/disable negated source address match.

option

-

source-address6 <name>

IPv6 source address of incoming traffic.

IPv6 address name.

string

Maximum length: 79

source-address6-negate

Enable/disable negated source IPv6 address match.

option

-

default-portal

Default SSL VPN portal.

string

Maximum length: 35

dtls-tunnel

Enable/disable DTLS to prevent eavesdropping, tampering, or message forgery.

option

-

dtls-max-proto-ver

DTLS maximum protocol version.

option

-

dtls-min-proto-ver

DTLS minimum protocol version.

option

-

check-referer

Enable/disable verification of referer field in HTTP request header.

option

-

http-request-header-timeout

SSL VPN session is disconnected if an HTTP request header is not received within this time (1 - 60 sec, default = 20).

integer

Minimum value: 0 Maximum value: 4294967295

http-request-body-timeout

SSL VPN session is disconnected if an HTTP request body is not received within this time (1 - 60 sec, default = 20).

integer

Minimum value: 0 Maximum value: 4294967295

auth-session-check-source-ip

Enable/disable checking of source IP for authentication session.

option

-

tunnel-connect-without-reauth

Enable/disable tunnel connection without re-authorization if previous connection dropped.

option

-

tunnel-user-session-timeout

Time out value to clean up user session after tunnel connection is dropped (1 - 255 sec, default=30).

integer

Minimum value: 1 Maximum value: 255

hsts-include-subdomains

Add HSTS includeSubDomains response header.

option

-

transform-backward-slashes

Transform backward slashes to forward slashes in URLs.

option

-

encode-2f-sequence

Encode \2F sequence to forward slash in URLs.

option

-

encrypt-and-store-password

Encrypt and store user passwords for SSL VPN web sessions.

option

-

client-sigalgs

Set signature algorithms related to client authentication. Affects TLS version <= 1.2 only.

option

-

source-interface <name>

SSL VPN source interface of incoming traffic.

Interface name.

string

Maximum length: 35

source-address <name>

Source address of incoming traffic.

Address name.

string

Maximum length: 79

source-address-negate

Enable/disable negated source address match.

option

-

source-address6 <name>

IPv6 source address of incoming traffic.

IPv6 address name.

string

Maximum length: 79

source-address6-negate

Enable/disable negated source IPv6 address match.

option

-

users <name>

User name.

User name.

string

Maximum length: 79

groups <name>

User groups.

Group name.

string

Maximum length: 79

portal

SSL VPN portal.

string

Maximum length: 35

realm

SSL VPN realm.

string

Maximum length: 35

client-cert

Enable/disable SSL VPN client certificate restrictive.

option

-

user-peer

Name of user peer.

string

Maximum length: 35

cipher

SSL VPN cipher strength.

option

-

auth

SSL VPN authentication method restriction.

option

-