VPN clients¶

# Check AnyConnect installation and version
reg query "HKLM\SOFTWARE\Cisco\Cisco AnyConnect Secure Mobility Client" /v Version

# Set default VPN server for the current user
$path = "HKCU:\SOFTWARE\Cisco\Cisco AnyConnect Secure Mobility Client"
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name "DefaultHostName" -Value "VPN Corporate" -Type String
Set-ItemProperty -Path $path -Name "DefaultHostAddress" -Value "vpn.corp.local" -Type String

# List AnyConnect profile files
Get-ChildItem "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\" `
    -Filter "*.xml" -ErrorAction SilentlyContinue

# Check DART module installation
reg query "HKLM\SOFTWARE\Cisco\Cisco AnyConnect Secure Mobility Client\DART" 2>$null
if ($LASTEXITCODE -eq 0) { Write-Output "DART module installed" }
else { Write-Output "DART module not found" }

# Check FortiClient installation
reg query "HKLM\SOFTWARE\Fortinet\FortiClient" /v Version 2>$null

# Create a new FortiClient SSL VPN tunnel
$tunnelPath = "HKLM:\SOFTWARE\Fortinet\FortiClient\Sslvpn\Tunnels\Corporate VPN"
New-Item -Path $tunnelPath -Force | Out-Null
Set-ItemProperty -Path $tunnelPath -Name "Server" -Value "vpn.corp.local" -Type String
Set-ItemProperty -Path $tunnelPath -Name "ServerPort" -Value 443 -Type DWord
Set-ItemProperty -Path $tunnelPath -Name "Description" -Value "Corporate VPN Tunnel" -Type String
Set-ItemProperty -Path $tunnelPath -Name "promptusername" -Value 1 -Type DWord
Set-ItemProperty -Path $tunnelPath -Name "promptcertificate" -Value 0 -Type DWord

# List all FortiClient VPN tunnels (SSL and IPsec)
foreach ($type in @("Sslvpn", "FA_VPN")) {
    $path = "HKLM:\SOFTWARE\Fortinet\FortiClient\$type\Tunnels"
    Write-Output "=== $type ==="
    if (Test-Path $path) {
        Get-ChildItem $path | ForEach-Object { Write-Output $_.PSChildName }
    } else { Write-Output "No tunnels configured" }
}

# Check FortiClient EMS management status
$emsPath = "HKLM:\SOFTWARE\Fortinet\FortiClient\FA_EMS"
if (Test-Path $emsPath) {
    $managed = Get-ItemProperty -Path $emsPath -Name "managed" -ErrorAction SilentlyContinue
    $server = Get-ItemProperty -Path $emsPath -Name "srv_name" -ErrorAction SilentlyContinue
    Write-Output "Managed by EMS: $($managed.managed)"
    Write-Output "EMS Server: $($server.srv_name)"
} else {
    Write-Output "FortiClient is not managed by EMS"
}

# List WireGuard tunnel services
Get-Service -Name "WireGuardTunnel$*" -ErrorAction SilentlyContinue |
    Select-Object Name, Status, StartType

# Set WireGuard tunnel to start automatically
Set-ItemProperty `
    -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WireGuardTunnel`$Corporate" `
    -Name "Start" -Value 2 -Type DWord

# Force strong crypto for IKEv2 connections
$path = "HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters"
Set-ItemProperty -Path $path -Name "NegotiateDH2048_AES256" -Value 1 -Type DWord

# List VPN connections for the current user
Get-VpnConnection | Select-Object Name, ServerAddress, TunnelType, AuthenticationMethod

# Create an IKEv2 VPN connection for all users
Add-VpnConnection -Name "Corporate VPN" `
    -ServerAddress "vpn.corp.local" `
    -TunnelType Ikev2 `
    -AuthenticationMethod MachineCertificate `
    -EncryptionLevel Required `
    -AllUserConnection `
    -SplitTunneling

# Enable split tunneling on an existing VPN connection
Set-VpnConnection -Name "Corporate VPN" -SplitTunneling $true

# Add specific routes to the VPN tunnel
Add-VpnConnectionRoute -ConnectionName "Corporate VPN" `
    -DestinationPrefix "10.0.0.0/8"
Add-VpnConnectionRoute -ConnectionName "Corporate VPN" `
    -DestinationPrefix "172.16.0.0/12"

# Check AnyConnect split tunnel routes during active session
reg query "HKLM\SOFTWARE\Cisco\Cisco AnyConnect Secure Mobility Client" /s | `
    Select-String -Pattern "SplitTunnel|Route"

# Check FortiClient tunnel split tunneling configuration
$tunnelPath = "HKLM:\SOFTWARE\Fortinet\FortiClient\Sslvpn\Tunnels\Corporate VPN"
Get-ItemProperty -Path $tunnelPath -Name "SplitTunnel" -ErrorAction SilentlyContinue

# Create an Always On VPN connection (device tunnel)
Add-VpnConnection -Name "AlwaysOn-Device" `
    -ServerAddress "vpn.corp.local" `
    -TunnelType Ikev2 `
    -AuthenticationMethod MachineCertificate `
    -AllUserConnection `
    -DeviceTunnel

# Enable auto-trigger for specific applications
Add-VpnConnectionTriggerApplication -Name "AlwaysOn-Device" `
    -ApplicationID "C:\Windows\System32\outlook.exe"

# Enable auto-connect on FortiClient tunnel
$tunnelPath = "HKLM:\SOFTWARE\Fortinet\FortiClient\Sslvpn\Tunnels\Corporate VPN"
Set-ItemProperty -Path $tunnelPath -Name "AutoConnect" -Value 1 -Type DWord

# List machine certificates suitable for VPN authentication
Get-ChildItem Cert:\LocalMachine\My |
    Where-Object { $_.EnhancedKeyUsageList.FriendlyName -contains "Client Authentication" } |
    Select-Object Thumbprint, Subject, NotAfter |
    Format-Table -AutoSize

# Configure IKEv2 VPN with machine certificate and verify
Set-VpnConnection -Name "Corporate VPN" -AuthenticationMethod MachineCertificate
Get-VpnConnection -Name "Corporate VPN" | Select-Object Name, AuthenticationMethod

# AnyConnect silent deployment script
# Run as SYSTEM via GPO startup script or SCCM

param(
    [string]$InstallerPath = "\\fileserver\deploy$\AnyConnect\anyconnect-win-5.1.3.62-predeploy-k9.msi",
    [string]$ProfileSource = "\\fileserver\deploy$\AnyConnect\CorporateVPN.xml"
)

$profileDest = "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile"
$logPath = "C:\Windows\Temp\AnyConnect-Install.log"

# Step 1: install AnyConnect silently
$installArgs = @(
    "/i", $InstallerPath,
    "/qn",
    "/norestart",
    "PRE_DEPLOY_DISABLE_VPN=0",
    "/l*v", $logPath
)
Start-Process "msiexec.exe" -ArgumentList $installArgs -Wait -NoNewWindow

# Step 2: create profile directory and copy profile
if (-not (Test-Path $profileDest)) {
    New-Item -Path $profileDest -ItemType Directory -Force | Out-Null
}
Copy-Item -Path $ProfileSource -Destination "$profileDest\CorporateVPN.xml" -Force

# Step 3: configure registry defaults
$regPath = "HKLM:\SOFTWARE\Cisco\Cisco AnyConnect Secure Mobility Client"
if (-not (Test-Path $regPath)) {
    New-Item -Path $regPath -Force | Out-Null
}

# Step 4: verify installation
$version = Get-ItemProperty -Path $regPath -Name "Version" -ErrorAction SilentlyContinue
if ($version) {
    Write-Output "AnyConnect $($version.Version) installed successfully"
    Write-Output "Profile deployed to $profileDest\CorporateVPN.xml"
} else {
    Write-Error "AnyConnect installation failed. Check log: $logPath"
}

# Verify AnyConnect deployment across multiple machines
$machines = Get-Content "C:\Admin\target-workstations.txt"
$results = Invoke-Command -ComputerName $machines -ScriptBlock {
    $version = (Get-ItemProperty `
        "HKLM:\SOFTWARE\Cisco\Cisco AnyConnect Secure Mobility Client" `
        -Name "Version" -ErrorAction SilentlyContinue).Version
    $profileExists = Test-Path `
        "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\CorporateVPN.xml"
    [PSCustomObject]@{
        Computer = $env:COMPUTERNAME
        Version  = if ($version) { $version } else { "Not installed" }
        Profile  = $profileExists
    }
}
$results | Sort-Object Computer | Format-Table -AutoSize