Use the CLI Utility to Configure SASE Client Settings (MacOS)
For supported software information, click here.
On macOS clients, you can use the versa-config command-line utility to configure SASE client settings. The following sections describe the available options and show examples of how to use them.
You install the CLI package at /var/versa/versa-config.
Note: Values written using versa-config are stored in the com.versa.vpn.profile preferences domain. Restart the SASE client for changes to take effect.
Certificate Options
Use the following options to configure certificate issuers:
| Option | Description |
|---|---|
| --add-user-cert-issuer <value> | Enter the user certificate issuer in the format "CN= , O= , OU= ". |
| --add-device-cert-issuer <value> | Enter the device certificate issuer in the format "CN= , O= , OU= ". |
For example:
versa-config --add-user-cert-issuer "CN=User CA, O=Acme Corp" versa-config --add-device-cert-issuer "CN=Device CA, OU=IT, O=Acme Corp"
User Options
Use the following options to configure user identity for registration:
| Option | Description |
|---|---|
| --user-name <value> | Enter the username for registration. |
| --user-id <value> | Enter the user ID for registration. Use this option as an alternative to --user-name. |
For example:
versa-config --user-name "john.doe@acme.com"
Registration Options
Use the following options to configure registration parameters:
| Option | Description |
|---|---|
| --enterprise-name <value> | Enter the enterprise or organization name. |
| --fqdn <value> | Enter the server fully-qualified domain name (FQDN). |
| --device-id <value> | Enter the device ID. |
| --device-name <value> | Enter the device name. |
| --user-name <value> | Enter the username for registration. |
For example:
versa-config --enterprise-name "AcmeCorp" --fqdn "vpn.acme.com" --user-name "jdoe"
Feature Flags
Use the following options to enable or disable SASE client features.
| Option | Description |
|---|---|
| --auto-logon (true | false) | Enter true to enable auto-logon. |
| --ekuid-devicecert <value> | Enter the EKU OID for device certificate authentication or prelogon certificate authentication. Preference key: eku_id_devicecert. |
| --ekuid-usercert <value> | Enter the EKU OID for user certificate authentication. Preference key: eku_id_usercert. |
| --managed-device (true | false) | Enter true to mark the device as managed. |
| --sso-enabled <true | false> | Enter true to enable single sign-on (SSO). |
| --skip-onboarding (true | false) | Enter true to skip onboarding screens. |
| --default-browser (true | false) | Enter true to enable default-browser mode. |
| --fetch-username-from-certificate (true | false) | Enter true to fetch the username from the client certificate. |
| --fail-close-allowed-ips <value> | Enter the IP addresses or subnets to allow on the fail-close list, separated by commas. |
| --cert-issuer <value> | Enter the certificate issuer name. Use this option with --fetch-username-from-certificate true. |
| --username-field ( CN | SAN ) | Enter the certificate field to use as the username: CN or SAN. Use this option with --fetch-username-from-certificate true. |
| --disable-dns-proxy (true | false) |
Enter true to disable the DNS proxy. Default: false. |
| --is-versa-root-ca-required (true | false) |
Enter true to require the Versa root CA. Default: false. |
| --log-level ( Info | Debug | Error | Warning | Verbose) | Set the log level. Enter one of the following: Info, Debug, Error, Warning, Verbose. |
Examples:
versa-config --ekuid-devicecert "1.3.6.1.4.1.12345.10" --ekuid-usercert "1.3.6.1.4.1.12345.20" versa-config --fetch-username-from-certificate true --cert-issuer "CN=User CA, O=Acme Corp" --username-field CN versa-config --fetch-username-from-certificate true --cert-issuer "CN=User CA" --username-field SAN
Account Sync
Use the following option to set the enterprise name and trigger automatic pre-registration for the specified enterprise:
| Option | Description |
|---|---|
| --sync-account <enterprise-name> | Enter the enterprise name to set it and trigger automatic pre-registration for that enterprise. |
Utility Options
Use the following options to manage and inspect the current configuration:
| Option | Description |
|---|---|
| --show | Displays the current configuration. |
| --reset | Removes all stored configuration. The utility prompts for confirmation before proceeding. |
| --reset --force | Removes all stored configuration without prompting for confirmation. |
| --delete-key <key> | Deletes a single configuration key. |
| --version | Displays the tool version. |
| --help | Displays help for all available options. |
| --load-json <filename> | Loads all settings from a JSON file. Keys must match the preference key names. |
For example:
versa-config --show versa-config --reset --force versa-config --load-json settings.json
Example JSON file for --load-json:
{
"enterprise_name": "AcmeCorp",
"fqdn": "vpn.acme.com",
"auto_logon": true,
"managed_device": true,
"fail_close_allowed_ips": ["10.0.0.1"]
}
Supported Software Information
SASE Client Releases 7.6.7 and later support all content described in this article.