Use the Versa SASE Client Application

Set IKE Phase 1 and Phase 2

For Android and MacOS only.

To set IKE Phase 1 and Phase 2 for MacOS devices:

1. In the SASE client home screen, click the Settings icon.
2. In the Enterprise section, click the account for which to set IKE phase details.
   
   
3. Click Secure Access Servers, and then click the secure access server for which to set IKE phase details.
   
   
4. In the Server Details screen, click Advanced Settings, and then click IKE Phase 1.
   
   
5. Enter the required information, and then click Done.
   
   
    
6. In the Advanced Settings screen, click IKE Phase 2, and enter the required information.
   
   
7. Click Done.

Set Prefixes and DNS Servers

To add prefixes:

1. In the Advanced Settings screen, click Traffic Steering, and then in the Traffic Steering screen, click Prefixes.
   
   
    
2. In the Traffic Steering Prefixes screen, enter the prefix and metric values, and then click Add.
   
    
3. Click the Back button, and save the configuration.
   
   

To add a DNS server:

Note that SASE Android client does not support split DNS.

1. In the Traffic Steering screen, click Domain Name Server.
   
   
    
2. In the Traffic Steering DNS screen, enter the IP address of the DNS server and, optionally, the domain name, and click Add. Add additional DNS servers, as needed.
   
   
3. Click the Back button, and save the configuration.
   
   

Change Display Modes

For Windows only.

To change the display mode or appearance (Default, Dark, or Light) of the client:

1. In the SASE client home screen, click the Settings icon.
2. Click App Settings > Appearance (Preview). 
   
   
   You can select Dark, Light, or Default. For example, if you select Light, the display looks like this:
   
   
3. To change display options using the CLI, issue VersaSecureAccessClientConsole.exe client --appearance default/light/dark CLI commands.

C: cd C:\Program Files (x86)\Versa Secure Access
C:\Program Files (x86)\Versa Secure Access> VersaSecureAccessClientConsole.exe

C:\Program Files (x86)\Versa Secure Access> VersaSecureAccessClientConsole.exe
C:\Program Files (x86)\Versa Secure Access>VersaSecureAccessClientConsole.exe
263 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
Run: VersaSecureAccessClientConsole.exe global --help, to get help for global options
Run: VersaSecureAccessClientConsole.exe help, to check supported Options Verb

Display and Execute Global Options

To view all the global options, issue the following CLI command:

C:\Program Files (x86)\Versa Secure Access> VersaSecureAccessClientConsole.exe global --help

For example:

C:\Program Files (x86)\Versa Secure Access>VersaSecureAccessClientConsole.exe global --help
VersaSecureAccessClientConsole 7.8.9.0

  --enable_split_dns          [Deprecated] Enable split DNS support
  --disable_split_dns         [Deprecated] Disable split DNS support
  --register_with_dns         [Deprecated] (true|false). Enable/Disable register with DNS
  --register_dns_suffix       [Deprecated] DNS Suffix to be used while registering with DNS. Used with
                              --register_with_dns. Ignored if --register_with_dns is false
  --network_outage_timeout    [Deprecated] Network outage timeout in seconds. (Range 30-3600)
  --uninstall_profiles        Remove all enterprise configurations
  --ip_stickiness             [Deprecated] (true|false). Enable/Disable IP stickiness
  --ip_stickiness_latency     [Deprecated] Latency diff (in %) to be considered in comparison with best. This value is
                              to be used along with ip_stickiness. Used with --ip_stickiness. Ignored if --ip_stickiness
                              is false
  --http_timeout              Timeout for http calls. (Range 30-300)                              
  --disable_ipv6              Disable IPV6. You must restart your computer for these changes to take effect.
  --enable_sso                (true|false). Enable/Disable Single sign-on.
  --help                      Display this help screen.
  --version                   Display version information.

--enable_split_dns

To enable split DNS support, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe global --enable_split_dns

For example:

C:\VSA> VersaSecureAccessClientConsole.exe global --enable_split_dns
324 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
401 [1] INFO Versa Secure Access (null) - Enable DNS Split tunnel
991 [1] INFO Versa Secure Access (null) - Success!

To disable split DNS support, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe global --disable_split_dns

For example:

C:\VSA> VersaSecureAccessClientConsole.exe global --disable_split_dns
291 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
330 [1] INFO Versa Secure Access (null) - Disable DNS Split tunnel
422 [1] INFO Versa Secure Access (null) - Success!

--register_with_dns

To register with a DNS server, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe global --register_with_dns true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe global --register_with_dns true
386 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
615 [1] INFO Versa Secure Access (null) - Enable Register IP with DNS with Suffix
872 [1] INFO Versa Secure Access (null) - Success!

To unregister from a DNS server, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe global --register_with_dns false

For example:

C:\VSA> VersaSecureAccessClientConsole.exe global --register_with_dns false
563 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
628 [1] INFO Versa Secure Access (null) - Disable Register IP with DNS

--register_dns_suffix

To add the DNS suffix, issue the following CLI command. Note that you must issue this option with the --register_with_dns true option. If you issue the --register_with_dns false option, the --register_dns_suffix option is not accepted.

C:\VSA> VersaSecureAccessClientConsole.exe global --register_dns_suffix "domain-name" --register_with_dns true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe global --register_dns_suffix "abc.com" --register_with_dns true
443 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
505 [1] INFO Versa Secure Access (null) - Enable Register IP with DNS with Suffix abc.com
624 [1] INFO Versa Secure Access (null) - Success!

--network_outage_timeout

To set the network outage time, in seconds, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe global --network_outage_timeout timeout

For example:

C:\VSA> VersaSecureAccessClientConsole.exe global --network_outage_timeout 10
367 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.4.1_24cd434d
467 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.4.1_24cd434d
467 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.4.1_24cd434d
526 [1] INFO Versa Secure Access (null) - Set Network Outage Timeout
526 [1] INFO Versa Secure Access (null) - Set Network Outage Timeout
676 [1] INFO Versa Secure Access (null) - Success!
676 [1] INFO Versa Secure Access (null) - Success!

--uninstall_profiles

Use this option to reset the client to the default (clean) installed state.

To uninstall registered profiles, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe global --uninstall_profiles

--ip_stickiness

IP stickiness stores the tunnel IP address provided by a connection and requests the same IP address for subsequent connections to the same gateway. When connecting to the best gateway with IP stickiness enabled, the client chooses the previously connected gateway, if it is available in the optimal gateway list and if that gateway's latency is within the permitted range compared to the best.

To enable IP stickiness, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe global --ip_stickiness true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe global --ip_stickiness true
289 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
328 [1] INFO Versa Secure Access (null) - Set IP Stickiness
519 [1] INFO Versa Secure Access (null) - Success!

To disable IP stickiness, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe global --ip_stickiness false

For example:

C:\VSA> VersaSecureAccessClientConsole.exe global --ip_stickiness false
291 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
331 [1] INFO Versa Secure Access (null) - Resets IP Stickiness
520 [1] INFO Versa Secure Access (null) - Success!

To customize the IP stickiness latency percentage difference compared against the best, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe global --ip_stickiness true  --ip_stickiness_latency latency

For example:

C:\VSA> VersaSecureAccessClientConsole.exe global --ip_stickiness true  --ip_stickiness_latency 20
293 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
332 [1] INFO Versa Secure Access (null) - Set IP Stickiness
523 [1] INFO Versa Secure Access (null) - Success!

--http_timeout

To specify a timeout value for HTTP calls, issue the following CLI command. The value range is 30 through 300 seconds.

C:\VSA> VersaSecureAccessClientConsole.exe global --http_timeout 60

--disable_ipv6

To disable IPv6 support, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe global --disable_ipv6

--enable_sso

You can enable SSO when you register the client to the portal. By default, SSO is disabled, so the user is prompted to enter credentials during SAML-based registration and reregistration. When you enable SSO, the client attempts a browser-based SSO using the Windows login credentials and tries to avoid prompting users for credentials.

To enable single sign-on (SSO), issue the following CLI command:

VSA>VersaSecureAccessClientConsole.exe global --enable_sso true

To disable SSO, issue the following CLI command:

C:\VSA>VersaSecureAccessClientConsole.exe global --enable_sso false

Display and Execute Pre-Logon Options

To view the pre-logon options, issue the following CLI command:

C:\Program Files (x86)\Versa Secure Access> VersaSecureAccessClientConsole.exe prelogon --help

For example:

C:\Program Files (x86)\Versa Secure Access> VersaSecureAccessClientConsole.exe prelogon --help
VersaSecureAccessClientConsole 7.9.1.0
Copyright c  2020

  --prelogon_config                Prelogon configuration file path
  --portal_fqdn                    Sets the default Portal FQDN for prelogon registration. To reset use --portal_fqdn ""
  --enterprise_name                Sets the default 'Enterprise Name' for prelogon registration. To reset use --enterprise_name ""
  --enable_certonlyauth            true to set the authentication type restricted only to Device Certificate for prelogon registration and connect.
                                   To reset use --enable_certonlyauth false ""
  --trusted_root_ca_certificate    Trusted root certificate for Secure Access Service
  --disconnect_prelogon            Disconnect prelogon connection
  --help                           Display this help screen.
  --version                        Display version information.

Note that to issue the pre-logon command options, you must have administrator privileges and you must be at the administrator command prompt. Also, save the pre-logon file (JSON) and CA certificate in your computer before you run the first two commands.

--prelogon_config

The pre-logon configuration option allows users to log in to the organization's VPN from a locked screen. For more information, see Configure Pre-Logon for the Versa Secure Access Client.

To apply the pre-logon configuration, issue the following CLI command:

c:\VSA> VersaSecureAccessClientConsole.exe prelogon --prelogon_config json-filename

For example:

c:\VSA> VersaSecureAccessClientConsole.exe prelogon --prelogon_config C:\Pre-Logon\PreLogonConfig.json
479 [1] INFO Versa Secure Access (null) - Starting application in prelogon_config mode. Version 7.4.1_24cd434d
577 [1] DEBUG Versa Secure Access (null) - Prelogon configuration initiated
578 [1] DEBUG Versa Secure Access (null) - Verifying and Applying Prelogon Configuration
2092 [1] DEBUG Versa Secure Access (null) - Prelogon Configuration Applied Successfully!

 --portal_fqdn

To set the default FQDN, issue the following command:

c:\VSA> VersaSecureAccessClientConsole.exe prelogon  --portal_fqdn fqdn

 --enterprise_name

To set the enterprise name FQDN, issue the following command:

c:\VSA> VersaSecureAccessClientConsole.exe prelogon  --enterprise_name enterprise

--enable_certonlyauth

To enable certificate-only authorization, issue the following command:

c:\VSA> VersaSecureAccessClientConsole.exe prelogon  --enable_certonlyauth true

--trusted_root_ca_certificate

Issue this command when the server uses private certificates and you want to add a root CA certificate. If the server uses trusted CA certificates, this command is optional.

To set the pre-logon configuration file path, issue the following CLI command:

c:\VSA> VersaSecureAccessClientConsole.exe prelogon --trusted_root_ca_certificate certificate-filename.cer

For example:

c:\VSA> VersaSecureAccessClientConsole.exe prelogon --trusted_root_ca_certificate C:\Certificate\VersaIntermediateCertificateAuthority1.cer
278 [1] INFO Versa Secure Access (null) - Starting application in prelogon_config mode. Version 7.4.1_24cd434d
417 [1] DEBUG Versa Secure Access (null) - Success!

--disconnect_prelogon

To disconnect the pre-logon VPN connection, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe prelogon --disconnect_prelogon

Display and Execute Client Options

To view the client options, issue the following CLI command:

C:\Program Files (x86)\Versa Secure Access> VersaSecureAccessClientConsole.exe client --help

For example:

C:\Program Files (x86)\Versa Secure Access>VersaSecureAccessClientConsole.exe client --help
881 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.9.3_350198313
VersaSecureAccessClientConsole 7.9.3.0
Copyright c  2020

  --display_default_logo                    (true|false). Enable/Disable default logo
  --hide_on_connect                         (true|false). Enable/Disable hide on connect
  --reconnect_interval                      [Deprecated] Delay between subsequent auto reconnect attempts in seconds
                                            (Range 1-10)
  --allow_alwayson_disconnect               [Deprecated] (true|false). Enable/Disable disconnecting always on profile
  --alwayson_reconnect_delay                [Deprecated] When always on profile is disconnected, reconnect will be
                                            attempted after specified timeDelay in minutes. (Range 1-30)
  --share_metrics_periodically              [Deprecated] (true|false). Enable/Disable sending periodic metrics info
  --post_metrics_interval                   [Deprecated] Interval between posting metrics info in minutes. (Range 1-30)
  --enable_fips_policy                      (true|false). Enable/Disable FIPS algorithm policy
  --enable_server_policy_alerts             (true|false). Enable/Disable CASB policy alerts from server
  --set_default_portal_fqdn                 Sets the default Portal FQDN for user registration. To reset use
                                            --set_default_portal_fqdn ""
  --set_default_enterprise_name             Sets the default enterprise name for user registration. To reset use
                                            --set_default_enterprise_name ""
  --set_default_username                    Sets the default username to be prefilled during registration. To reset use
                                            --set_default_username ""
  --restart_ipsec_service_on_disconnect     (true|false) Restart system's ipsec policy agent service on user disconnect
  --prefer_ie_browser_engine                (true|false) Forces to use IE browser for SAML authentication
  --sub_optimal_gateway_disconnect_delay    Time delay to auto disconnect sub optimal gateway in seconds.
  --enable_eip                              (true|false). Enable/Disable EIP ( Default is true)
  --enable_realtime_eip                     (true|false). Enable/Disable EIP ( Default is false). Note: If enable_eip is
                                            set to false, it will disable realtime as well
  --auto_update_defer_limit                 Max allowed limit to defer software auto update (Range 1-5)
  --auto_disconnect_interval                Time interval to auto disconnect tunnel if user authentication fails in
                                            minutes (Value >= 1 min)
  --reset_auto_disconnect_interval          Resets auto disconnect time interval. e.g. to use
                                            --reset_auto_disconnect_interval ""
  --auto_disconnect_reminder_time           Reminder will be shown to user before the specified time about tunnel auto
                                            disconnect in minutes. (Value >= 1 min)
  --reset_auto_disconnect_reminder_time     Resets auto disconnect reminder time. e.g. to use
                                            --reset_auto_disconnect_reminder_time ""
  --prefer_popout_browser                   (true|false) Application launches seperate pop out browser for IDP
                                            authentication
  --display_vpn_profile_in_os               (true|false). Allows VPN profile to be listed in Windows Network Settings (
                                            Default is false)
  --enable_auto_logon                       [Deprecated] (true|false). When enabled, logged in user information will be
                                            used for establishing vpn connection. This will be applied only when default
                                            enterpise_name, portal_fqdn and user_login_type value are set. ( Default is
                                            false)
  --logon_type                              [Deprecated] Sets the logon type to be used when AutoLogon flag is enabled.
                                            Possible values (1) - Email, (2) - Username
  --auto_register_max_retry_count           Maximum number of allowed auto register attempt. (Value >= 1 )
  --reset_auto_register_max_retry_count     Resets auto register retry count. e.g. to use
                                            --reset_auto_register_max_retry_count ""
  --prefer_gateway_assisted_tnd             (true|false). When enabled, gateway assisted trusted network detection will
                                            be given priority over trusted host name check
  --enable_tls_tunnel                       (true|false). When enabled, the client will attempt a TLS tunnel if
                                            configured in the gateway.
  --disable_custom_ip_resolution            (true|false). When enabled, the client will use the API request directly
                                            with FQDN instead of sending to a specific IP.
  --enable_dtls_tunnel                      (true|false). When enabled, the client will attempt a DTLS tunnel if
                                            configured in the gateway.
  --appearance                              (Light|Dark|Default) When set, the UI will change according to the theme set
  --reset_ssl_stats                         When provided, the client will attempt to reset SSL VPN connection
                                            statistics. Usage --reset_ssl_stats "{enterpriseName}"
  --fetch_username_from_certificate         To fetch username from personal certificate store e.g. To use
                                            --fetch_username_from_certificate true|false --cert_issuer <certificate
                                            issuer name> --username_field  CN | SAN --san_match_regex <regex>
  --add_user_cert_issuer                    Additional Certficate issuer names
  --remove_user_cert_issuer                 Remove Certficate issuer name
  --clear_auth_cookie_on_user_disconnect    (true|false). When enabled, user authentication cookie is cleared upon
                                            manual tunnel disconnect by user.
  --user_session_idle_timeout               Allowed idle ( no activity) time for user session to be inactive.(in
                                            minutes) (Value >= 1 min). 0 will reset idle time out
  --clear_auth_cookie_on_service_restart    (true|false). When enabled, user authentication cookie is cleared upon
                                            machine reboot or service restart.
  --use_system_browser                      (true|false). When enabled, system defaut browser will be used for
                                            authentication.
  --enable_eip_debug                        (true|false). When enabled, eip extensive debug logs with be collected.
  --heartbeat_timeout_interval              Heartbeat timeout interval for SSL VPN connection in minutes.
  --device_id                               Sets the device ID that MDM uses to manage this device. This value takes
                                            precedence over device ID retrieved from any other sources e.g. --device_id
                                            9908c957-7161-4235
  --allow_user_to_select_cert               When set to true, User will be prompted to choose a certificate for the
                                            device auth if there are more than 1 matching certificates. When set to
                                            false client will automatically pick the first matching certificate without
                                            prompting the user. Set to false by default.
  --disable_software_update                 (true|false). When set to true, User will not be allowed to manually update
                                            the new client version.
  --silent_install                          (true|false). Enable/Disable silent app install during software upgrade.
                                            Default is true, app will be installed silently.                                           
  --help                                    Display this help screen.
  --version                                 Display version information.

--display_default_logo

To display the default logo in the SASE client interface, issue the following CLI command. Note that to issue the display and disable SASE client logo commands, you must have administrator privileges and you must be at the administrator command prompt.

c:\VSA> VersaSecureAccessClientConsole.exe client --display_default_logo true

For example:

c:\VSA> VersaSecureAccessClientConsole.exe client --display_default_logo true
276 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.4.1_24cd434d
311 [1] INFO Versa Secure Access (null) - Enable Display default logo
398 [1] INFO Versa Secure Access (null) - Success!

Disable the default logo:

c:\VSA> VersaSecureAccessClientConsole.exe client --display_default_logo false

For example:

c:\VSA> VersaSecureAccessClientConsole.exe client --display_default_logo false
302 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.4.1_24cd434d
336 [1] INFO Versa Secure Access (null) - Disable Display default logo
419 [1] INFO Versa Secure Access (null) - Success!

--hide_on_connect

Use the hide on connect option to automatically close the SASE client UI 10 seconds after a successful VPN connection. This command requires an administrator login.

To enable automatic closing of the SASE client, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --hide_on_connect true

For example:

C:\VSA>VersaSecureAccessClientConsole.exe client --hide_on_connect true
664 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
714 [1] INFO Versa Secure Access (null) - Hide On Connect : True

To disable automatic closing of the SASE client UI, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --hide_on_connect false

For example:

C:\VSA>VersaSecureAccessClientConsole.exe client --hide_on_connect false
617 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
662 [1] INFO Versa Secure Access (null) - Hide On Connect : False

--reconnect_interval

To configure the time between autoreconnection attempts, in seconds, issue the following CLI command. The range is 1 through 10 seconds.

C:\VSA> VersaSecureAccessClientConsole.exe client --reconnect_interval seconds

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --reconnect_interval 5
290 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
329 [1] INFO Versa Secure Access (null) - Set Auto Reconnect interval
495 [1] INFO Versa Secure Access (null) - Success!

--allow_alwayson_disconnect

To enable disconnection of always on for a profile, issue the following CLI command. This command requires an administrator login.

C:\VSA> VersaSecureAccessClientConsole.exe client --allow_alwayson_disconnect true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --allow_alwayson_disconnect true
327 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
368 [1] INFO Versa Secure Access (null) - Configure disconnect always on preference.
855 [1] INFO Versa Secure Access (null) - Success!

To disable disconnection of always on for a profile, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --allow_alwayson_disconnect false

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --allow_alwayson_disconnect false
302 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
341 [1] INFO Versa Secure Access (null) - Configure disconnect always on preference.
591 [1] INFO Versa Secure Access (null) - Success!

--alwayson_reconnect_delay

Use this command to enter the time, in minutes, between reconnection attempts when always on is disconnected for a profile. The range is 1 through 30 minutes.

To set the always on reconnect delay, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --alwayson_reconnect_delay minutes

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --alwayson_reconnect_delay 10
326 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
371 [1] INFO Versa Secure Access (null) - Set AlwaysOn Delay Time
827 [1] INFO Versa Secure Access (null) - Success!

--share_metrics_periodically

To enable periodic metric sharing, issue the following CLI command. This command requires an administrator login.

C:\VSA>VersaSecureAccessClientConsole.exe client --share_metrics_periodically true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --share_metrics_periodically true
300 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
341 [1] INFO Versa Secure Access (null) - Configure periodic metric share preference.
749 [1] INFO Versa Secure Access (null) - Success!

To disable periodic metric sharing, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --share_metrics_periodically false

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --share_metrics_periodically false
308 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
349 [1] INFO Versa Secure Access (null) - Configure periodic metric share preference.
761 [1] INFO Versa Secure Access (null) - Success!

--post_metrics_interval

Use this command to enter the time, in minutes, between posting metrics. The range is 1 through 30 minutes.

To set the interval for posting metrics, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --post_metrics_interval minutes

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --post_metrics_interval 5
316 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
358 [1] INFO Versa Secure Access (null) - Configure send metrics interval
748 [1] INFO Versa Secure Access (null) - Success!

--enable_fips_policy

To enable the Federal Information Processing Standards (FIPS) algorithm policy, issue the following CLI command. This command requires an administrator login.

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_fips_policy true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_fips_policy true
358 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
398 [1] INFO Versa Secure Access (null) - Configure FIPS policy preference.
742 [1] INFO Versa Secure Access (null) - Success!

To disable the FIPS algorithm policy, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_fips_policy false

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_fips_policy false
360 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
400 [1] INFO Versa Secure Access (null) - Configure FIPS policy preference.
2815 [1] INFO Versa Secure Access (null) - Success!

--enable_server_policy_alerts

To enable Cloud Access Security Broker (CASB) policy alerts from server, issue the following CLI command. This command requires an administrator login.

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_server_policy_alerts true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_server_policy_alerts true
320 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
359 [1] INFO Versa Secure Access (null) - Configuring server casb policy alerts display preference.
647 [1] INFO Versa Secure Access (null) - Success!

To disable CASB policy alerts from server:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_server_policy_alerts false

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_server_policy_alerts false
305 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
347 [1] INFO Versa Secure Access (null) - Configuring server casb policy alerts display preference.
538 [1] INFO Versa Secure Access (null) - Success!

--set_default_portal_fqdn

To set the default FQDN for user registration, issue the following CLI command. This command requires an administrator login.

C:\VSA> VersaSecureAccessClientConsole.exe client --set_default_portal_fqdn fqdn

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --set_default_portal_fqdn name.com
301 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
341 [1] INFO Versa Secure Access (null) - Setting default portal FQDN: name.com
585 [1] INFO Versa Secure Access (null) - Successfully configured default portal FQDN!

To reset the default FQDN for user registration, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --set_default_portal_fqdn "fqdn"

--set_default_enterprise_name

To set the default enterprise name for user registration, issue the following CLI command. This command requires an administrator login.

C:\VSA> VersaSecureAccessClientConsole.exe client --set_default_enterprise_name "Versa Networks"

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --set_default_enterprise_name "Versa Networks"
718 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_d72e3e6f
796 [1] INFO Versa Secure Access (null) - Setting default Enterprise Name: Versa Networks
1031 [1] INFO Versa Secure Access (null) - Successfully configured default Enterprise Name!

--set_default_username

To set the default username for first time registration, issue the following CLI command. This command requires an administrator login.

C:\VSA> VersaSecureAccessClientConsole.exe client --set_default_username username

For example:

C:\VSA>VersaSecureAccessClientConsole.exe client --set_default_username martha
617 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
661 [1] INFO Versa Secure Access (null) - Setting default Username: martha
1551 [1] INFO Versa Secure Access (null) - Successfully configured default Username for registration

--restart_ipsec_service_on_disconnect

To restart the IPsec policy agent service when a user disconnects, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --restart_ipsec_service_on_disconnect true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --restart_ipsec_service_on_disconnect true
645 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.0_aa6f120a
686 [1] INFO Versa Secure Access (null) - Setting restart IPSec service on user disconnect to: True
1116 [1] INFO Versa Secure Access (null) - Successfully set IPSec service restart on user disconnect to: True!

To disable the restarting of the IPsec policy agent service when a user disconnects, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --restart_ipsec_service_on_disconnect false

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --restart_ipsec_service_on_disconnect false
648 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.0_aa6f120a
693 [1] INFO Versa Secure Access (null) - Setting restart IPSec service on user disconnect to: False
1104 [1] INFO Versa Secure Access (null) - Successfully set IPSec service restart on user disconnect to: False!

--prefer_ie_browser_engine

To use the Internet Explorer (IE) browser for SAML authentication, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --prefer_ie_browser_engine true

For example:

C:\VSA>VersaSecureAccessClientConsole.exe client  --prefer_ie_browser_engine true
662 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.0_aa6f120a
710 [1] INFO Versa Secure Access (null) - Use IE Engine as preferred browser control: True
1099 [1] INFO Versa Secure Access (null) - Successfully set IE as preferred browser engine!

To disable use of the Internet Explorer browser for SAML authentication, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --prefer_ie_browser_engine false

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client  --prefer_ie_browser_engine false
657 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.0_aa6f120a
701 [1] INFO Versa Secure Access (null) - Use IE Engine as preferred browser control: False
1078 [1] INFO Versa Secure Access (null) - Successfully reset preferred browser engine to default value!

--sub_optimal_gateway_disconnect_delay

Use this command to configure the disconnect time for a non-optimal gateway. When connecting to a dynamic optimal gateway, the client establishes a new connection with a lower metric without disconnecting the old tunnel. The old, or non-optimal, tunnel automatically disconnects after 30 minutes. Automatic reconnection occurs only when the optimal gateway is disconnected.

To configure the sub-optimal gateway disconnect delay, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --sub_optimal_gateway_disconnect_delay delay-time-in-seconds

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --sub_optimal_gateway_disconnect_delay 10 seconds
574 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.0_aa6f120a
617 [1] INFO Versa Secure Access (null) - Set sub-optimal gateway auto disconnect delay
855 [1] INFO Versa Secure Access (null) - Success!

--enable_eip

Use this command to enable or disable endpoint information profile (EIP). 

EIP is enabled by default for the SASE client. To disable EIP, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_eip false

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_eip false
575 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.0_aa6f120a
614 [1] INFO Versa Secure Access (null) - Turning OFF EIP feature.
887 [1] INFO Versa Secure Access (null) - Success!
887 [1] INFO Versa Secure Access (null) - Configure EIP collection preference.
925 [1] INFO Versa Secure Access (null) - Success!

To re-enable EIP, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_eip true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_eip true
585 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.0_aa6f120a
666 [1] INFO Versa Secure Access (null) - Turning ON EIP feature.
933 [1] INFO Versa Secure Access (null) - Success!
933 [1] INFO Versa Secure Access (null) - Configure EIP collection preference.
986 [1] INFO Versa Secure Access (null) - Success!

--enable_realtime_eip

To enable real-time EIP, issue the following CLI command. Note that --enable_realtime_eip is disabled if you set --enable_eip to False. This command requires an administrator login.

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_realtime_eip true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_realtime_eip true
682 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
842 [1] INFO Versa Secure Access (null) - Turning ON EIP feature. DisableRealTimeEIPCollection.
1759 [1] INFO Versa Secure Access (null) - Success!
1761 [1] INFO Versa Secure Access (null) - Configure Realtime EIP collection preference.
1889 [1] DEBUG Versa Secure Access (null) - IsEIPSupported: True

--auto_update_defer_limit

Use this command to configure the maximum allowed limit, in days, to defer an automatic software update. The range is 1 through 5 days.

To set the auto update defer limit, issue the following CLI command. This command requires an administrator login.

C:\VSA> VersaSecureAccessClientConsole.exe client --auto_update_defer_limit 1 through 5

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --auto_update_defer_limit 3
575 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.0_aa6f120a
607 [1] INFO Versa Secure Access (null) - Set Auto Update defer limit
857 [1] INFO Versa Secure Access (null) - Success!

--auto_disconnect_interval

Use this command to configure the tunnel automatic disconnecter, in minutes. You configure this on the Versa Secure Access portal and then share the configuration with the SASE client during registration or reregistration. The value must be greater than or equal to 1. This command requires an administrator login.

C:\VSA> VersaSecureAccessClientConsole.exe client --auto_disconnect_interval

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --auto_disconnect_interval 2
628 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
673 [1] INFO Versa Secure Access (null) - Set Auto Disconnect interval
1447 [1] INFO Versa Secure Access (null) - Success!

To reset the automatic disconnect interval, issue the following CLI command. This option is available for all registered enterprises. If you set the interval at the server and client CLI levels, the server configuration has preference.

C:\VSA> VersaSecureAccessClientConsole.exe client --reset_auto_disconnect_interval

--auto_disconnect_reminder_time

Use this option to configure the reminder time for automatic disconnection, in minutes. The value must be greater than or equal to 1. The default time is 15 minutes.

To configure the automatic disconnect reminder time, issue the following CLI command. This command requires an administrator login.

C:\VSA> VersaSecureAccessClientConsole.exe client --auto_disconnect_reminder_time time

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --auto_disconnect_reminder_time 20
582 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
623 [1] INFO Versa Secure Access (null) - Set Auto Disconnect Reminder Time
917 [1] INFO Versa Secure Access (null) - Success!

To reset the automatic disconnect reminder time to the default value, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --reset_auto_disconnect_reminder_time

--prefer_popout_browser

To enable the display of a popup browser for SAML authentication, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --prefer_popout_browser true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --auto_disconnect_reminder_time 20
582 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
623 [1] INFO Versa Secure Access (null) - Set Auto Disconnect Reminder Time
917 [1] INFO Versa Secure Access (null) - Success!

To disable the display of a popup browser for SAML authentication, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --prefer_popout_browser false

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --prefer_popout_browser false
698 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
745 [1] INFO Versa Secure Access (null) - Use pop out browser as preferred for web authentication: False
1205 [1] INFO Versa Secure Access (null) - Successfully reset pop out browser preference

--display_vpn_profile_in_os

To enable the listing of the VPN profile in the Windows network settings, issue the following CLI command. The default value is false. This command requires an administrator login.

C:\VSA> VersaSecureAccessClientConsole.exe client --display_vpn_profile_in_os true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --display_vpn_profile_in_os true
578 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
618 [1] INFO Versa Secure Access (null) - Display VPN Profile in OS : True
888 [1] INFO Versa Secure Access (null) - Successfully set "Display VPN Profile in OS" preference!

To disable the listing of the VPN profile in the Windows network settings, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --display_vpn_profile_in_os false

--auto_register_max_retry_count

Use this option to set the limit for the maximum number of attempts for automatic registration. The value must be greater than or equal to 1.

To set the maximum retry count, issue the following command. This command requires an administrator login.

C:\VSA> VersaSecureAccessClientConsole.exe client --auto_register_max_retry_count limit

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --auto_register_max_retry_count 5
614 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
659 [1] INFO Versa Secure Access (null) - The requested operation requires elevation.

--reset_auto_register_max_retry_count

To reset the retry count for automatic registration, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --reset_auto_register_max_retry_count " " 

--prefer_gateway_assisted_tnd

To prioritize gateway-assisted trusted network detection over trusted hostname-based network detection when both networks are configured, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --prefer_gateway_assisted_tnd true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe client --prefer_gateway_assisted_tnd true
706 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
751 [1] INFO Versa Secure Access (null) - Use gateway assisted trusted network detection: True
1212 [1] INFO Versa Secure Access (null) - Successfully set gateway assisted trusted network detection method as preferred!

To disable this prioritization, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --prefer_gateway_assisted_tnd false

--enable_tls_tunnel and --enable_dtls_tunnel

By default, TLS and DTLS tunnels are disabled. When you enable TLS Tunnel or DTLS tunnel, the client tries to establish a tunnel based on the tunnel type order it receives from the portal. If the first attempt fails, the client tries to connect to the next tunnel type in the configuration order. If you have administrator privileges, you can enable or disable these tunnels using the CLI:

To enable TLS tunnel, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_tls_tunnel true

To disable TLS tunnel, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_tls_tunnel true

To enable DTLS tunnel, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_dtls_tunnel true

To disable DTLS tunnel, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_dtls_tunnel true

--appearance

To change display options using the CLI, issue the following command (default, dark, light are the display options):

C:\VSA> VersaSecureAccessClientConsole.exe client --appearance default/light/dark

For example:

C:\Program Files (x86)\Versa Secure Access>VersaSecureAccessClientConsole.exe client --appearance light
1699 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.9.1_45ee8d413
2264 [1] INFO Versa Secure Access (null) - Setting preffered Theme : light
3428 [1] INFO Versa Secure Access (null) - Successfully configured the Theme: light
3428 [1] INFO Versa Secure Access (null) - Theme is reset successfully!

--reset_ssl_stats

To  reset SSL VPN connection statistics of an enterprise, issue the following CLI command. Note that to issue this command, you must have administrator privileges and you must be at the administrator command prompt:

C:\VSA> VersaSecureAccessClientConsole.exe client --reset_ssl_stats

--add_user_cert_issuer

To add a new certificate issuer name, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --add_user_cert_issuer

To enable accepting multiple certificate issuers to retrieve usernames from a Smart Card certificate, see --fetch_username_from_certificate.

--remove_user_cert_issuer

To remove a new certificate issuer name, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --remove_user_cert_issuer

--clear_auth_cookie_on_user_disconnect

Clear authentication token when user manually disconnects tunnel or if it disconnects when the auto-disconnect interval expires:

To enable issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --clear_auth_cookie_on_user_disconnect true

To disable, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --clear_auth_cookie_on_user_disconnect false

--user_session_idle_timeout

Clear authentication token when user attempts to connect after a session times out on exceeding the idle timeout interval. To enable, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --user_session_idle_timeout interval in seconds

To disable user session idle timeout, set interval to 0.

--clear_auth_cookie_on_service_restart

Clear authentication token when Versa service restarts (for example, system restart):

To enable, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --clear_auth_cookie_on_service_restart true

To disable, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --clear_auth_cookie_on_service_restart false

--use_system_browser

Allows you to use the system default browser for SAML authentication instead of the in-app browser. When you enable this, the client displays the system default browser to follow HTTP redirection to the IDP login URL:

To enable, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --use_system_browser true

To disable, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --use_system_browser false

--enable_eip_debug

Enable to collect extensive EIP debug logs: 

To enable, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_eip_debug true

To disable, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --enable_eip_debug false

 --heartbeat_timeout_interval

To set the heartbeat timeout interval for SSL VPN connection in minutes, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --heartbeat_timeout_interval interval in minutes

--device_id

To pre-configure the default device ID for a device, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --device_id device-ID 

--allow_user_to_select_cert

 When set to True, user is prompted to choose a certificate for device authentication, if there are more than one matching certificates. If set to False, client automatically picks the first matching certificate without prompting the user. Set to False by default:

To enable, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --allow_user_to_select_cert true

To disable, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --allow_user_to_select_cert false

--fetch_username_from_certificate

To fetch username from personal certificate store, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --fetch_username_from_certificate true|false --cert_issuer 
certificate issuer name --username_field  CN | SAN --san_match_regex regex

--disable_software_update

 To disable software updates in the client UI, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --disable_software_update true

--silent_install

Automatic update supports silent client installation. In silent mode, the package installer GUI is not displayed to the user. The installation takes place in the background and the application relaunches after a successful installation.

To enable, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --silent_install true

To disable, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe client --silent_install false

Display and Execute Monitor Options

To view the monitor options, issue the following CLI command:

C:\Program Files (x86)\Versa Secure Access> VersaSecureAccessClientConsole.exe monitor --help

For example:

C:\Program Files (x86)\Versa Secure Access> VersaSecureAccessClientConsole.exe monitor --help
VersaSecureAccessClientConsole 7.8.0.0

  --tunnel_monitor                   [Deprecated] (true|false). Enable/Disable tunnel monitoring
  --tunnel_monitor_interval          [Deprecated] Tunnel monitor interval in seconds. (Range 10-600)
  --tunnel_monitor_retry_interval    [Deprecated] Interval between each retry for tunnel monitoring in seconds. (Range 1-5)
  --tunnel_monitor_retry_count       [Deprecated] Number of retry attempts before concluding the tunnel is down. (Range 1-5)
  --help                             Display this help screen.
  --version                          Display version information.

--tunnel_monitor

To enable tunnel monitoring, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe monitor --tunnel_monitor true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe monitor --tunnel_monitor true
296 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
343 [1] INFO Versa Secure Access (null) - Configure DNS monitoring.
511 [1] INFO Versa Secure Access (null) - Success!

To disable tunnel monitoring, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe monitor --tunnel_monitor false

For example:

C:\VSA> VersaSecureAccessClientConsole.exe monitor --tunnel_monitor false
294 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
334 [1] INFO Versa Secure Access (null) - Configure DNS monitoring.
495 [1] INFO Versa Secure Access (null) - Success!

--tunnel_monitor_interval

To configure the tunnel monitoring interval, in seconds, issue the following CLI command. The range is 10 through 600 seconds.

C:\VSA> VersaSecureAccessClientConsole.exe monitor --tunnel_monitor_interval seconds

For example:

C:\VSA> VersaSecureAccessClientConsole.exe monitor --tunnel_monitor_interval 30
623 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
930 [1] INFO Versa Secure Access (null) - Configure tunnel monitoring interval
1525 [1] INFO Versa Secure Access (null) - Success!

--tunnel_monitor_retry_interval

Use this option to configure the interval, in seconds, between each try before concluding the tunnel is down. The range is 1 through 5 seconds. 

To configure the tunnel monitor retry interval, issue the following CLI command: 

C:\VSA> VersaSecureAccessClientConsole.exe monitor --tunnel_monitor_retry_interval seconds

For example:

C:\VSA> VersaSecureAccessClientConsole.exe monitor --tunnel_monitor_retry_interval 4
321 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
368 [1] INFO Versa Secure Access (null) - Configure DNS monitor retry interval.
716 [1] INFO Versa Secure Access (null) - Success!

--tunnel_monitor_retry_count

To configure the maximum number of retry attempts before concluding the tunnel is down, issue the following CLI command. The range is 1 through 5.

C:\VSA> VersaSecureAccessClientConsole.exe monitor --tunnel_monitor_retry_count retries

For example:

C:\VSA> VersaSecureAccessClientConsole.exe monitor --tunnel_monitor_retry_interval 4
321 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
368 [1] INFO Versa Secure Access (null) - Configure DNS monitor retry interval.
716 [1] INFO Versa Secure Access (null) - Success!

Display and Execute Service Options

To view the service options, issue the following CLI command:

C:\Program Files (x86)\Versa Secure Access> VersaSecureAccessClientConsole.exe service --help

For example:

C:\Program Files (x86)\Versa Secure Access>VersaSecureAccessClientConsole.exe service --help
VersaSecureAccessClientConsole 7.8.7.0

VersaSecureAccessClientConsole 7.9.1.0

  --enable_apptunnel                                    (true|false). Enable/Disable App tunnel driver
  --fail_open_mode                                      [Deprecated] Set driver to fail open mode
  --fail_close_mode                                     [Deprecated] Set driver to fail close mode
  --restricted_access_fallback_duration                 [Deprecated] Duration in seconds for which Restricted Access
                                                        will be relaxed, when user disables Restricted Access.
                                                        Restricted Access would be enabled back after the duration
                                                        completes (Range: 5 - 600)
  --allow_domains                                       Allow domains/FQDNs in fail close mode. ex for domain:
                                                        .versa-networks.com, OR ".versa-networks.com .office365.com" ex
                                                        for FQDN: test.versa-networks.com, OR "test.versa-networks.com
                                                        test.office365.com"
  --reset_domains                                       Remove domains/FQDNs that were allowed in fail close mode. ex
                                                        for domain: .versa-networks.com, OR ".versa-networks.com
                                                        .office365.com" ex for FQDN: test.versa-networks.com, OR
                                                        "test.versa-networks.com test.office365.com"
  --allow_ips                                           Allow IP(s) in fail close mode, ex: 10.0.0.1, OR "10.0.0.1
                                                        10.0.0.2"
  --reset_ips                                           Remove IP(s) that was allowed in fail close mode. ex: 10.0.0.1,
                                                        OR "10.0.0.1 10.0.0.2"
  --strict_full_tunnel                                  (true|false) When connected to gateway in full tunnel mode, the
                                                        traffic may go through underlay if there are any routes through
                                                        underlay interface. By setting the the option to true, routes
                                                        through underlay will not be effective; the traffic will be sent
                                                        through underlay only if they match any of excluded domain,
                                                        excluded application, excluded subnets or trusted subnets. When
                                                        the option is set to false: The routes will influence traffic
                                                        through underlay or any other interface
  --trusted_subnets                                     Trusted subnets to be excluded in case of full-tunnel and semi
                                                        trusted modeEx: 192.168.1.0/24 OR "192.168.1.0/24
                                                        192.168.2.0/24"
  --reset_trusted_subnets                               Reset the trusted subnets which are excluded in case of
                                                        full-tunnel and semi trusted modeEx: 192.168.1.0/24 OR
                                                        "192.168.1.0/24 192.168.2.0/24"
  --clean_dns_nrpt_rule                                 Clean all stale DNS NRPT rules
  --exclude_subnets                                     Add one or more subnets to be excluded in case of full-tunnelEx:
                                                        192.168.1.0/24 OR "192.168.1.0/24 192.168.2.0/24"
  --reset_exclude_subnets                               Remove one or more subnets which are excluded in case of
                                                        full-tunnelEx: 192.168.1.0/24 OR "192.168.1.0/24 192.168.2.0/24"
  --apptunnel_bypass_application                        Command to add application(s) to Versa Client bypass list.The
                                                        traffic originated by these bypassed applications won't be
                                                        processed by Versa client.Use this command to Ex: "red.exe" OR
                                                        "blue.exe|black.exe|only white.exe"
  --apptunnel_bypass_application_reset                  Command to clear the list of applications that were bypassed
                                                        from Versa Client
  --apptunnel_list_bypassed_applications                Command to show the list of applications that were bypassed from
                                                        Versa Client
  --block_icmp_on_fail_close                            (true|false) Block ICMP Traffic in Fail-Close Mode

  --Allow_Excluded_Application_traffic_on_fail_close    (true|false) Allow Excluded Application Traffic in Fail-Close
                                                        Mode
  --exclude_service                                     Allows TCP/UDP traffic to be excluded for the specified Port and
                                                        IP when in full-tunnel.
                                                        Ex: Exclude based on Service and Ports: "TCP::1002" or
                                                        "TCP::1002:1003:1004"
                                                         Exclude based on Service with Ports and IP:
                                                         "TCP::1002|10.0.0.1, 10.0.0.2"
                                                         Exclude based on Service with Ports and IP Prefix:
                                                         "TCP::1002|10.0.0.1/24" or "TCP::1002|10.0.0.1/24,10.0.0.2/24"
                                                         or
                                                         "TCP::1002|10.0.0.1/24,10.0.0.2/24:1003|10.0.0.3/24,10.0.0.4/24
                                                         "
  --reset_exclude_service                               Removes TCP/UDP traffic exclusions which were added using
                                                        exclude_service command.
                                                        Ex: Remove exclusion based on Service and Ports: "TCP::1002" or
                                                        "TCP::1002:1003:1004"
                                                        Remove exclusion based on Service with Ports and IP:
                                                        "TCP::1002|10.0.0.1, 10.0.0.2"
                                                        Remove exclusion based on Service Ports and IP Prefix:
                                                        "TCP::1002|10.0.0.1/24" or "TCP::1002|10.0.0.1/24,10.0.0.2/24"
                                                        or
                                                        "TCP::1002|10.0.0.1/24,10.0.0.2/24:1003|10.0.0.3/24,10.0.0.4/24"
  --set_data_exfiltration_warning                       Data exfiltration warning to be displayed to the end user
  --help                                                Display this help screen.
  --version                                             Display version information.

--enable_apptunnel

Use this option to enable the application tunnel driver to enable application and domain-based traffic steering and fail-mode services. Note that to issue these commands, you must have administrator privileges and you must be at the administrator command prompt.

To enable the application tunnel driver for SASE client, issue the following CLI command: 

C:\VSA> VersaSecureAccessClientConsole.exe monitor service --enable_apptunnel true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe service --enable_apptunnel true
309 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
350 [1] INFO Versa Secure Access (null) - Enable App Tunnel Driver
859 [1] INFO Versa Secure Access (null) - Success!

To disable the application tunnel driver for SASE client, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe monitor service --enable_apptunnel false

For example:

C:\VSA> VersaSecureAccessClientConsole.exe service --enable_apptunnel false
277 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
315 [1] INFO Versa Secure Access (null) - Disable App Tunnel Driver

--fail_open_mode

To set the application tunnel driver to FAIL_OPEN mode for the client to allow all outgoing traffic when the client is not connected to a gateway, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe service --fail_open_mode

For example:

C:\VSA> VersaSecureAccessClientConsole.exe service --fail_open_mode
356 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
412 [1] INFO Versa Secure Access (null) - Setting apptunnel driver mode to FAIL_OPEN
803 [1] INFO Versa Secure Access (null) - Success!

--fail_close_mode

To set the application tunnel driver to FAIL_CLOSE mode for the client to block all outgoing traffic (except ICMP, allowed domains, and IP addresses) when the client is not connected to a gateway, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe service --fail_close_mode

For example:

C:\VSA> VersaSecureAccessClientConsole.exe service --fail_close_mode
279 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
316 [1] INFO Versa Secure Access (null) - Setting Apptunnel driver mode to FAIL_CLOSE
450 [1] INFO Versa Secure Access (null) - Success!

--restricted_access_fallback_duration

Use this option to configure the duration, in seconds, after which restricted access is enabled again. The range is 5 through 500 seconds. When a user enables restricted access, it is disabled for the specified amount of time and then re-enabled. Note that to issue this command, you must have administrator privileges and you must be at the administrator command prompt.

To configure the restricted access fallback duration, issue the following CLI command: 

C:\VSA> VersaSecureAccessClientConsole.exe service --restricted_access_fallback_duration seconds

For example:

C:\VSA> VersaSecureAccessClientConsole.exe service --restricted_access_fallback_duration 120
278 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
454 [1] INFO Versa Secure Access (null) - Success!

--allow_domains

Use this option to enable domain traffic in FAIL_CLOSE mode. You can specify the domains to be allowed if the tunnel is not connected and FAIL_CLOSE mode is enabled. Note that to issue the commands to enable or disable domains in FAIL_CLOSE mode, you must have administrator privileges and you must be at the administrator command prompt.

To allow domains in FAIL_CLOSE mode, issue the following CLI command: 

C:\VSA> VersaSecureAccessClientConsole.exe service --allow_domains domain-name

For example:

C:\VSA> VersaSecureAccessClientConsole.exe service --allow_domains money.com
282 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
321 [1] INFO Versa Secure Access (null) - Registering domain money.com to whitelist
536 [1] INFO Versa Secure Access (null) - Restarting Services...
615 [1] INFO Versa Secure Access (null) - Success!

--reset_domains

To disable or remove domains that were allowed in FAIL_CLOSE mode, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe service --reset_domains domain-name

For example:

C:\VSA> VersaSecureAccessClientConsole.exe" service --reset_domains money.com
278 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
315 [1] INFO Versa Secure Access (null) - Unregistering domain money.com from whitelist
484 [1] INFO Versa Secure Access (null) - Restarting Services...
538 [1] INFO Versa Secure Access (null) - Success!

--allow_ips

Use this option to enable or allow IP addresses in FAIL_CLOSE mode. Note that to issue the commands to enable or disable IP addresses in fail close mode, you must have administrator privileges and you must be at the administrator command prompt.

To allow IP addresses in FAIL_CLOSE mode, issue the following CLI command: 

C:\VSA> VersaSecureAccessClientConsole.exe service --allow_ips ip-address

For example:

C:\VSA> VersaSecureAccessClientConsole.exe service --allow_ips 10.10.10.10
279 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
317 [1] INFO Versa Secure Access (null) - Registering IP 10.10.10.10 to whitelist
514 [1] INFO Versa Secure Access (null) - Restarting Services...
567 [1] INFO Versa Secure Access (null) - Success!

--reset_ips

To disable or remove IP addresses that were allowed in FAIL_CLOSE mode, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe service --reset_ips ip-address

For example:

C:\VSA> VersaSecureAccessClientConsole.exe" service --reset_ips 10.10.10.10
281 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.5.9_6f38b04e
318 [1] INFO Versa Secure Access (null) - Unregistering IP 10.10.10.10 from whitelist
533 [1] INFO Versa Secure Access (null) - Restarting Services...
588 [1] INFO Versa Secure Access (null) - Success!

--strict_full_tunnel

Configure strict full tunnel (administrator mode). When the client connects to a gateway in full tunnel mode, the traffic may go through underlay if there are routes through underlay interface. If you enable strict full tunnel, routes through underlay are not effective, and traffic is sent through underlay only if they match any of excluded domain, excluded application, excluded subnets, or trusted subnets. When you disable strict full tunnel, routes influence traffic through underlay or any other interface.

To enable strict full tunnel, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe service --strict_full_tunnel true

For example:

C:\VSA>VersaSecureAccessClientConsole.exe service --strict_full_tunnel true
591 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.0_aa6f120a
630 [1] INFO Versa Secure Access (null) - Set strict full tunnel: True
907 [1] INFO Versa Secure Access (null) - Success!

To disable strict full tunnel, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe service --strict_full_tunnel false

For example:

C:\VSA>VersaSecureAccessClientConsole.exe service --strict_full_tunnel false
571 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.0_aa6f120a
609 [1] INFO Versa Secure Access (null) - Set strict full tunnel: False
852 [1] INFO Versa Secure Access (null) - Success!

--trusted_subnets

You can configure trusted subnets that bypass the tunnel. In semitrusted mode, the SASE client establishes a tunnel to the SASE gateway even when a trusted host is reachable without the tunnel. You can use semitrusted mode in deployments in which the site or branch CPE does not have a secure tunnel connection to the SASE gateway. The client establishes a tunnel to the gateway for all traffic expect for traffic to trusted subnets.

To configure trusted subnets, issue the following CLI command: 

C:\VSA> VersaSecureAccessClientConsole.exe service --trusted_subnets subnet

For example:

C:\VSA>VersaSecureAccessClientConsole.exe service --trusted_subnets 192.168.1.0/24
576 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
618 [1] INFO Versa Secure Access (null) - Registering trusted subnets 192.168.1.0/24
891 [1] INFO Versa Secure Access (null) - Success!

To configure multiple trusted subnets, enclose the subnets in quotation marks; for example, "192.168.1.0/24 192.168.2.0/24".

--reset_trusted_subnets

To reset trusted subnets, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe service --reset_trusted_subnets subnet

For example:

C:\VSA> VersaSecureAccessClientConsole.exe service --reset_trusted_subnets 192.168.1.0/24
532 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.2_6ab2577f
569 [1] INFO Versa Secure Access (null) - Unregistering trusted subnets 192.168.1.0/24
817 [1] INFO Versa Secure Access (null) - Success!

--clean_dns_nrpt_rule

To clear all stale DNS name resolution policy table (NRPT) rules, issue the following CLI command:

C:\VSA>VersaSecureAccessClientConsole.exe service --clean_dns_nrpt_rule

For example:

C:\VSA> VersaSecureAccessClientConsole.exe service --clean_dns_nrpt_rule
652 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.0_aa6f120a
695 [1] INFO Versa Secure Access (null) - Clear DNS NRPT Rules
1513 [1] INFO Versa Secure Access (null) - Success!

--exclude_subnets

Use this option to exclude one or more subnets from a full tunnel. When you configure a full tunnel, all traffic redirects through the tunnel interface. When you exclude a subnet from a full tunnel, the subnet's traffic goes through the default underlay instead of over the tunnel. 

To exclude subnets, issue the following CLI command: 

C:\VSA> VersaSecureAccessClientConsole.exe service --exclude_subnets subnets

For example:

C:\VSA> VersaSecureAccessClientConsole.exe service --exclude_subnets 192.168.2.0/24
581 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.0_aa6f120a
620 [1] INFO Versa Secure Access (null) - Excluding subnets 192.168.2.0/24
984 [1] INFO Versa Secure Access (null) - Success!

--reset_exclude_subnets

To remove one or more subnets that have been excluded from a full tunnel, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe service --reset_exclude_subnets subnets

For example:

C:\VSA> VersaSecureAccessClientConsole.exe service --reset_exclude_subnets 192.168.2.0/24
546 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.2_6ab2577f
583 [1] INFO Versa Secure Access (null) - Reset excluded subnets 192.168.2.0/24
830 [1] INFO Versa Secure Access (null) - Success!

--apptunnel_bypass_application

Use this option to add applications to the bypass list of the SASE client so that the client does not process traffic that originates from the bypassed applications. For example, you can use red.exe, blue.exe, or black.exe to bypass these applications. Issuing this command requires admin login.

To add applications to the bypass list, issue the following CLI command: 

C:\VSA> VersaSecureAccessClientConsole.exe service --apptunnel_bypass_application application-name

For example:

C:\VSA> VersaSecureAccessClientConsole.exe service --apptunnel_bypass_application black.exe
709 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
929 [1] DEBUG Versa Secure Access (null) - executable name: black.exe
1676 [1] INFO Versa Secure Access (null) - Success!

--apptunnel_bypass_application_reset

To clear or reset the bypass list of applications, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe service --apptunnel_bypass_application_reset

--apptunnel_list_bypassed_applications

To display applications that the client bypasses, issue the following CLI command. This command requires an administrator login.

C:\VSA> VersaSecureAccessClientConsole.exe service --apptunnel_list_bypassed_applications

For example:

C:\VSA> VersaSecureAccessClientConsole.exe service --apptunnel_list_bypassed_applications
613 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
677 [1] INFO Versa Secure Access (null) - ByPass Application List
ByPass application: black.exe
ByPass application: red.exe
ByPass application: blue.exe
743 [1] INFO Versa Secure Access (null) - Success!

--block_icmp_on_fail_close

To allow ICMP traffic in FAIL_CLOSE mode, issue the following CLI command. This command requires an administrator login.

C:\VSA> VersaSecureAccessClientConsole.exe service --block_icmp_on_fail_close true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe service --block_icmp_on_fail_close true
605 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
656 [1] INFO Versa Secure Access (null) - Set Block ICMP in Fail Close Mode: True
1044 [1] INFO Versa Secure Access (null) - Success!

To disable ICMP traffic in FAIL_CLOSE mode, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe service --block_icmp_on_fail_close false

--Allow_Excluded_Application_traffic_on_fail_close

To allow DNS traffic for excluded applications in FAIL-CLOSE mode, issue the following CLI command. This command requires an administrator login.

C:\VSA> VersaSecureAccessClientConsole.exe service --Allow_Excluded_Application_traffic_on_fail_close true

For example:

C:\VSA> VersaSecureAccessClientConsole.exe service --Allow_Excluded_Application_traffic_on_fail_close true
624 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
673 [1] INFO Versa Secure Access (null) - Set Allow Excluded Application Traffic in Fail Close Mode: True
994 [1] INFO Versa Secure Access (null) - Success!

To disable DNS traffic for excluded applications in FAIL_CLOSE mode, issue the following CLI command:

C:\VSA> VersaSecureAccessClientConsole.exe service --Allow_Excluded_Application_traffic_on_fail_close false

--exclude_service

To exclude TCP/UDP traffic based on service, port number, and IP address when in full-tunnel mode, issue the following CLI command:

C:\VSA> Versa Secure Access>VersaSecureAccessClientConsole.exe service --exclude_service service-name

For example:

C:\VSA> VersaSecureAccessClientConsole.exe service --exclude_service TCP::1002
624 [1] INFO Versa Secure Access (null) - Starting application in console mode. Version 7.8.7_ce167b8e
1843 [1] INFO Versa Secure Access (null) - Exclude services is set: True

--reset_exclude_service

To remove or reset traffic exclusions, issue the following CLI command:

C:\VSA> Versa Secure Access>VersaSecureAccessClientConsole.exe service --reset_exclude_service service-name

For example:

C:\VSA> Versa Secure Access>VersaSecureAccessClientConsole.exe service --reset_exclude_service TCP::1002