update fortinet free vpn

# Requires PowerShell 5.1 or later.
# This script must be run with Administrator privileges.

##
# script requirement:
# .\ipsec.xml which is an export of a configuration (FCConfig.exe) that Includes the "ipsec connection" that you want to add to other installs
#  run this to generate the .xml: FCConfig.exe -m all -f c:\temp\ipsec.xml -o export -i 1 -p BACKUP-PaSSword$ -d -q
#
#
#


# --- Logging Function ---
Function Write-Log {
    Param (
        [string]$Message
    )
    $Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    Add-Content -Path $LogFile -Value "$Timestamp - $Message"
    Write-Host "$Timestamp - $Message"
}

# ---------------------
# --- Configuration ---
# ---------------------

# search c:\program files* folder for the FCConfig.exe file. some clients install folders were inconsistent so didn't want to hard code.

$FCCExe = Get-ChildItem -Path "C:\Program Files*" -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.Name -eq "FCConfig.exe" }
if ($FCCExe) {
    foreach ($fn in $FCCExe) {
        if($fn.VersionInfo -match "7.4") {
            $FortiClientPath = $fn.DirectoryName
            Write-Log "FCConfig.exe found: $FortiClientPath version $fn.VersionInfo"
        }
    }
} else {

    # idk where it is, exit
    Write-log "FCConfig.exe Not found"
    Exit 1
}
# we should know the folder, so.. set the location of the FCConfig.exe file.
$FCConfigExe = "$FortiClientPath\FCConfig.exe"

# on a workstation with your config, run the FCCconfig to backup your settings.. save this file as ipsec.xml
# have that file in the same folder as the .ps1
$SourceConfigFile = ".\ipsec.xml"  # Your backup file with the new config in it. to be distributed with package

# This is the "name" of the ipsec vpn config that you want to export from the .\ipsec.xml
$ConnectionNameToMerge = "Company - IPSEC SAML VPN"

# here it is in the registry so we can check for install later
$HKLMpath = 'HKLM:\SOFTWARE\Fortinet\FortiClient\IPSec\Tunnels\Company - IPSEC SAML VPN'

# This is the file of the current client config that gets exported, then modified, then re-imported.
$BackupFile = "$CompanyPath\IPSECVpnFortiClient_backup.xml"

# working dir and log file
$CompanyPath = "C:\ProgramData\Company\IPSECVpn"
$LogFile = "$CompanyPath\IPSECVpnFortiClient_automation.log"


# --------------------------
# --- Script Starts Here ---
# --------------------------


#Setup Working/Log folder.
if (-not (Test-Path $CompanyPath -Pathtype Container)) {
    New-Item -Path $CompanyPath -ItemType Directory
}
Write-Log "Starting FortiClient configuration merge process from source file."

# check to see if the Connection already exists in the registry, if so, exit.
if (Test-Path $HKLMpath) {
    Write-Log "PRECHECK: The Import connection exists in the registry"
    Exit 0
} else {
    Write-Log "PRECHECK: The Import connection does not exist in the Registy"
}

# What if they don't have forticlient installed?
if (Test-Path $FCConfigExe) {
    Write-Log "PRECHECK: The pgm $FcConfigExe file exists"
} else {
    Write-Log "PRECHECK: The pgm $FcConfigExe file DOES NOT exist, Forticlient not installed?"
    Exit 1
}

# Step 1: Check for admin privileges
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Log "Script requires Administrator privileges. Exiting."
    Exit 1
}

Start-Sleep -Seconds 3

# Load the source configuration (.\ipsec.xml) and find the connection node
Write-Log "Loading source configuration from $SourceConfigFile"
if (-not (Test-Path $SourceConfigFile)) {
    Write-Log "Source configuration file not found at $SourceConfigFile. Exiting."
    Exit 1
}

try {
    $sourceXml = [xml](Get-Content $SourceConfigFile)

    # Find the specific connection node by its 'name' value using XPath
    $connectionNode = $sourceXml.SelectSingleNode("//connection[name = '$ConnectionNameToMerge']")
    if (-not $connectionNode) {
        Write-Log "Connection '$ConnectionNameToMerge' not found in source file. Exiting."
        Exit 1
    }
    Write-Log "Found connection node '$ConnectionNameToMerge' in source file."
} catch {
    Write-Log "Failed to load or parse source XML file: $_"
    Exit 1
}

# Export the local machine's current configuration
Write-Log "Exporting current FortiClient configuration to $BackupFile"
try {
    & "$FCConfigExe" -m all -f $BackupFile -o export -i 1 -p BACKUP-PaSSword$ -d -q
} catch {
    Write-Log "Error exporting configuration: $_"
    Exit 1
}

if (-not (Test-Path $BackupFile)) {
    Write-Log "Failed to export local configuration. Backup file not found. Exiting."
    Exit 1
}

# Step 5: Merge the connection node into the local backup file
Write-Log "Merging connection node into local backup file..."
try {
    $localXml = [xml](Get-Content $BackupFile)

    # Locate the ipsec connections node, or create it if it doesn't exist
    # may have to doublecheck this.. but it should be right.

    $connectionsNode = $localXml.SelectSingleNode("//forticlient_configuration/vpn/ipsecvpn/connections")
    if (-not $connectionsNode) {
        Write-Log "IPsec connections node not found. Creating it."
        $ipsecNode = $localXml.SelectSingleNode("//forticlient_configuration/vpn/ipsecvpn")
        if (-not $ipsecNode) {
            Write-Log "ipsec node not found. Failed to merge."
            Exit 1
        }
        $connectionsNode = $localXml.CreateElement("connections")
        $ipsecNode.AppendChild($connectionsNode) | Out-Null
    }

    # Import and append the connection node from the source
    $importedNode = $localXml.ImportNode($connectionNode, $true)
    $connectionsNode.AppendChild($importedNode) | Out-Null

    $localXml.Save($BackupFile)
    Write-Log "Successfully merged new connection into local backup."
} catch {
    Write-Log "Failed to merge XML files: $_"
    Exit 1
}

#reset all the things..
Get-Process -Name "Forti*" | Write-Log
Get-Process -Name "Forti*" | Stop-Process -Force
Get-Process -Name "Forti*" | Write-Log

sleep 2
# Step 6: Import the updated configuration
Write-Log "Importing updated configuration from $BackupFile"
try {

    # had to trial and error to get it to work/import. the sequence below seems to work?
    # basically , run the importvpn command, then run the import command after.. not sure why as there is little documentation
    # use the same backup password from the .\ipsec.xml export.
    & "$FCConfigExe" -m all -f  $BackupFile -d -o importvpn -p BACKUP-PaSSword$ -q
    sleep 2
    & "$FCConfigExe" -m all -f  $BackupFile -d -o import -p BACKUP-PaSSword$ -q

    # extra export commands / testing.. just leaving this in as comments.
    #-m all -f c:\ProgramData\Company\IPSECVpnforticlient_backup.xml -o importvpn -p BACKUP-PaSSword$ -d -i 1
    #-m all -f c:\ProgramData\Company\IPSECVpnforticlient_backup.xml -o import -p BACKUP-PaSSword$ -d -i 1

} catch {
    Write-Log "Error importing configuration: $_"
    Exit 1
}

# IPSEC IKEv2 in 7.4.3 with 7.4.9Fw doesn't support dns suffix.. so add a dns-suffix to the windows network interface directly.
# change comany.local to your dns suffix.
#
Write-Log "DNS: Setting Adapter dns suffix"

$NETAdapter = get-netadapter | where-Object {$_.interfacedescription -match "Fortinet Virtual" }
if ($NETAdapter) {
    foreach ($neta in $netAdapter) {
       set-dnsclient -InterfaceIndex  $neta.ifIndex -ConnectionSpecificSuffix "Company.local"
           Write-Log "DNS: $neta.name suffix set (maybe)"
    }
}

Write-Log "FortiClient configuration merge process Endpgm."