// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***

using System;
using System.Collections.Generic;
using System.Collections.Immutable;
using System.Threading.Tasks;
using Pulumi.Serialization;
using Pulumi;

namespace Pulumiverse.Fortios
{
    /// <summary>
    /// Configure SSL VPN.
    /// 
    /// ## Example Usage
    /// 
    /// ```csharp
    /// using System.Collections.Generic;
    /// using System.Linq;
    /// using Pulumi;
    /// using Fortios = Pulumiverse.Fortios;
    /// 
    /// return await Deployment.RunAsync(() =&gt; 
    /// {
    ///     var trname = new Fortios.VpnsslSettings("trname", new()
    ///     {
    ///         LoginAttemptLimit = 2,
    ///         LoginBlockTime = 60,
    ///         LoginTimeout = 30,
    ///         Port = 443,
    ///         Servercert = "self-sign",
    ///     });
    /// 
    /// });
    /// ```
    /// 
    /// ## Import
    /// 
    /// VpnSsl Settings can be imported using any of these accepted formats
    /// 
    /// ```sh
    ///  $ pulumi import fortios:index/vpnsslSettings:VpnsslSettings labelname VpnSslSettings
    /// ```
    /// 
    ///  If you do not want to import arguments of block$ export "FORTIOS_IMPORT_TABLE"="false"
    /// 
    /// ```sh
    ///  $ pulumi import fortios:index/vpnsslSettings:VpnsslSettings labelname VpnSslSettings
    /// ```
    /// 
    ///  $ unset "FORTIOS_IMPORT_TABLE"
    /// </summary>
    [FortiosResourceType("fortios:index/vpnsslSettings:VpnsslSettings")]
    public partial class VpnsslSettings : global::Pulumi.CustomResource
    {
        /// <summary>
        /// Force the SSL-VPN security level. High allows only high. Medium allows medium and high. Low allows any. Valid values: `high`, `medium`, `default`, `low`.
        /// </summary>
        [Output("algorithm")]
        public Output<string> Algorithm { get; private set; } = null!;

        /// <summary>
        /// Enable/disable checking of source IP for authentication session. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("authSessionCheckSourceIp")]
        public Output<string> AuthSessionCheckSourceIp { get; private set; } = null!;

        /// <summary>
        /// SSL-VPN authentication timeout (1 - 259200 sec (3 days), 0 for no timeout).
        /// </summary>
        [Output("authTimeout")]
        public Output<int> AuthTimeout { get; private set; } = null!;

        /// <summary>
        /// Authentication rule for SSL VPN. The structure of `authentication_rule` block is documented below.
        /// </summary>
        [Output("authenticationRules")]
        public Output<ImmutableArray<Outputs.VpnsslSettingsAuthenticationRule>> AuthenticationRules { get; private set; } = null!;

        /// <summary>
        /// Enable to auto-create static routes for the SSL-VPN tunnel IP addresses. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("autoTunnelStaticRoute")]
        public Output<string> AutoTunnelStaticRoute { get; private set; } = null!;

        /// <summary>
        /// Select one or more cipher technologies that cannot be used in SSL-VPN negotiations.
        /// </summary>
        [Output("bannedCipher")]
        public Output<string> BannedCipher { get; private set; } = null!;

        /// <summary>
        /// Enable/disable overriding the configured system language based on the preferred language of the browser. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("browserLanguageDetection")]
        public Output<string> BrowserLanguageDetection { get; private set; } = null!;

        /// <summary>
        /// Enable/disable verification of referer field in HTTP request header. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("checkReferer")]
        public Output<string> CheckReferer { get; private set; } = null!;

        /// <summary>
        /// Select one or more TLS 1.3 ciphersuites to enable. Does not affect ciphers in TLS 1.2 and below. At least one must be enabled. To disable all, set ssl-max-proto-ver to tls1-2 or below. Valid values: `TLS-AES-128-GCM-SHA256`, `TLS-AES-256-GCM-SHA384`, `TLS-CHACHA20-POLY1305-SHA256`, `TLS-AES-128-CCM-SHA256`, `TLS-AES-128-CCM-8-SHA256`.
        /// </summary>
        [Output("ciphersuite")]
        public Output<string> Ciphersuite { get; private set; } = null!;

        /// <summary>
        /// Set signature algorithms related to client authentication. Affects TLS version &lt;= 1.2 only. Valid values: `no-rsa-pss`, `all`.
        /// </summary>
        [Output("clientSigalgs")]
        public Output<string> ClientSigalgs { get; private set; } = null!;

        /// <summary>
        /// Default SSL VPN portal.
        /// </summary>
        [Output("defaultPortal")]
        public Output<string> DefaultPortal { get; private set; } = null!;

        /// <summary>
        /// Compression level (0~9).
        /// </summary>
        [Output("deflateCompressionLevel")]
        public Output<int> DeflateCompressionLevel { get; private set; } = null!;

        /// <summary>
        /// Minimum amount of data that triggers compression (200 - 65535 bytes).
        /// </summary>
        [Output("deflateMinDataSize")]
        public Output<int> DeflateMinDataSize { get; private set; } = null!;

        /// <summary>
        /// DNS server 1.
        /// </summary>
        [Output("dnsServer1")]
        public Output<string> DnsServer1 { get; private set; } = null!;

        /// <summary>
        /// DNS server 2.
        /// </summary>
        [Output("dnsServer2")]
        public Output<string> DnsServer2 { get; private set; } = null!;

        /// <summary>
        /// DNS suffix used for SSL-VPN clients.
        /// </summary>
        [Output("dnsSuffix")]
        public Output<string?> DnsSuffix { get; private set; } = null!;

        /// <summary>
        /// SSLVPN maximum DTLS hello timeout (10 - 60 sec, default = 10).
        /// </summary>
        [Output("dtlsHelloTimeout")]
        public Output<int> DtlsHelloTimeout { get; private set; } = null!;

        /// <summary>
        /// DTLS maximum protocol version. Valid values: `dtls1-0`, `dtls1-2`.
        /// </summary>
        [Output("dtlsMaxProtoVer")]
        public Output<string> DtlsMaxProtoVer { get; private set; } = null!;

        /// <summary>
        /// DTLS minimum protocol version. Valid values: `dtls1-0`, `dtls1-2`.
        /// </summary>
        [Output("dtlsMinProtoVer")]
        public Output<string> DtlsMinProtoVer { get; private set; } = null!;

        /// <summary>
        /// Enable DTLS to prevent eavesdropping, tampering, or message forgery. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("dtlsTunnel")]
        public Output<string> DtlsTunnel { get; private set; } = null!;

        /// <summary>
        /// Tunnel mode: enable parallel IPv4 and IPv6 tunnel. Web mode: support IPv4 and IPv6 bookmarks in the portal. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("dualStackMode")]
        public Output<string> DualStackMode { get; private set; } = null!;

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Output("dynamicSortSubtable")]
        public Output<string?> DynamicSortSubtable { get; private set; } = null!;

        /// <summary>
        /// Encode \2F sequence to forward slash in URLs. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("encode2fSequence")]
        public Output<string> Encode2fSequence { get; private set; } = null!;

        /// <summary>
        /// Encrypt and store user passwords for SSL-VPN web sessions. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("encryptAndStorePassword")]
        public Output<string> EncryptAndStorePassword { get; private set; } = null!;

        /// <summary>
        /// Enable to force two-factor authentication for all SSL-VPNs. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("forceTwoFactorAuth")]
        public Output<string> ForceTwoFactorAuth { get; private set; } = null!;

        /// <summary>
        /// Forward the same, add, or remove HTTP header. Valid values: `pass`, `add`, `remove`.
        /// </summary>
        [Output("headerXForwardedFor")]
        public Output<string> HeaderXForwardedFor { get; private set; } = null!;

        /// <summary>
        /// Add HSTS includeSubDomains response header. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("hstsIncludeSubdomains")]
        public Output<string> HstsIncludeSubdomains { get; private set; } = null!;

        /// <summary>
        /// Enable to allow HTTP compression over SSL-VPN tunnels. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("httpCompression")]
        public Output<string> HttpCompression { get; private set; } = null!;

        /// <summary>
        /// Enable/disable SSL-VPN support for HttpOnly cookies. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("httpOnlyCookie")]
        public Output<string> HttpOnlyCookie { get; private set; } = null!;

        /// <summary>
        /// SSL-VPN session is disconnected if an HTTP request body is not received within this time (1 - 60 sec, default = 20).
        /// </summary>
        [Output("httpRequestBodyTimeout")]
        public Output<int> HttpRequestBodyTimeout { get; private set; } = null!;

        /// <summary>
        /// SSL-VPN session is disconnected if an HTTP request header is not received within this time (1 - 60 sec, default = 20).
        /// </summary>
        [Output("httpRequestHeaderTimeout")]
        public Output<int> HttpRequestHeaderTimeout { get; private set; } = null!;

        /// <summary>
        /// Enable/disable redirect of port 80 to SSL-VPN port. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("httpsRedirect")]
        public Output<string> HttpsRedirect { get; private set; } = null!;

        /// <summary>
        /// SSL VPN disconnects if idle for specified time in seconds.
        /// </summary>
        [Output("idleTimeout")]
        public Output<int> IdleTimeout { get; private set; } = null!;

        /// <summary>
        /// IPv6 DNS server 1.
        /// </summary>
        [Output("ipv6DnsServer1")]
        public Output<string> Ipv6DnsServer1 { get; private set; } = null!;

        /// <summary>
        /// IPv6 DNS server 2.
        /// </summary>
        [Output("ipv6DnsServer2")]
        public Output<string> Ipv6DnsServer2 { get; private set; } = null!;

        /// <summary>
        /// IPv6 WINS server 1.
        /// </summary>
        [Output("ipv6WinsServer1")]
        public Output<string> Ipv6WinsServer1 { get; private set; } = null!;

        /// <summary>
        /// IPv6 WINS server 2.
        /// </summary>
        [Output("ipv6WinsServer2")]
        public Output<string> Ipv6WinsServer2 { get; private set; } = null!;

        /// <summary>
        /// SSL VPN maximum login attempt times before block (0 - 10, default = 2, 0 = no limit).
        /// </summary>
        [Output("loginAttemptLimit")]
        public Output<int> LoginAttemptLimit { get; private set; } = null!;

        /// <summary>
        /// Time for which a user is blocked from logging in after too many failed login attempts (0 - 86400 sec, default = 60).
        /// </summary>
        [Output("loginBlockTime")]
        public Output<int> LoginBlockTime { get; private set; } = null!;

        /// <summary>
        /// SSLVPN maximum login timeout (10 - 180 sec, default = 30).
        /// </summary>
        [Output("loginTimeout")]
        public Output<int> LoginTimeout { get; private set; } = null!;

        /// <summary>
        /// SSL-VPN access port (1 - 65535).
        /// </summary>
        [Output("port")]
        public Output<int> Port { get; private set; } = null!;

        /// <summary>
        /// Enable means that if SSL-VPN connections are allowed on an interface admin GUI connections are blocked on that interface. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("portPrecedence")]
        public Output<string> PortPrecedence { get; private set; } = null!;

        /// <summary>
        /// Enable to require client certificates for all SSL-VPN users. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("reqclientcert")]
        public Output<string> Reqclientcert { get; private set; } = null!;

        /// <summary>
        /// Enable to allow SSL-VPN sessions to bypass routing and bind to the incoming interface. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("routeSourceInterface")]
        public Output<string> RouteSourceInterface { get; private set; } = null!;

        /// <summary>
        /// SAML local redirect port in the machine running FCT (0 - 65535). 0 is to disable redirection on FGT side.
        /// </summary>
        [Output("samlRedirectPort")]
        public Output<int> SamlRedirectPort { get; private set; } = null!;

        /// <summary>
        /// Name of the server certificate to be used for SSL-VPNs.
        /// </summary>
        [Output("servercert")]
        public Output<string> Servercert { get; private set; } = null!;

        /// <summary>
        /// Enable/disable negated source IPv6 address match. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("sourceAddress6Negate")]
        public Output<string> SourceAddress6Negate { get; private set; } = null!;

        /// <summary>
        /// IPv6 source address of incoming traffic. The structure of `source_address6` block is documented below.
        /// </summary>
        [Output("sourceAddress6s")]
        public Output<ImmutableArray<Outputs.VpnsslSettingsSourceAddress6>> SourceAddress6s { get; private set; } = null!;

        /// <summary>
        /// Enable/disable negated source address match. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("sourceAddressNegate")]
        public Output<string> SourceAddressNegate { get; private set; } = null!;

        /// <summary>
        /// Source address of incoming traffic. The structure of `source_address` block is documented below.
        /// </summary>
        [Output("sourceAddresses")]
        public Output<ImmutableArray<Outputs.VpnsslSettingsSourceAddress>> SourceAddresses { get; private set; } = null!;

        /// <summary>
        /// SSL VPN source interface of incoming traffic. The structure of `source_interface` block is documented below.
        /// </summary>
        [Output("sourceInterfaces")]
        public Output<ImmutableArray<Outputs.VpnsslSettingsSourceInterface>> SourceInterfaces { get; private set; } = null!;

        /// <summary>
        /// Enable to allow client renegotiation by the server if the tunnel goes down. Valid values: `disable`, `enable`.
        /// </summary>
        [Output("sslClientRenegotiation")]
        public Output<string> SslClientRenegotiation { get; private set; } = null!;

        /// <summary>
        /// Enable/disable insertion of empty fragment. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("sslInsertEmptyFragment")]
        public Output<string> SslInsertEmptyFragment { get; private set; } = null!;

        /// <summary>
        /// SSL maximum protocol version. Valid values: `tls1-0`, `tls1-1`, `tls1-2`, `tls1-3`.
        /// </summary>
        [Output("sslMaxProtoVer")]
        public Output<string> SslMaxProtoVer { get; private set; } = null!;

        /// <summary>
        /// SSL minimum protocol version. Valid values: `tls1-0`, `tls1-1`, `tls1-2`, `tls1-3`.
        /// </summary>
        [Output("sslMinProtoVer")]
        public Output<string> SslMinProtoVer { get; private set; } = null!;

        /// <summary>
        /// Enable/disable SSL-VPN. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("status")]
        public Output<string> Status { get; private set; } = null!;

        /// <summary>
        /// Enable/disable TLSv1.0. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("tlsv10")]
        public Output<string> Tlsv10 { get; private set; } = null!;

        /// <summary>
        /// Enable/disable TLSv1.1. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("tlsv11")]
        public Output<string> Tlsv11 { get; private set; } = null!;

        /// <summary>
        /// Enable/disable TLSv1.2. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("tlsv12")]
        public Output<string> Tlsv12 { get; private set; } = null!;

        /// <summary>
        /// Enable/disable TLSv1.3. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("tlsv13")]
        public Output<string> Tlsv13 { get; private set; } = null!;

        /// <summary>
        /// Transform backward slashes to forward slashes in URLs. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("transformBackwardSlashes")]
        public Output<string> TransformBackwardSlashes { get; private set; } = null!;

        /// <summary>
        /// Method used for assigning address for tunnel. Valid values: `first-available`, `round-robin`.
        /// </summary>
        [Output("tunnelAddrAssignedMethod")]
        public Output<string> TunnelAddrAssignedMethod { get; private set; } = null!;

        /// <summary>
        /// Enable/disable tunnel connection without re-authorization if previous connection dropped. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("tunnelConnectWithoutReauth")]
        public Output<string> TunnelConnectWithoutReauth { get; private set; } = null!;

        /// <summary>
        /// Names of the IPv4 IP Pool firewall objects that define the IP addresses reserved for remote clients. The structure of `tunnel_ip_pools` block is documented below.
        /// </summary>
        [Output("tunnelIpPools")]
        public Output<ImmutableArray<Outputs.VpnsslSettingsTunnelIpPool>> TunnelIpPools { get; private set; } = null!;

        /// <summary>
        /// Names of the IPv6 IP Pool firewall objects that define the IP addresses reserved for remote clients. The structure of `tunnel_ipv6_pools` block is documented below.
        /// </summary>
        [Output("tunnelIpv6Pools")]
        public Output<ImmutableArray<Outputs.VpnsslSettingsTunnelIpv6Pool>> TunnelIpv6Pools { get; private set; } = null!;

        /// <summary>
        /// Time out value to clean up user session after tunnel connection is dropped (1 - 255 sec, default=30).
        /// </summary>
        [Output("tunnelUserSessionTimeout")]
        public Output<int> TunnelUserSessionTimeout { get; private set; } = null!;

        /// <summary>
        /// Enable/disable unsafe legacy re-negotiation. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("unsafeLegacyRenegotiation")]
        public Output<string> UnsafeLegacyRenegotiation { get; private set; } = null!;

        /// <summary>
        /// Enable to obscure the host name of the URL of the web browser display. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("urlObscuration")]
        public Output<string> UrlObscuration { get; private set; } = null!;

        /// <summary>
        /// Name of user peer.
        /// </summary>
        [Output("userPeer")]
        public Output<string> UserPeer { get; private set; } = null!;

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Output("vdomparam")]
        public Output<string?> Vdomparam { get; private set; } = null!;

        /// <summary>
        /// Enable/disable use of IP pools defined in firewall policy while using web-mode. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("webModeSnat")]
        public Output<string> WebModeSnat { get; private set; } = null!;

        /// <summary>
        /// WINS server 1.
        /// </summary>
        [Output("winsServer1")]
        public Output<string> WinsServer1 { get; private set; } = null!;

        /// <summary>
        /// WINS server 2.
        /// </summary>
        [Output("winsServer2")]
        public Output<string> WinsServer2 { get; private set; } = null!;

        /// <summary>
        /// Add HTTP X-Content-Type-Options header. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("xContentTypeOptions")]
        public Output<string> XContentTypeOptions { get; private set; } = null!;

        /// <summary>
        /// Enable/disable verification of device certificate for SSLVPN ZTNA session. Valid values: `enable`, `disable`.
        /// </summary>
        [Output("ztnaTrustedClient")]
        public Output<string> ZtnaTrustedClient { get; private set; } = null!;


        /// <summary>
        /// Create a VpnsslSettings resource with the given unique name, arguments, and options.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resource</param>
        /// <param name="args">The arguments used to populate this resource's properties</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public VpnsslSettings(string name, VpnsslSettingsArgs? args = null, CustomResourceOptions? options = null)
            : base("fortios:index/vpnsslSettings:VpnsslSettings", name, args ?? new VpnsslSettingsArgs(), MakeResourceOptions(options, ""))
        {
        }

        private VpnsslSettings(string name, Input<string> id, VpnsslSettingsState? state = null, CustomResourceOptions? options = null)
            : base("fortios:index/vpnsslSettings:VpnsslSettings", name, state, MakeResourceOptions(options, id))
        {
        }

        private static CustomResourceOptions MakeResourceOptions(CustomResourceOptions? options, Input<string>? id)
        {
            var defaultOptions = new CustomResourceOptions
            {
                Version = Utilities.Version,
                PluginDownloadURL = "github://api.github.com/pulumiverse/pulumi-fortios",
            };
            var merged = CustomResourceOptions.Merge(defaultOptions, options);
            // Override the ID if one was specified for consistency with other language SDKs.
            merged.Id = id ?? merged.Id;
            return merged;
        }
        /// <summary>
        /// Get an existing VpnsslSettings resource's state with the given name, ID, and optional extra
        /// properties used to qualify the lookup.
        /// </summary>
        ///
        /// <param name="name">The unique name of the resulting resource.</param>
        /// <param name="id">The unique provider ID of the resource to lookup.</param>
        /// <param name="state">Any extra arguments used during the lookup.</param>
        /// <param name="options">A bag of options that control this resource's behavior</param>
        public static VpnsslSettings Get(string name, Input<string> id, VpnsslSettingsState? state = null, CustomResourceOptions? options = null)
        {
            return new VpnsslSettings(name, id, state, options);
        }
    }

    public sealed class VpnsslSettingsArgs : global::Pulumi.ResourceArgs
    {
        /// <summary>
        /// Force the SSL-VPN security level. High allows only high. Medium allows medium and high. Low allows any. Valid values: `high`, `medium`, `default`, `low`.
        /// </summary>
        [Input("algorithm")]
        public Input<string>? Algorithm { get; set; }

        /// <summary>
        /// Enable/disable checking of source IP for authentication session. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("authSessionCheckSourceIp")]
        public Input<string>? AuthSessionCheckSourceIp { get; set; }

        /// <summary>
        /// SSL-VPN authentication timeout (1 - 259200 sec (3 days), 0 for no timeout).
        /// </summary>
        [Input("authTimeout")]
        public Input<int>? AuthTimeout { get; set; }

        [Input("authenticationRules")]
        private InputList<Inputs.VpnsslSettingsAuthenticationRuleArgs>? _authenticationRules;

        /// <summary>
        /// Authentication rule for SSL VPN. The structure of `authentication_rule` block is documented below.
        /// </summary>
        public InputList<Inputs.VpnsslSettingsAuthenticationRuleArgs> AuthenticationRules
        {
            get => _authenticationRules ?? (_authenticationRules = new InputList<Inputs.VpnsslSettingsAuthenticationRuleArgs>());
            set => _authenticationRules = value;
        }

        /// <summary>
        /// Enable to auto-create static routes for the SSL-VPN tunnel IP addresses. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("autoTunnelStaticRoute")]
        public Input<string>? AutoTunnelStaticRoute { get; set; }

        /// <summary>
        /// Select one or more cipher technologies that cannot be used in SSL-VPN negotiations.
        /// </summary>
        [Input("bannedCipher")]
        public Input<string>? BannedCipher { get; set; }

        /// <summary>
        /// Enable/disable overriding the configured system language based on the preferred language of the browser. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("browserLanguageDetection")]
        public Input<string>? BrowserLanguageDetection { get; set; }

        /// <summary>
        /// Enable/disable verification of referer field in HTTP request header. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("checkReferer")]
        public Input<string>? CheckReferer { get; set; }

        /// <summary>
        /// Select one or more TLS 1.3 ciphersuites to enable. Does not affect ciphers in TLS 1.2 and below. At least one must be enabled. To disable all, set ssl-max-proto-ver to tls1-2 or below. Valid values: `TLS-AES-128-GCM-SHA256`, `TLS-AES-256-GCM-SHA384`, `TLS-CHACHA20-POLY1305-SHA256`, `TLS-AES-128-CCM-SHA256`, `TLS-AES-128-CCM-8-SHA256`.
        /// </summary>
        [Input("ciphersuite")]
        public Input<string>? Ciphersuite { get; set; }

        /// <summary>
        /// Set signature algorithms related to client authentication. Affects TLS version &lt;= 1.2 only. Valid values: `no-rsa-pss`, `all`.
        /// </summary>
        [Input("clientSigalgs")]
        public Input<string>? ClientSigalgs { get; set; }

        /// <summary>
        /// Default SSL VPN portal.
        /// </summary>
        [Input("defaultPortal")]
        public Input<string>? DefaultPortal { get; set; }

        /// <summary>
        /// Compression level (0~9).
        /// </summary>
        [Input("deflateCompressionLevel")]
        public Input<int>? DeflateCompressionLevel { get; set; }

        /// <summary>
        /// Minimum amount of data that triggers compression (200 - 65535 bytes).
        /// </summary>
        [Input("deflateMinDataSize")]
        public Input<int>? DeflateMinDataSize { get; set; }

        /// <summary>
        /// DNS server 1.
        /// </summary>
        [Input("dnsServer1")]
        public Input<string>? DnsServer1 { get; set; }

        /// <summary>
        /// DNS server 2.
        /// </summary>
        [Input("dnsServer2")]
        public Input<string>? DnsServer2 { get; set; }

        /// <summary>
        /// DNS suffix used for SSL-VPN clients.
        /// </summary>
        [Input("dnsSuffix")]
        public Input<string>? DnsSuffix { get; set; }

        /// <summary>
        /// SSLVPN maximum DTLS hello timeout (10 - 60 sec, default = 10).
        /// </summary>
        [Input("dtlsHelloTimeout")]
        public Input<int>? DtlsHelloTimeout { get; set; }

        /// <summary>
        /// DTLS maximum protocol version. Valid values: `dtls1-0`, `dtls1-2`.
        /// </summary>
        [Input("dtlsMaxProtoVer")]
        public Input<string>? DtlsMaxProtoVer { get; set; }

        /// <summary>
        /// DTLS minimum protocol version. Valid values: `dtls1-0`, `dtls1-2`.
        /// </summary>
        [Input("dtlsMinProtoVer")]
        public Input<string>? DtlsMinProtoVer { get; set; }

        /// <summary>
        /// Enable DTLS to prevent eavesdropping, tampering, or message forgery. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dtlsTunnel")]
        public Input<string>? DtlsTunnel { get; set; }

        /// <summary>
        /// Tunnel mode: enable parallel IPv4 and IPv6 tunnel. Web mode: support IPv4 and IPv6 bookmarks in the portal. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dualStackMode")]
        public Input<string>? DualStackMode { get; set; }

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Input("dynamicSortSubtable")]
        public Input<string>? DynamicSortSubtable { get; set; }

        /// <summary>
        /// Encode \2F sequence to forward slash in URLs. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("encode2fSequence")]
        public Input<string>? Encode2fSequence { get; set; }

        /// <summary>
        /// Encrypt and store user passwords for SSL-VPN web sessions. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("encryptAndStorePassword")]
        public Input<string>? EncryptAndStorePassword { get; set; }

        /// <summary>
        /// Enable to force two-factor authentication for all SSL-VPNs. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("forceTwoFactorAuth")]
        public Input<string>? ForceTwoFactorAuth { get; set; }

        /// <summary>
        /// Forward the same, add, or remove HTTP header. Valid values: `pass`, `add`, `remove`.
        /// </summary>
        [Input("headerXForwardedFor")]
        public Input<string>? HeaderXForwardedFor { get; set; }

        /// <summary>
        /// Add HSTS includeSubDomains response header. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("hstsIncludeSubdomains")]
        public Input<string>? HstsIncludeSubdomains { get; set; }

        /// <summary>
        /// Enable to allow HTTP compression over SSL-VPN tunnels. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("httpCompression")]
        public Input<string>? HttpCompression { get; set; }

        /// <summary>
        /// Enable/disable SSL-VPN support for HttpOnly cookies. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("httpOnlyCookie")]
        public Input<string>? HttpOnlyCookie { get; set; }

        /// <summary>
        /// SSL-VPN session is disconnected if an HTTP request body is not received within this time (1 - 60 sec, default = 20).
        /// </summary>
        [Input("httpRequestBodyTimeout")]
        public Input<int>? HttpRequestBodyTimeout { get; set; }

        /// <summary>
        /// SSL-VPN session is disconnected if an HTTP request header is not received within this time (1 - 60 sec, default = 20).
        /// </summary>
        [Input("httpRequestHeaderTimeout")]
        public Input<int>? HttpRequestHeaderTimeout { get; set; }

        /// <summary>
        /// Enable/disable redirect of port 80 to SSL-VPN port. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("httpsRedirect")]
        public Input<string>? HttpsRedirect { get; set; }

        /// <summary>
        /// SSL VPN disconnects if idle for specified time in seconds.
        /// </summary>
        [Input("idleTimeout")]
        public Input<int>? IdleTimeout { get; set; }

        /// <summary>
        /// IPv6 DNS server 1.
        /// </summary>
        [Input("ipv6DnsServer1")]
        public Input<string>? Ipv6DnsServer1 { get; set; }

        /// <summary>
        /// IPv6 DNS server 2.
        /// </summary>
        [Input("ipv6DnsServer2")]
        public Input<string>? Ipv6DnsServer2 { get; set; }

        /// <summary>
        /// IPv6 WINS server 1.
        /// </summary>
        [Input("ipv6WinsServer1")]
        public Input<string>? Ipv6WinsServer1 { get; set; }

        /// <summary>
        /// IPv6 WINS server 2.
        /// </summary>
        [Input("ipv6WinsServer2")]
        public Input<string>? Ipv6WinsServer2 { get; set; }

        /// <summary>
        /// SSL VPN maximum login attempt times before block (0 - 10, default = 2, 0 = no limit).
        /// </summary>
        [Input("loginAttemptLimit")]
        public Input<int>? LoginAttemptLimit { get; set; }

        /// <summary>
        /// Time for which a user is blocked from logging in after too many failed login attempts (0 - 86400 sec, default = 60).
        /// </summary>
        [Input("loginBlockTime")]
        public Input<int>? LoginBlockTime { get; set; }

        /// <summary>
        /// SSLVPN maximum login timeout (10 - 180 sec, default = 30).
        /// </summary>
        [Input("loginTimeout")]
        public Input<int>? LoginTimeout { get; set; }

        /// <summary>
        /// SSL-VPN access port (1 - 65535).
        /// </summary>
        [Input("port")]
        public Input<int>? Port { get; set; }

        /// <summary>
        /// Enable means that if SSL-VPN connections are allowed on an interface admin GUI connections are blocked on that interface. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("portPrecedence")]
        public Input<string>? PortPrecedence { get; set; }

        /// <summary>
        /// Enable to require client certificates for all SSL-VPN users. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("reqclientcert")]
        public Input<string>? Reqclientcert { get; set; }

        /// <summary>
        /// Enable to allow SSL-VPN sessions to bypass routing and bind to the incoming interface. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("routeSourceInterface")]
        public Input<string>? RouteSourceInterface { get; set; }

        /// <summary>
        /// SAML local redirect port in the machine running FCT (0 - 65535). 0 is to disable redirection on FGT side.
        /// </summary>
        [Input("samlRedirectPort")]
        public Input<int>? SamlRedirectPort { get; set; }

        /// <summary>
        /// Name of the server certificate to be used for SSL-VPNs.
        /// </summary>
        [Input("servercert")]
        public Input<string>? Servercert { get; set; }

        /// <summary>
        /// Enable/disable negated source IPv6 address match. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sourceAddress6Negate")]
        public Input<string>? SourceAddress6Negate { get; set; }

        [Input("sourceAddress6s")]
        private InputList<Inputs.VpnsslSettingsSourceAddress6Args>? _sourceAddress6s;

        /// <summary>
        /// IPv6 source address of incoming traffic. The structure of `source_address6` block is documented below.
        /// </summary>
        public InputList<Inputs.VpnsslSettingsSourceAddress6Args> SourceAddress6s
        {
            get => _sourceAddress6s ?? (_sourceAddress6s = new InputList<Inputs.VpnsslSettingsSourceAddress6Args>());
            set => _sourceAddress6s = value;
        }

        /// <summary>
        /// Enable/disable negated source address match. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sourceAddressNegate")]
        public Input<string>? SourceAddressNegate { get; set; }

        [Input("sourceAddresses")]
        private InputList<Inputs.VpnsslSettingsSourceAddressArgs>? _sourceAddresses;

        /// <summary>
        /// Source address of incoming traffic. The structure of `source_address` block is documented below.
        /// </summary>
        public InputList<Inputs.VpnsslSettingsSourceAddressArgs> SourceAddresses
        {
            get => _sourceAddresses ?? (_sourceAddresses = new InputList<Inputs.VpnsslSettingsSourceAddressArgs>());
            set => _sourceAddresses = value;
        }

        [Input("sourceInterfaces")]
        private InputList<Inputs.VpnsslSettingsSourceInterfaceArgs>? _sourceInterfaces;

        /// <summary>
        /// SSL VPN source interface of incoming traffic. The structure of `source_interface` block is documented below.
        /// </summary>
        public InputList<Inputs.VpnsslSettingsSourceInterfaceArgs> SourceInterfaces
        {
            get => _sourceInterfaces ?? (_sourceInterfaces = new InputList<Inputs.VpnsslSettingsSourceInterfaceArgs>());
            set => _sourceInterfaces = value;
        }

        /// <summary>
        /// Enable to allow client renegotiation by the server if the tunnel goes down. Valid values: `disable`, `enable`.
        /// </summary>
        [Input("sslClientRenegotiation")]
        public Input<string>? SslClientRenegotiation { get; set; }

        /// <summary>
        /// Enable/disable insertion of empty fragment. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sslInsertEmptyFragment")]
        public Input<string>? SslInsertEmptyFragment { get; set; }

        /// <summary>
        /// SSL maximum protocol version. Valid values: `tls1-0`, `tls1-1`, `tls1-2`, `tls1-3`.
        /// </summary>
        [Input("sslMaxProtoVer")]
        public Input<string>? SslMaxProtoVer { get; set; }

        /// <summary>
        /// SSL minimum protocol version. Valid values: `tls1-0`, `tls1-1`, `tls1-2`, `tls1-3`.
        /// </summary>
        [Input("sslMinProtoVer")]
        public Input<string>? SslMinProtoVer { get; set; }

        /// <summary>
        /// Enable/disable SSL-VPN. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("status")]
        public Input<string>? Status { get; set; }

        /// <summary>
        /// Enable/disable TLSv1.0. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("tlsv10")]
        public Input<string>? Tlsv10 { get; set; }

        /// <summary>
        /// Enable/disable TLSv1.1. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("tlsv11")]
        public Input<string>? Tlsv11 { get; set; }

        /// <summary>
        /// Enable/disable TLSv1.2. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("tlsv12")]
        public Input<string>? Tlsv12 { get; set; }

        /// <summary>
        /// Enable/disable TLSv1.3. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("tlsv13")]
        public Input<string>? Tlsv13 { get; set; }

        /// <summary>
        /// Transform backward slashes to forward slashes in URLs. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("transformBackwardSlashes")]
        public Input<string>? TransformBackwardSlashes { get; set; }

        /// <summary>
        /// Method used for assigning address for tunnel. Valid values: `first-available`, `round-robin`.
        /// </summary>
        [Input("tunnelAddrAssignedMethod")]
        public Input<string>? TunnelAddrAssignedMethod { get; set; }

        /// <summary>
        /// Enable/disable tunnel connection without re-authorization if previous connection dropped. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("tunnelConnectWithoutReauth")]
        public Input<string>? TunnelConnectWithoutReauth { get; set; }

        [Input("tunnelIpPools")]
        private InputList<Inputs.VpnsslSettingsTunnelIpPoolArgs>? _tunnelIpPools;

        /// <summary>
        /// Names of the IPv4 IP Pool firewall objects that define the IP addresses reserved for remote clients. The structure of `tunnel_ip_pools` block is documented below.
        /// </summary>
        public InputList<Inputs.VpnsslSettingsTunnelIpPoolArgs> TunnelIpPools
        {
            get => _tunnelIpPools ?? (_tunnelIpPools = new InputList<Inputs.VpnsslSettingsTunnelIpPoolArgs>());
            set => _tunnelIpPools = value;
        }

        [Input("tunnelIpv6Pools")]
        private InputList<Inputs.VpnsslSettingsTunnelIpv6PoolArgs>? _tunnelIpv6Pools;

        /// <summary>
        /// Names of the IPv6 IP Pool firewall objects that define the IP addresses reserved for remote clients. The structure of `tunnel_ipv6_pools` block is documented below.
        /// </summary>
        public InputList<Inputs.VpnsslSettingsTunnelIpv6PoolArgs> TunnelIpv6Pools
        {
            get => _tunnelIpv6Pools ?? (_tunnelIpv6Pools = new InputList<Inputs.VpnsslSettingsTunnelIpv6PoolArgs>());
            set => _tunnelIpv6Pools = value;
        }

        /// <summary>
        /// Time out value to clean up user session after tunnel connection is dropped (1 - 255 sec, default=30).
        /// </summary>
        [Input("tunnelUserSessionTimeout")]
        public Input<int>? TunnelUserSessionTimeout { get; set; }

        /// <summary>
        /// Enable/disable unsafe legacy re-negotiation. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("unsafeLegacyRenegotiation")]
        public Input<string>? UnsafeLegacyRenegotiation { get; set; }

        /// <summary>
        /// Enable to obscure the host name of the URL of the web browser display. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("urlObscuration")]
        public Input<string>? UrlObscuration { get; set; }

        /// <summary>
        /// Name of user peer.
        /// </summary>
        [Input("userPeer")]
        public Input<string>? UserPeer { get; set; }

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Input("vdomparam")]
        public Input<string>? Vdomparam { get; set; }

        /// <summary>
        /// Enable/disable use of IP pools defined in firewall policy while using web-mode. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("webModeSnat")]
        public Input<string>? WebModeSnat { get; set; }

        /// <summary>
        /// WINS server 1.
        /// </summary>
        [Input("winsServer1")]
        public Input<string>? WinsServer1 { get; set; }

        /// <summary>
        /// WINS server 2.
        /// </summary>
        [Input("winsServer2")]
        public Input<string>? WinsServer2 { get; set; }

        /// <summary>
        /// Add HTTP X-Content-Type-Options header. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("xContentTypeOptions")]
        public Input<string>? XContentTypeOptions { get; set; }

        /// <summary>
        /// Enable/disable verification of device certificate for SSLVPN ZTNA session. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ztnaTrustedClient")]
        public Input<string>? ZtnaTrustedClient { get; set; }

        public VpnsslSettingsArgs()
        {
        }
        public static new VpnsslSettingsArgs Empty => new VpnsslSettingsArgs();
    }

    public sealed class VpnsslSettingsState : global::Pulumi.ResourceArgs
    {
        /// <summary>
        /// Force the SSL-VPN security level. High allows only high. Medium allows medium and high. Low allows any. Valid values: `high`, `medium`, `default`, `low`.
        /// </summary>
        [Input("algorithm")]
        public Input<string>? Algorithm { get; set; }

        /// <summary>
        /// Enable/disable checking of source IP for authentication session. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("authSessionCheckSourceIp")]
        public Input<string>? AuthSessionCheckSourceIp { get; set; }

        /// <summary>
        /// SSL-VPN authentication timeout (1 - 259200 sec (3 days), 0 for no timeout).
        /// </summary>
        [Input("authTimeout")]
        public Input<int>? AuthTimeout { get; set; }

        [Input("authenticationRules")]
        private InputList<Inputs.VpnsslSettingsAuthenticationRuleGetArgs>? _authenticationRules;

        /// <summary>
        /// Authentication rule for SSL VPN. The structure of `authentication_rule` block is documented below.
        /// </summary>
        public InputList<Inputs.VpnsslSettingsAuthenticationRuleGetArgs> AuthenticationRules
        {
            get => _authenticationRules ?? (_authenticationRules = new InputList<Inputs.VpnsslSettingsAuthenticationRuleGetArgs>());
            set => _authenticationRules = value;
        }

        /// <summary>
        /// Enable to auto-create static routes for the SSL-VPN tunnel IP addresses. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("autoTunnelStaticRoute")]
        public Input<string>? AutoTunnelStaticRoute { get; set; }

        /// <summary>
        /// Select one or more cipher technologies that cannot be used in SSL-VPN negotiations.
        /// </summary>
        [Input("bannedCipher")]
        public Input<string>? BannedCipher { get; set; }

        /// <summary>
        /// Enable/disable overriding the configured system language based on the preferred language of the browser. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("browserLanguageDetection")]
        public Input<string>? BrowserLanguageDetection { get; set; }

        /// <summary>
        /// Enable/disable verification of referer field in HTTP request header. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("checkReferer")]
        public Input<string>? CheckReferer { get; set; }

        /// <summary>
        /// Select one or more TLS 1.3 ciphersuites to enable. Does not affect ciphers in TLS 1.2 and below. At least one must be enabled. To disable all, set ssl-max-proto-ver to tls1-2 or below. Valid values: `TLS-AES-128-GCM-SHA256`, `TLS-AES-256-GCM-SHA384`, `TLS-CHACHA20-POLY1305-SHA256`, `TLS-AES-128-CCM-SHA256`, `TLS-AES-128-CCM-8-SHA256`.
        /// </summary>
        [Input("ciphersuite")]
        public Input<string>? Ciphersuite { get; set; }

        /// <summary>
        /// Set signature algorithms related to client authentication. Affects TLS version &lt;= 1.2 only. Valid values: `no-rsa-pss`, `all`.
        /// </summary>
        [Input("clientSigalgs")]
        public Input<string>? ClientSigalgs { get; set; }

        /// <summary>
        /// Default SSL VPN portal.
        /// </summary>
        [Input("defaultPortal")]
        public Input<string>? DefaultPortal { get; set; }

        /// <summary>
        /// Compression level (0~9).
        /// </summary>
        [Input("deflateCompressionLevel")]
        public Input<int>? DeflateCompressionLevel { get; set; }

        /// <summary>
        /// Minimum amount of data that triggers compression (200 - 65535 bytes).
        /// </summary>
        [Input("deflateMinDataSize")]
        public Input<int>? DeflateMinDataSize { get; set; }

        /// <summary>
        /// DNS server 1.
        /// </summary>
        [Input("dnsServer1")]
        public Input<string>? DnsServer1 { get; set; }

        /// <summary>
        /// DNS server 2.
        /// </summary>
        [Input("dnsServer2")]
        public Input<string>? DnsServer2 { get; set; }

        /// <summary>
        /// DNS suffix used for SSL-VPN clients.
        /// </summary>
        [Input("dnsSuffix")]
        public Input<string>? DnsSuffix { get; set; }

        /// <summary>
        /// SSLVPN maximum DTLS hello timeout (10 - 60 sec, default = 10).
        /// </summary>
        [Input("dtlsHelloTimeout")]
        public Input<int>? DtlsHelloTimeout { get; set; }

        /// <summary>
        /// DTLS maximum protocol version. Valid values: `dtls1-0`, `dtls1-2`.
        /// </summary>
        [Input("dtlsMaxProtoVer")]
        public Input<string>? DtlsMaxProtoVer { get; set; }

        /// <summary>
        /// DTLS minimum protocol version. Valid values: `dtls1-0`, `dtls1-2`.
        /// </summary>
        [Input("dtlsMinProtoVer")]
        public Input<string>? DtlsMinProtoVer { get; set; }

        /// <summary>
        /// Enable DTLS to prevent eavesdropping, tampering, or message forgery. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dtlsTunnel")]
        public Input<string>? DtlsTunnel { get; set; }

        /// <summary>
        /// Tunnel mode: enable parallel IPv4 and IPv6 tunnel. Web mode: support IPv4 and IPv6 bookmarks in the portal. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("dualStackMode")]
        public Input<string>? DualStackMode { get; set; }

        /// <summary>
        /// Sort sub-tables, please do not set this parameter when configuring static sub-tables. Options: [ false, true, natural, alphabetical ]. false: Default value, do not sort tables; true/natural: sort tables in natural order. For example: [ a10, a2 ] -&gt; [ a2, a10 ]; alphabetical: sort tables in alphabetical order. For example: [ a10, a2 ] -&gt; [ a10, a2 ].
        /// </summary>
        [Input("dynamicSortSubtable")]
        public Input<string>? DynamicSortSubtable { get; set; }

        /// <summary>
        /// Encode \2F sequence to forward slash in URLs. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("encode2fSequence")]
        public Input<string>? Encode2fSequence { get; set; }

        /// <summary>
        /// Encrypt and store user passwords for SSL-VPN web sessions. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("encryptAndStorePassword")]
        public Input<string>? EncryptAndStorePassword { get; set; }

        /// <summary>
        /// Enable to force two-factor authentication for all SSL-VPNs. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("forceTwoFactorAuth")]
        public Input<string>? ForceTwoFactorAuth { get; set; }

        /// <summary>
        /// Forward the same, add, or remove HTTP header. Valid values: `pass`, `add`, `remove`.
        /// </summary>
        [Input("headerXForwardedFor")]
        public Input<string>? HeaderXForwardedFor { get; set; }

        /// <summary>
        /// Add HSTS includeSubDomains response header. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("hstsIncludeSubdomains")]
        public Input<string>? HstsIncludeSubdomains { get; set; }

        /// <summary>
        /// Enable to allow HTTP compression over SSL-VPN tunnels. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("httpCompression")]
        public Input<string>? HttpCompression { get; set; }

        /// <summary>
        /// Enable/disable SSL-VPN support for HttpOnly cookies. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("httpOnlyCookie")]
        public Input<string>? HttpOnlyCookie { get; set; }

        /// <summary>
        /// SSL-VPN session is disconnected if an HTTP request body is not received within this time (1 - 60 sec, default = 20).
        /// </summary>
        [Input("httpRequestBodyTimeout")]
        public Input<int>? HttpRequestBodyTimeout { get; set; }

        /// <summary>
        /// SSL-VPN session is disconnected if an HTTP request header is not received within this time (1 - 60 sec, default = 20).
        /// </summary>
        [Input("httpRequestHeaderTimeout")]
        public Input<int>? HttpRequestHeaderTimeout { get; set; }

        /// <summary>
        /// Enable/disable redirect of port 80 to SSL-VPN port. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("httpsRedirect")]
        public Input<string>? HttpsRedirect { get; set; }

        /// <summary>
        /// SSL VPN disconnects if idle for specified time in seconds.
        /// </summary>
        [Input("idleTimeout")]
        public Input<int>? IdleTimeout { get; set; }

        /// <summary>
        /// IPv6 DNS server 1.
        /// </summary>
        [Input("ipv6DnsServer1")]
        public Input<string>? Ipv6DnsServer1 { get; set; }

        /// <summary>
        /// IPv6 DNS server 2.
        /// </summary>
        [Input("ipv6DnsServer2")]
        public Input<string>? Ipv6DnsServer2 { get; set; }

        /// <summary>
        /// IPv6 WINS server 1.
        /// </summary>
        [Input("ipv6WinsServer1")]
        public Input<string>? Ipv6WinsServer1 { get; set; }

        /// <summary>
        /// IPv6 WINS server 2.
        /// </summary>
        [Input("ipv6WinsServer2")]
        public Input<string>? Ipv6WinsServer2 { get; set; }

        /// <summary>
        /// SSL VPN maximum login attempt times before block (0 - 10, default = 2, 0 = no limit).
        /// </summary>
        [Input("loginAttemptLimit")]
        public Input<int>? LoginAttemptLimit { get; set; }

        /// <summary>
        /// Time for which a user is blocked from logging in after too many failed login attempts (0 - 86400 sec, default = 60).
        /// </summary>
        [Input("loginBlockTime")]
        public Input<int>? LoginBlockTime { get; set; }

        /// <summary>
        /// SSLVPN maximum login timeout (10 - 180 sec, default = 30).
        /// </summary>
        [Input("loginTimeout")]
        public Input<int>? LoginTimeout { get; set; }

        /// <summary>
        /// SSL-VPN access port (1 - 65535).
        /// </summary>
        [Input("port")]
        public Input<int>? Port { get; set; }

        /// <summary>
        /// Enable means that if SSL-VPN connections are allowed on an interface admin GUI connections are blocked on that interface. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("portPrecedence")]
        public Input<string>? PortPrecedence { get; set; }

        /// <summary>
        /// Enable to require client certificates for all SSL-VPN users. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("reqclientcert")]
        public Input<string>? Reqclientcert { get; set; }

        /// <summary>
        /// Enable to allow SSL-VPN sessions to bypass routing and bind to the incoming interface. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("routeSourceInterface")]
        public Input<string>? RouteSourceInterface { get; set; }

        /// <summary>
        /// SAML local redirect port in the machine running FCT (0 - 65535). 0 is to disable redirection on FGT side.
        /// </summary>
        [Input("samlRedirectPort")]
        public Input<int>? SamlRedirectPort { get; set; }

        /// <summary>
        /// Name of the server certificate to be used for SSL-VPNs.
        /// </summary>
        [Input("servercert")]
        public Input<string>? Servercert { get; set; }

        /// <summary>
        /// Enable/disable negated source IPv6 address match. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sourceAddress6Negate")]
        public Input<string>? SourceAddress6Negate { get; set; }

        [Input("sourceAddress6s")]
        private InputList<Inputs.VpnsslSettingsSourceAddress6GetArgs>? _sourceAddress6s;

        /// <summary>
        /// IPv6 source address of incoming traffic. The structure of `source_address6` block is documented below.
        /// </summary>
        public InputList<Inputs.VpnsslSettingsSourceAddress6GetArgs> SourceAddress6s
        {
            get => _sourceAddress6s ?? (_sourceAddress6s = new InputList<Inputs.VpnsslSettingsSourceAddress6GetArgs>());
            set => _sourceAddress6s = value;
        }

        /// <summary>
        /// Enable/disable negated source address match. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sourceAddressNegate")]
        public Input<string>? SourceAddressNegate { get; set; }

        [Input("sourceAddresses")]
        private InputList<Inputs.VpnsslSettingsSourceAddressGetArgs>? _sourceAddresses;

        /// <summary>
        /// Source address of incoming traffic. The structure of `source_address` block is documented below.
        /// </summary>
        public InputList<Inputs.VpnsslSettingsSourceAddressGetArgs> SourceAddresses
        {
            get => _sourceAddresses ?? (_sourceAddresses = new InputList<Inputs.VpnsslSettingsSourceAddressGetArgs>());
            set => _sourceAddresses = value;
        }

        [Input("sourceInterfaces")]
        private InputList<Inputs.VpnsslSettingsSourceInterfaceGetArgs>? _sourceInterfaces;

        /// <summary>
        /// SSL VPN source interface of incoming traffic. The structure of `source_interface` block is documented below.
        /// </summary>
        public InputList<Inputs.VpnsslSettingsSourceInterfaceGetArgs> SourceInterfaces
        {
            get => _sourceInterfaces ?? (_sourceInterfaces = new InputList<Inputs.VpnsslSettingsSourceInterfaceGetArgs>());
            set => _sourceInterfaces = value;
        }

        /// <summary>
        /// Enable to allow client renegotiation by the server if the tunnel goes down. Valid values: `disable`, `enable`.
        /// </summary>
        [Input("sslClientRenegotiation")]
        public Input<string>? SslClientRenegotiation { get; set; }

        /// <summary>
        /// Enable/disable insertion of empty fragment. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("sslInsertEmptyFragment")]
        public Input<string>? SslInsertEmptyFragment { get; set; }

        /// <summary>
        /// SSL maximum protocol version. Valid values: `tls1-0`, `tls1-1`, `tls1-2`, `tls1-3`.
        /// </summary>
        [Input("sslMaxProtoVer")]
        public Input<string>? SslMaxProtoVer { get; set; }

        /// <summary>
        /// SSL minimum protocol version. Valid values: `tls1-0`, `tls1-1`, `tls1-2`, `tls1-3`.
        /// </summary>
        [Input("sslMinProtoVer")]
        public Input<string>? SslMinProtoVer { get; set; }

        /// <summary>
        /// Enable/disable SSL-VPN. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("status")]
        public Input<string>? Status { get; set; }

        /// <summary>
        /// Enable/disable TLSv1.0. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("tlsv10")]
        public Input<string>? Tlsv10 { get; set; }

        /// <summary>
        /// Enable/disable TLSv1.1. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("tlsv11")]
        public Input<string>? Tlsv11 { get; set; }

        /// <summary>
        /// Enable/disable TLSv1.2. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("tlsv12")]
        public Input<string>? Tlsv12 { get; set; }

        /// <summary>
        /// Enable/disable TLSv1.3. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("tlsv13")]
        public Input<string>? Tlsv13 { get; set; }

        /// <summary>
        /// Transform backward slashes to forward slashes in URLs. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("transformBackwardSlashes")]
        public Input<string>? TransformBackwardSlashes { get; set; }

        /// <summary>
        /// Method used for assigning address for tunnel. Valid values: `first-available`, `round-robin`.
        /// </summary>
        [Input("tunnelAddrAssignedMethod")]
        public Input<string>? TunnelAddrAssignedMethod { get; set; }

        /// <summary>
        /// Enable/disable tunnel connection without re-authorization if previous connection dropped. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("tunnelConnectWithoutReauth")]
        public Input<string>? TunnelConnectWithoutReauth { get; set; }

        [Input("tunnelIpPools")]
        private InputList<Inputs.VpnsslSettingsTunnelIpPoolGetArgs>? _tunnelIpPools;

        /// <summary>
        /// Names of the IPv4 IP Pool firewall objects that define the IP addresses reserved for remote clients. The structure of `tunnel_ip_pools` block is documented below.
        /// </summary>
        public InputList<Inputs.VpnsslSettingsTunnelIpPoolGetArgs> TunnelIpPools
        {
            get => _tunnelIpPools ?? (_tunnelIpPools = new InputList<Inputs.VpnsslSettingsTunnelIpPoolGetArgs>());
            set => _tunnelIpPools = value;
        }

        [Input("tunnelIpv6Pools")]
        private InputList<Inputs.VpnsslSettingsTunnelIpv6PoolGetArgs>? _tunnelIpv6Pools;

        /// <summary>
        /// Names of the IPv6 IP Pool firewall objects that define the IP addresses reserved for remote clients. The structure of `tunnel_ipv6_pools` block is documented below.
        /// </summary>
        public InputList<Inputs.VpnsslSettingsTunnelIpv6PoolGetArgs> TunnelIpv6Pools
        {
            get => _tunnelIpv6Pools ?? (_tunnelIpv6Pools = new InputList<Inputs.VpnsslSettingsTunnelIpv6PoolGetArgs>());
            set => _tunnelIpv6Pools = value;
        }

        /// <summary>
        /// Time out value to clean up user session after tunnel connection is dropped (1 - 255 sec, default=30).
        /// </summary>
        [Input("tunnelUserSessionTimeout")]
        public Input<int>? TunnelUserSessionTimeout { get; set; }

        /// <summary>
        /// Enable/disable unsafe legacy re-negotiation. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("unsafeLegacyRenegotiation")]
        public Input<string>? UnsafeLegacyRenegotiation { get; set; }

        /// <summary>
        /// Enable to obscure the host name of the URL of the web browser display. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("urlObscuration")]
        public Input<string>? UrlObscuration { get; set; }

        /// <summary>
        /// Name of user peer.
        /// </summary>
        [Input("userPeer")]
        public Input<string>? UserPeer { get; set; }

        /// <summary>
        /// Specifies the vdom to which the resource will be applied when the FortiGate unit is running in VDOM mode. Only one vdom can be specified. If you want to inherit the vdom configuration of the provider, please do not set this parameter.
        /// </summary>
        [Input("vdomparam")]
        public Input<string>? Vdomparam { get; set; }

        /// <summary>
        /// Enable/disable use of IP pools defined in firewall policy while using web-mode. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("webModeSnat")]
        public Input<string>? WebModeSnat { get; set; }

        /// <summary>
        /// WINS server 1.
        /// </summary>
        [Input("winsServer1")]
        public Input<string>? WinsServer1 { get; set; }

        /// <summary>
        /// WINS server 2.
        /// </summary>
        [Input("winsServer2")]
        public Input<string>? WinsServer2 { get; set; }

        /// <summary>
        /// Add HTTP X-Content-Type-Options header. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("xContentTypeOptions")]
        public Input<string>? XContentTypeOptions { get; set; }

        /// <summary>
        /// Enable/disable verification of device certificate for SSLVPN ZTNA session. Valid values: `enable`, `disable`.
        /// </summary>
        [Input("ztnaTrustedClient")]
        public Input<string>? ZtnaTrustedClient { get; set; }

        public VpnsslSettingsState()
        {
        }
        public static new VpnsslSettingsState Empty => new VpnsslSettingsState();
    }
}
