Troubleshooting Tip: 'Your device may not support more than 30 routes' when using split tunnel

Description

This article discusses the error message 'Your device may not support more than 30 routes' after trying to connect to the FortiClient VPN.

Scope

FortiGate, FortiClient.

Solution

In some cases, the error message may be seen 'Your device may not support more than 30 routes' while using split tunneling.

Symptoms that may be seen with pushing many routes to the client are:

1. FortiClient may disconnect after a few seconds.

2. VPN traffic will not flow.

3. Routes may be missing.

 
If this is the case, try the following suggestions:

1. Route Summary.

As an example, a split tunnel address group has the following networks:

• 10.0.1.0/24

• 10.0.2.0/24

• 10.0.3.0/24

The following addresses can be summarized as:

• 10.0.1.0/22

If SSL VPN is being used check the routing address override under VPN -> SSL VPN Portal -> Routing Address Override. Or, if there is no routing address override check the SSL VPN firewall policy.

If IPsec is being used check the split tunneling networks under VPN -> IPSec Tunnels -> Network -> IPv4 split tunnel.

2. Full Tunnel.

When using a full tunnel the route 0.0.0.0/0 will be pushed to the device's routing table when they connect to the SSL VPN.

Note: If the issue persists after reviewing the split tunneling configuration, perform the following troubleshooting steps.

3. Verify the routes installed on the endpoint.

For Windows devices, establish the VPN connection and run the following command in the command prompt:

route print -4

Review the IPv4 routing table and verify whether the expected split tunnel routes have been installed through the FortiClient VPN adapter.

Compare the installed routes against the networks configured on the FortiGate.

If the VPN disconnects immediately, collect the routing table before the connection attempt and review the FortiClient diagnostic logs.