IPSec VPN with multiple split-tunnel networks

Forum|Forum|9 years ago
August 11, 2017
6 replies
19788 views

Good afternoon. I have a situation where I would like to enable split-tunnel for multiple subnets that can't be expressed in a single subnet or range. For example let's say 10.0.0.0/16 and 192.168.0.0/24. On Cisco ASA this is done by creating a standard ACL for the split-tunnel that permits the desired networks.

I'm trying to do this on a FortiGate 200D running version 5.2. The VPN type is IPSec created with the iOS native client template, and it's working fine with just one of the split-tunnel networks defined. I couldn't see a way via the GUI or CLI to add more than one split-tunnel network to the VPN tunnel. Can this be done?

Thanks

Best answer by Toshi_Esumi

GUI would differ from FortiOS version to version, but at lease in CLI, you just need to duplicate the phase2-interface entry you already have after modifying the name and subnet pair (so-called selector) like below. The key is both need to be referring to the same phase1-interface.

config vpn ipsec phase2-interface

edit "IPsecTest1-1"

set phase1name "IPsecTest1"

set proposal aes256-sha256 set dhgrp 19 set dst-subnet 192.168.0.0 255.255.255.0

set src-subnet 172.16.0.0 255.255.0.0 next

edit "IPsecTest1-2"

set phase1name "IPsecTest1"

set proposal aes256-sha256 set dhgrp 19 set dst-subnet 10.0.0.0 255.0.0.0

set src-subnet 172.16.0.0 255.255.0.0 next

end

Toshi_EsumiAnswer

SuperUser

GUI would differ from FortiOS version to version, but at lease in CLI, you just need to duplicate the phase2-interface entry you already have after modifying the name and subnet pair (so-called selector) like below. The key is both need to be referring to the same phase1-interface.

config vpn ipsec phase2-interface

edit "IPsecTest1-1"

set phase1name "IPsecTest1"

set proposal aes256-sha256 set dhgrp 19 set dst-subnet 192.168.0.0 255.255.255.0

set src-subnet 172.16.0.0 255.255.0.0 next

edit "IPsecTest1-2"

set phase1name "IPsecTest1"

set proposal aes256-sha256 set dhgrp 19 set dst-subnet 10.0.0.0 255.0.0.0

set src-subnet 172.16.0.0 255.255.0.0 next

end

urho

New Member

Hi,

You need to create a address group and put all your split-tunnel networks on that group. Then on GUI or CLI put that address group to your split-tunnel-network.

rwpatterson

New Member

urho wrote:
Hi,

You need to create a address group and put all your split-tunnel networks on that group. Then on GUI or CLI put that address group to your split-tunnel-network.

This is actually optional. If you do it group wise like above, then all tunnels have the same access. If you leave them split, you can apply different services/access/schedules to the different tunnel segments.

My two cents

Myth

New Member

"If you leave them split, you can apply different services/access/schedules to the different tunnel segments."

Could you explain how this is done? Config multiple IPsec tunnels with a single subnet each? Then connect from the remote side as needed to each tunnel?