Skip to main content
vovochka83
vovochka83
New Member
August 30, 2021
Question

Route specific public domain for SSL VPN split tunnel

  • August 30, 2021
  • 2 replies
  • 7104 views

Is there any possible to route the public domain for example abc.com going via firewall outgoing interface? For example SSL VPN user trying to access xyz.abc.com, then fortigate will redirect the traffic via outgoing interface, else other traffic will exit SSL VPN users default gateway.

    2 replies

    lobstercreed
    lobstercreed
    New Member
    August 30, 2021

    Of course, you just have to include that in the split tunnel routing the same way you would for other LAN traffic.  In our particular case, I leave the split tunnel config blank and let the firewall build the split tunnel list by what policies are allowed.  If you do this the same, you simply need a policy to that destination with the appropriate users going from the ssl.root to the wan.  You can add more destinations as needed.

    vovochka83
    vovochka83Author
    New Member
    August 31, 2021

    what if some domains using dynamic public ip addresss with load balancer? for example nslookup xyz.aabbcc.com, will resolved 2 ip addresses 10.10.10.10, 20.20.20.20, and then after few hours change it to 30.30.30.30 and 40.40.40.40. I can't keep monitoring the ip address and add it into fortigate firewall right?

    lobstercreed
    lobstercreed
    New Member
    August 31, 2021

    Why not use an FQDN address object so that it keeps up with those changes dynamically?  I assumed that's what you intended to do in the first place.

    iincitr
    iincitr
    New Member
    November 4, 2021

    Hi 

     

    did you solve the issue?

     

    I am looking for a solution.

    Thank you

     

    JonasV
    JonasV
    Explorer
    November 9, 2021
    I’ve been trying to solve the same issue, however what I’ve encountered (even with a FQDN objekt) only the first IP that the FortiOS resolves is passed to the FortiClients = to the PC’s local routing table. Viewing the routing table of a PC with the CMD command: Route PRINT, will also only list one. At this point I think it’s a limitation of the “tunnel-VPN”.
    Terms & ConditionsAccessibility statement