Skip to main content
Mehulp
New Member
August 11, 2023
Question

Split Tunnel

  • August 11, 2023
  • 4 replies
  • 4096 views

How to Configure split Tunnel to exclude only Microsoft Teams Traffic (There is no option to exclude FQDN for Trusted destination)

4 replies

Babitha_M
Staff
Staff
August 11, 2023

Hi Mehul,

 

Please note that the ISDB object will not support split tunneling. It is necessary to manually build an address group and include all of the Teams addresses.

 

Regards,
Babitha M

 

Mehulp
MehulpAuthor
New Member
August 12, 2023

Is there any template to perform the same because there are a lot of IP ranges for MS Teams

funkylicious
SuperUser
SuperUser
August 12, 2023

These would be the ranges for TCP/80,443

13.107.64.0/18, 52.112.0.0/14, 52.122.0.0/15, 52.238.119.141/32, 52.244.160.207/32

"jack of all trades, master of none"
esalija
Staff
Staff
August 12, 2023
pavankr5
Staff
Staff
August 15, 2023

Hello @Mehulp.,

 

+ Find the IP address ranges that Microsoft Teams uses for its traffic. Microsoft provides a list of IP addresses and ranges that their services use, including Teams.

+ Set up the basic split tunneling configuration on your FortiGate firewall to route general internet traffic through the VPN tunnel while allowing specific traffic to bypass it.

+ You'll need to create a custom routing table to handle the traffic you want to exclude from the VPN tunnel.
+ Assign the custom routing table to the IP address ranges associated with Microsoft Teams traffic.


Example of what the CLI configuration might look like

config system dns-database

edit "microsoft_teams"

config ip-range

edit 1

set start-ip <start_ip>

set end-ip <end_ip>

next

end

next

end

 

 

config system route-table

edit "teams_bypass"

config rule

edit 1 set src 0.0.0.0 0.0.0.0

set dst "microsoft_teams"

set gateway <gateway_ip>

next

end

next

end

 

Let us know if you have any queries.

 

Thanks,

Pavan