Skip to main content
captainit
New Member
October 28, 2024
Question

SSL VPN is not doing split tunnel

  • October 28, 2024
  • 4 replies
  • 1890 views

Hello,
How is it possible that I enable this:
Enabled Based on Policy Destination
And I still get the IP of the office and not my home WIFI?
gameie_Primary # config vdom
gameie_Primary (vdom) # edit root
current vf=root:0
gameie_Primary (root) # config vpn ssl web portal
gameie_Primary (portal) # edit "vpn-rnd"
gameie_Primary (vpn-rnd) # show
config vpn ssl web portal
edit "vpn-rnd"
set tunnel-mode enable
set ip-pools "vpn-rnd-new"
next
end
gameie_Primary (vpn-rnd) # show full-configuration
config vpn ssl web portal
edit "vpn-rnd"
set tunnel-mode enable
set ipv6-tunnel-mode disable
set web-mode disable
set allow-user-access web ftp smb sftp telnet ssh vnc rdp ping
set limit-user-logins disable
set forticlient-download enable
set ip-mode range
set auto-connect disable
set keep-alive disable
set save-password disable
set ip-pools "vpn-rnd-new"
set split-tunneling enable
set split-tunneling-routing-negate disable
set dns-server1 0.0.0.0
set dns-server2 0.0.0.0
set dns-suffix ''
set wins-server1 0.0.0.0
set wins-server2 0.0.0.0
set dhcp-ra-giaddr 0.0.0.0
set client-src-range disable
set host-check none
set mac-addr-check disable
set os-check disable
set forticlient-download-method direct
set customize-forticlient-download-url disable
next
end
gameie_Primary (vpn-rnd) #
Thanks

4 replies

honeqwo2
New Member
October 28, 2024

If you are using the "Enabled Based on Policy Destination" then your policy ID 2 has to have your specific subnets on your lan defined in the destination section. If you have all, like your image shows, then the split tunnel will match on every IP and not allow internet access through the end user's local network https://100001.onl/  .

captainit
captainitAuthor
New Member
October 28, 2024

So how can I solve it? I want everything to pass through the end user's local network except the interfaces of Fortigate.

Thanks

brandjp
New Member
November 2, 2024

Hi captainit,

perhaps you may have a look at this: Enabling split tunnel feature for SSL-VPN - Fortinet Community

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!