Skip to main content
froggle
froggle
New Member
March 24, 2020
Solved

SSL VPN Split Tunnel - Route specific IP/FQDN out locally

  • March 24, 2020
  • 2 replies
  • 26793 views

Hello,

 

I can't seem to find any questions quite like mine, and I apologize if I have missed them.

 

Fortigate 300D - 6.0.4

 

We are setting up a SSL VPN with Split Tunneling. I can route our internal networks and some public IP Addresses through the tunnel. That much is easy.

 

What I am trying to find out is if I can switch this around? So I would specify 0.0.0.0/0 to go through the tunnel, but then specify IPs, or FQDNs out through the endpoints local ISP. Specifically Microsoft Office 365 traffic.

 

The reason I am thinking this way is because we currently have no control of internet access at the endpoint, like WebFilter/AppControl using FortiClient. Something I hope to get soon, but having to wait. I don't like the idea of internet access outside of the corp net that I cannot control. And this is why we don't use Split-Tunneling.

 

Feel free to change my mind here, I might be barking up the wrong tree. If I had EMS I wouldn't be doing this.

 

Many thanks!

Best answer by Abraham

Same Idea and same Problem. I tried the same approach but the split tunnel configuration allow to configure only IP address network or ranges no FQDN or Internet services. So the only solution possible is to configure network ranges of all IPv4 ip addresses and exclude those you want to split. ex.

 

You what to split: 10.255.255.0/24 (255 IP adresses) Two network ranges

1-Configure a network range 0.0.0.0-10.255.254.255

2-Configure a network range 11.0.0.0-255.255.255.255

3- Add IP ranges to under split-tunnel routing address   

2 replies

Abraham
AbrahamAnswer
New Member
March 30, 2020

Same Idea and same Problem. I tried the same approach but the split tunnel configuration allow to configure only IP address network or ranges no FQDN or Internet services. So the only solution possible is to configure network ranges of all IPv4 ip addresses and exclude those you want to split. ex.

 

You what to split: 10.255.255.0/24 (255 IP adresses) Two network ranges

1-Configure a network range 0.0.0.0-10.255.254.255

2-Configure a network range 11.0.0.0-255.255.255.255

3- Add IP ranges to under split-tunnel routing address   

TecnetRuss
TecnetRuss
Visitor III
March 30, 2020

Sorry but it should be said that FortiOS 6.0.4 has three pretty serious SSL-VPN vulnerabilities and I would strongly recommend against deploying SSL-VPN before upgrading to at least 6.0.5 but preferably the latest 6.0.x release (currently 6.0.9).

 

https://www.fortinet.com/blog/business-and-technology/fortios-ssl-vulnerability.html

https://fortiguard.com/psirt/FG-IR-18-384

https://fortiguard.com/psirt/FG-IR-18-388

https://fortiguard.com/psirt/FG-IR-18-389

 

Russ

NSE7

CHXGVA
CHXGVA
New Member
April 21, 2020

Hi Froggle ,

 

Same problem here, in order to configure Office 365 correctly Microsoft recommend Split Tunneling and they provide the required addresses.  We would like to keep the majority of Web traffic running through the Forti but to force 0365 traffic to be routed directly on the client. 0365 is becoming very very widely deployed and I imagine that we are not alone in the request.

nsandone
nsandone
New Member
May 18, 2020

This is something a lot of people have been asking for.   It looks like 6.4.0 finally has this feature although I haven't tested it myself yet.   You need FortiOS 6.4.0 and FortiClient 6.4.0 for it to work from what I'm reading.    There is a CLI option:

 

set split-tunneling-routing-negate

 

 

Kevin_Shanus
Kevin_Shanus
New Member
May 22, 2020

The below article would do the opposite by forcing specific FQDN to use the tunnel and not local internet? Thanks

 

https://kb.fortinet.com/kb/documentLink.do?externalID=FD46248

 

 

Juquinha
Juquinha
New Member
February 5, 2021

Kevin Shanus wrote:

The below article would do the opposite by forcing specific FQDN to use the tunnel and not local internet? Thanks

 

https://kb.fortinet.com/kb/documentLink.do?externalID=FD46248

 

 

This works like a charm for hostnames that resolves only to one IP address. Does anyone had problems qith hostnames that have more than one IP? Example, the URl xpto.com resolve to 200.200.200.200 and 200.200.1.1. The Forticlient will only route one of them to inside the SSLVPN tunnel.

Terms & ConditionsAccessibility statement