Skip to main content
Domsi
Domsi
New Member
February 25, 2020
Solved

SSL VPN - Split Tunneling

  • February 25, 2020
  • 1 reply
  • 8937 views

Hi. I have a FortiGate 100F which I have configured for SSL-VPN in "Tunnel-Mode" (also configured a policy) > which is working. Now I would like to set up "Split Tunneling" > I have enabled it and set up the routing addresses. Now the issue is, that I can only connect to the "MGMT-IP-Address" if I set the outgoing-interface to "any". I have attached a screenshot of the VPN policy. If it is configured like in the screenshot, then I'm able to connect to the "MGMT-IP-Address" for remote managment over VPN. "Security Fabric" marks this as "failed".

 

But I can't select "MGMT" as interface in the policy rules, it is not appearing in the list of interfaces. If add all available interfaces (execpt "any") to the "outgoing interface" then I'm not able to connect to the "MGMT-IP-Address" with VPN.

 

For the MGMT-IP-Address I have created a "firewall address", which I have added to the "routing addresses":

 

config firewall address     edit "VPN-MGMT"         set uuid e79017f6-4b1f-51ea-b3bb-a7dd0f696a51         set subnet 192.168.99.0 255.255.255.0     next end

 

As explained, it is working with "outgoing interface = any" of the policy - but the "Security Fabric" marks "failed" and I can't set up this Interface/IP on the outgoing interface. Can I ignore the Security Fabric for this case? I suppose not, but no I'm wondering how I can connect to the "MGMT-IP-Address".

    Best answer by sw2090

    well hm the dedicated-to-mgmt is a fortios factory default setting. If you don't nbeed a dedicated mgmt interface (like we don't need one because we have a mgmtm vlan for this purpose) you could unset this and use the port for other purposes. It then behaves like any other port does.

     

    For your policy you would have to set src to the subnet that is on your tunnel. You should have configured a client ip range on that tunnel. So traffic from client will come in with an ip out of this range.

    1 reply

    sw2090
    SuperUser
    sw2090
    SuperUser
    February 26, 2020

    hm is that mgmt interface part of a zone or trunk or switch? In this cae it is not shown anymore in the selection drop down. You would have to use zone/trunk/switch interface then instead.

    Domsi
    DomsiAuthor
    New Member
    February 26, 2020

    No, non of these three. There was only enabled "DCHP", I have disabled it now. Verifing the GUI > Ref = 0.

    sw2090
    SuperUser
    sw2090
    SuperUser
    February 26, 2020

    hm afair it could also be due to the role the interface is set to have. The Role also affects some INterface feature.

    is your MGMT dedicated to role management or similar?

    Terms & ConditionsAccessibility statement