Skip to main content
dhodgson
dhodgson
New Member
April 25, 2020
Solved

SSLVPN Split tunnel 6.4.0

  • April 25, 2020
  • 1 reply
  • 8575 views

I recently upgraded our test firewalls to 6.4.0 and now split tunneling doesn't work. The VPN connects fine but all portals push a default route instead of the routes I specify. 

 

Creating new portals with the GUI or CLI have the same issue. 

    Best answer by tzals

    Last week after upgrading Fortigate 60E from v6.2.2 to v6.4.0, I noticed having VPN-SSL split-tunnel issues 2 days after the upgrade.

     

    I can remotely connect using SSL-VPN but the Internet doesn't work, only internal addresses (split tunnel is not working). Devices used:

    MacOS Catalina version 10.15.5 running FortiClient 6.4.0.1231

    iPhone iOS13.5 running FortiClient 6.0.5.0218.

     

    However, using a Windows device with Forticlient 6.4 and trying with the same VPN user account, both internet and internal address work. It was working fine on all MacOS, iOS and Windows devices when I had Fortigate v6.2.2 installed.

     

    From the Fortigate Log Details below I can see the Deny action. But I thought split tunnel prevents internet traffic access to the firewall in the first place.

    Action: Deny:policy violation

    Policy: 0

    Policy Type: Firewall

     

    [SOLVED] AFTER upgrading FortiGate firmware to v6.4.1 (released June 5th, 2020).

     

    https://docs.fortinet.com/document/fortigate/6.4.1/fortios-release-notes/289806/resolved-issues

    624477

    FortiClient SSL VPN split tunnel is not working from macOS Catalina.

    1 reply

    jbrule
    jbrule
    New Member
    April 28, 2020

    I've been able to get split-tunnelling & split-DNS to work fine for users who connect with a Windows machine; however, it is not working for my MacOS users.  The MacOS users are able to access the internal resources that I permit by policy, but their internet access is broken.  Confirmed on MacOS Mojave and Catalina.  We're using Forticlient VPN 6.2.6.0951.  Firewall is 6.4.0.  I've attached a copy of my SSL-VPN Settings, Portal, and the FW policy.

     

    I'm still doing various experiments.  Today, I think I am going to take the split-DNS out of the picture and see if that changes the MacOS behavior.

    Belgarioz
    Belgarioz
    Visitor III
    May 25, 2020

    Same behaviour here.

    At the moment i am using a MacOS Catalina and a iOS device and there is no way to make split tunnel work. I haven't tested a windows machine since i have none available right now, i will update this topic asap.

     

     

    Checked with a colleague: Indeed, it works only on windows

    tzals
    tzalsAnswer
    New Member
    May 29, 2020

    Last week after upgrading Fortigate 60E from v6.2.2 to v6.4.0, I noticed having VPN-SSL split-tunnel issues 2 days after the upgrade.

     

    I can remotely connect using SSL-VPN but the Internet doesn't work, only internal addresses (split tunnel is not working). Devices used:

    MacOS Catalina version 10.15.5 running FortiClient 6.4.0.1231

    iPhone iOS13.5 running FortiClient 6.0.5.0218.

     

    However, using a Windows device with Forticlient 6.4 and trying with the same VPN user account, both internet and internal address work. It was working fine on all MacOS, iOS and Windows devices when I had Fortigate v6.2.2 installed.

     

    From the Fortigate Log Details below I can see the Deny action. But I thought split tunnel prevents internet traffic access to the firewall in the first place.

    Action: Deny:policy violation

    Policy: 0

    Policy Type: Firewall

     

    [SOLVED] AFTER upgrading FortiGate firmware to v6.4.1 (released June 5th, 2020).

     

    https://docs.fortinet.com/document/fortigate/6.4.1/fortios-release-notes/289806/resolved-issues

    624477

    FortiClient SSL VPN split tunnel is not working from macOS Catalina.

    Terms & ConditionsAccessibility statement