New Member

Question

VPN for Windows Clients with local Internet browsing

15 replies
16688 views

Hello everyone!

I hope anyone can help me with this:

I have a L2TP+IPSec VPN (Dialup) configured in a Forti and Windows Clients are connecting fine.

I want to these Windows client can use Internet through theirs local default gateways, I dont want to clients navigate through the remote Fortinet.

Is it posible to create a VPN which I can use to connect from Windows OS to remote network through Forti but leaving the same local gateways?

Thanks in advance.

Regards,

SecurityPlus

Explorer III

Have you considered Split Tunneling?. Here is an article about the technology: https://kb.fortinet.com/k....do?externalId=FD36253

DamianLozanoAuthor

New Member

Thanks a lot,

It seems it is what I need

Need some time to configure it

Regards

DamianLozanoAuthor

New Member

Hello,

I used this link to set up a new vpn

The VPN was created but when I see the the VPN properties, in the network section, there is a field named "Accessible Networks", which is in the "Split tunnel" part, this field does not show anything, just a Little circle like searching for something.

I upload a screenshot to Google photos but it seems it is not supported for this.

I used the cli to remove the "Accessible Networks" but when I try to add a network, nothing appear, it only allow me to add a new network/ip range, I tried to créate a new address object but neither appears as selected.

Any Idea?

Thanks in advance

Regards!

DamianLozanoAuthor

New Member

Hello,

I have created the same VPN in another Forti as:

https://kb.fortinet.com/kb/viewContent.do?externalId=FD36253

I set it to custom

I got forticlient 5.2 for a forti OS 5.2

I configured the forticlient with the default parameters, as ipsec

I can connect but I can not use Internet, I did not add a rule in the forti to go out to Internet because I want the forticlient use the local gateway to Internet access

Here the code:

config vpn ipsec phase1-interface

    edit "VPN_Fib"

        set type dynamic

        set interface "wan1"

        set mode aggressive

        set mode-cfg enable

        set proposal aes128-sha256 aes256-sha256

        set comments "VPN: VPN_Fib (Created by VPN wizard)

        set xauthtype auto

        set authusrgrp "VPN-Users"

        set ipv4-start-ip 172.20.5.64

        set ipv4-end-ip 172.20.5.70

        set ipv4-netmask 255.255.252.0

        set dns-mode auto

        set ipv4-split-include "-Clients172"

        set save-password enable

        set psksecret ENC JS+5e/6wwAFQk7sDdTBv9/ZGrZcZzVyErqo3YGwehXeDNXZNHnqqeVHB0NgAlNCKezaOjXHB1gOGwQaJyLxBr+FpNvcEPFyFWhbAQ9g+H79LfTMd67wiMV1uUxNpfKUd5ctlp6t4wrs/hodnVto5DkEs2pP4vdU4hXDScqFmFKReQWr155Fjn0xd/e9u0DTjd/5MGQ==

    next

end

Any Idea?

Thanks in advance

Regards

config vpn ipsec phase1-interface

    edit "VPN_Fib"

        set type dynamic

        set interface "wan1"

        set mode aggressive

        set mode-cfg enable

        set proposal aes128-sha256 aes256-sha256

        set comments "VPN: VPN_Fib (Created by VPN wizard)

Para utilización de telefonía IP desde Chile"

        set xauthtype auto

        set authusrgrp "VPN-Users"

        set ipv4-start-ip 172.20.5.64

        set ipv4-end-ip 172.20.5.70

        set ipv4-netmask 255.255.252.0

        set dns-mode auto

        set ipv4-split-include "-Clients172"

        set save-password enable

        set psksecret ENC JS+5e/6wwAFQk7sDdTBv9/ZGrZcZzVyErqo3YGwehXeDNXZNHnqqeVHB0NgAlNCKezaOjXHB1gOGwQaJyLxBr+FpNvcEPFyFWhbAQ9g+H79LfTMd67wiMV1uUxNpfKUd5ctlp6t4wrs/hodnVto5DkEs2pP4vdU4hXDScqFmFKReQWr155Fjn0xd/e9u0DTjd/5MGQ==

    next

end

DamianLozanoAuthor

New Member

I realliced that when I connect to VPN, the default route in Windows clients, for 0.0.0.0/0 for VPN has 1 in metric

I change the metric on IPv4 settings but it sets again to 1 automatically the next time I connect

I think this is the problem.

Any Idea?

Thanks in advance

sw2090

SuperUser

without split tunneling your default route will be changed to the vpn once you connect and reverted back when vpn disconnects again.

DamianLozanoAuthor

New Member

But split tunneling is enabled

I followed https://kb.fortinet.com/kb/viewContent.do?externalId=FD36253

mr_vaughn

Explorer III

it is called "split tunnel" .You specify the IP subnets that the are routed across the IPSEC VPN to your site. and this get injected into the client apon connection of IPSEC VPN. so traffic is routed to internet or across VPN.

in Windows you can see this from CMD when executing "route print"

AlexL

New Member

Hi guys!

I have a similar problem, a set of several networks is included in ipv4-split-include (172.22.0.0/16, 172.25.0.0/16, 172.29.0.0/16 and others), but this does not work, clients (Windows VPN IKEv2) by still get one route, regardless of whether networks are added to ipv4-split-include or not:

172.25.0.0 255.255.0.0 On-link 172.25.151.51 36

FortiOS 6.0.9

What's wrong? How can I change this behavior?

Configured under the article https://kb.fortinet.com/k....do?externalId=FD36253

Sign up

Login with SSO

Login to the community

Login with SSO