Skip to main content
HS08
HS08
Visitor III
March 2, 2026
Solved

VPN IPsec Remote Acess Split Tunnel

  • March 2, 2026
  • 3 replies
  • 354 views

When we use IPSec for remote access with Split tunnel enabled, can we make the fortiget to not set dns in the client?
Now when the forticlient connected to the VPN then the client can't access the local domain.

Best answer by Toshi_Esumi

More specifically, try below:
config vpn ipsec phase1-interface
    edit <dup_ipsec_name>
        unset ipv4-dns-server1
        unset ipv4-dns-server2
    next

end

 

while you still have:
        set dns-mode manual


Toshi

3 replies

funkylicious
SuperUser
funkylicious
SuperUser
March 2, 2026

most likely the option Use sytem DNS was enabled in the IPsec config, which means it will push the DNS servers from the FortiGate to the client.

just disable it, or set it to manually in CLI and then set the correct DNS servers - https://community.fortinet.com/t5/FortiGate/Technical-Tip-Setting-multiple-DNS-server-for-IPsec-dial-up-VPN/ta-p/198129 

"jack of all trades, master of none"
AEK
SuperUser
AEK
SuperUser
March 2, 2026

Yes you disable pushing DNS because split tunnel is different than split DNS.

AEK
Toshi_Esumi
SuperUser
Toshi_EsumiAnswer
SuperUser
March 2, 2026

More specifically, try below:
config vpn ipsec phase1-interface
    edit <dup_ipsec_name>
        unset ipv4-dns-server1
        unset ipv4-dns-server2
    next

end

 

while you still have:
        set dns-mode manual


Toshi

Terms & ConditionsAccessibility statement