VPNSSL Split tunneling using internet services

Question

Hello,

I would like to configure SSLVPN in split tunneling mode in order to reach local resources, but also some objects in GCP that have an ACL allowing the primary public IP of the Fortigate as source.

I thought of using Internet Services to allow whole GCP from the tunnel, and I was expecting the forticlient to install those routes, but it didn't.

config firewall policy   edit <rulenumber>     set uuid xxx     set srcintf "ssl.root"     set dstintf "<wanport>"     set action accept     set srcaddr "<vpnaddresspool>"     set internet-service enable     set internet-service-name "Google-Google.Cloud"     set schedule "always"     set nat enable     set groups "<groupname>"   next end

In SSLVPN Portals -> Routing Address override: I don't have access to Internet Policies.

The device is a F3501F, running latest mature version available. (7.2.10)

What would be the less time consuming of doing what I want?

Is there a way to make those Internet policies work for split tunneling? Or maybe create a project on github that build the list of ip in a .txt every day and make Fortigate query it?

Thanks,

johnathan · Answer

ISDB may not work for SSLVPN split tunnel, but FQDN objects should. If you know the FQDN of the destinations you need to reach, you can specify this in your policy and those routes should be injected in the FortiClient.  See this document: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Access-to-Specific-FQDN-using-Split-Tunnel-SSL-VPN/ta-p/190062

Sign up

Login with SSO

Login to the community

Login with SSO