Technical Tip: Access to Specific FQDN using Split Tunnel SSL VPN

[gmarcuccetti]

Description

This article explains how to allow access to specific site FQDN using split tunnel SSLVPN.
FQDN address is not supported in split tunnel.

Scope

FortiGate.

Solution

To achieve this requirement, follow below steps:

1. Keep Split Tunneling routing address blank in SSL-VPN portal. 
   

In FortiOS 7.0.x and above, split tunneling must be enabled based on policy destination. 

2. Configure the SSL-VPN setting to allow access to portal. 
3. Configure the FQDN for which it is required to allow access using SSLVPN split tunnel. Go to Policy & Objects -> Addresses -> Create New .

Note:

Address Type should be FQDN

Example here below of FQDN : example.com.

4. Create a firewall policy with the destination address as the FQDN object created in step 3.

5.  After logging in via split tunnel SSL VPN, the IP address of example.com is installed in the routing table of the SSL VPN client.

At client computer, the route of FQDN example.com ( 93.184.16.34) is shown:

C:\Users\fortinet>route print
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     10.201.3.146     10.201.3.153      6
       10.201.0.0    255.255.240.0         On-link      10.201.3.153    261
     10.201.3.146  255.255.255.255         On-link      10.201.3.153      5
   10.212.134.200  255.255.255.255         On-link    10.212.134.200    257
    93.184.216.34  255.255.255.255   10.212.134.201   10.212.134.200      1       <----- Prefix for FQDN
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      10.201.3.153    261
        224.0.0.0        240.0.0.0         On-link    10.212.134.200    257
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
===========================================================================

6. Add other external address in Firewall policy also, if customer want access external address and particular FQDN.

At client computer, the route of FQDN example.com ( 93.184.16.34) and prefix 8.8.8.8/32, which was added in the policy, is shown:

C:\Users\fortinet>route print
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     10.201.3.146     10.201.3.153      6
          8.8.8.8  255.255.255.255   10.212.134.201   10.212.134.200      1       <----- Prefix that was added in policy
       10.201.0.0    255.255.240.0         On-link      10.201.3.153    261
    10.201.15.255  255.255.255.255         On-link      10.201.3.153    261
   10.212.134.200  255.255.255.255         On-link    10.212.134.200    257
    93.184.216.34  255.255.255.255   10.212.134.201   10.212.134.200      1       <----- Prefix for FQDN
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      10.201.3.153    261
        224.0.0.0        240.0.0.0         On-link    10.212.134.200    257
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
===========================================================================

Whichever address or FQDN is added to the firewall policy of the SSL VPN IPv4 policy that route will get installed in the routing table of the PC only need to Keep Split Tunneling routing address blank in the SSL VPN portal.

•  To reach internal resources, create a policy to inject the proper subnets into the Client routing table

Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     10.201.3.146     10.201.3.153      6

          8.8.8.8  255.255.255.255   10.212.134.201   10.212.134.200      1  <----- subnet that was added in the first policy
    192.168.108.0    255.255.255.0   10.212.134.201   10.212.134.200      1       <----- subnet that was added in the second policy
    192.168.112.0    255.255.255.0   10.212.134.201   10.212.134.200      1       <----- subnet that was added in the second policy
    192.168.200.0    255.255.255.0   10.212.134.201   10.212.134.200      1       <----- subnet that was added in the second policy
       10.201.0.0    255.255.240.0         On-link      10.201.3.153    261
    10.201.15.255  255.255.255.255         On-link      10.201.3.153    261
   10.212.134.200  255.255.255.255         On-link    10.212.134.200    257
    93.184.216.34  255.255.255.255   10.212.134.201   10.212.134.200      1       <----- Prefix for FQDN
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      10.201.3.153    261
        224.0.0.0        240.0.0.0         On-link    10.212.134.200    257
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306

===========================================================================

Note.

Be sure that the FQDN address object is resolved by the FortiGate.

Unresolved FQDN can cause connection failure.