FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
gmarcuccetti
Staff
Staff
Article Id 190062

Description


This article explains how to allow access to specific site FQDN using split tunnel SSL VPN.
FQDN address is not supported in split tunnel.

 

Scope

 

FortiGate 7.2 and FortiOS 4.


Solution


To achieve this requirement, follow the below steps:

 

  1. Keep the Split Tunneling routing address blank in the SSL VPN portal. 

 
In FortiOS 7.0.x and above, split tunneling must be enabled based on policy destination. 
 
portal.PNG

 

  1. Configure the SSL VPN setting to allow access to the portal. 
  2. Configure the FQDN for which it is required to allow access using SSL VPN split tunnel. Go to Policy & Objects -> Addresses -> Create New.

 

Note:

Address Type should be FQDN.

Example here below of FQDN: example.com.

 
 
  1. Create a firewall policy with the destination address as the FQDN object created in step 3.
 
 
  1.  After logging in via split tunnel SSL VPN, the IP address of example.com is installed in the routing table of the SSL VPN client.

 

 
 
At client's computer, the route of FQDN example.com ( 93.184.16.34) is shown:
 
C:\Users\fortinet>route print
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     10.201.3.146     10.201.3.153      6
       10.201.0.0    255.255.240.0         On-link      10.201.3.153    261
     10.201.3.146  255.255.255.255         On-link      10.201.3.153      5
   10.212.134.200  255.255.255.255         On-link    10.212.134.200    257
    93.184.216.34  255.255.255.255   10.212.134.201   10.212.134.200      1       <----- Prefix for FQDN.
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      10.201.3.153    261
        224.0.0.0        240.0.0.0         On-link    10.212.134.200    257
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
===========================================================================

 
  1. Add other external addresses in the Firewall policy also, if the customer wants to access an external address and particular FQDN.
 

 
 
At the client's computer, the route of FQDN example.com (93.184.16.34) and prefix 8.8.8.8/32, which was added in the policy, is shown:
 
C:\Users\fortinet>route print
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     10.201.3.146     10.201.3.153      6
          8.8.8.8  255.255.255.255   10.212.134.201   10.212.134.200      1       <----- Prefix that was added in the policy.
       10.201.0.0    255.255.240.0         On-link      10.201.3.153    261
    10.201.15.255  255.255.255.255         On-link      10.201.3.153    261
   10.212.134.200  255.255.255.255         On-link    10.212.134.200    257
    93.184.216.34  255.255.255.255   10.212.134.201   10.212.134.200      1       <----- Prefix for FQDN.
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      10.201.3.153    261
        224.0.0.0        240.0.0.0         On-link    10.212.134.200    257
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
===========================================================================

 
Whichever address or FQDN is added to the firewall policy of the SSL VPN IPv4 policy that route will get installed in the routing table of the PC it is only needed to keep the Split Tunneling routing address blank in the SSL VPN portal.
 
  •  To reach internal resources, create a policy to inject the proper subnets into the Client routing table.

 

 

Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     10.201.3.146     10.201.3.153      6


          8.8.8.8  255.255.255.255   10.212.134.201   10.212.134.200      1  <----- subnet that was added in the first policy.
    192.168.108.0    255.255.255.0   10.212.134.201   10.212.134.200      1       <----- subnet that was added in the second policy.
    192.168.112.0    255.255.255.0   10.212.134.201   10.212.134.200      1     
 <----- subnet that was added in the second policy.
    192.168.200.0    255.255.255.0   10.212.134.201   10.212.134.200      1       
<----- subnet that was added in the second policy.
       10.201.0.0    255.255.240.0         On-link      10.201.3.153    261
    10.201.15.255  255.255.255.255         On-link      10.201.3.153    261
   10.212.134.200  255.255.255.255         On-link    10.212.134.200    257
    93.184.216.34  255.255.255.255   10.212.134.201   10.212.134.200      1       
<----- Prefix for FQDN.
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      10.201.3.153    261
        224.0.0.0        240.0.0.0         On-link    10.212.134.200    257
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306

===========================================================================

 
Note.
Be sure that the FortiGate resolves the FQDN address object.
 
 
 
 
Unresolved FQDN can cause connection failure.
Note that this feature does not support FQDN with dynamic IP resolution or wildcard FQDN, as FortiClient only installs routes when it connects. If the IP address gets changed while it is connected, a new IP address will not be added to the client routing table. A full tunnel is required to access wildcard FQDN or dynamic IP FQDN.