Description
This article explains how to allow access to specific site FQDN using split tunnel SSL VPN.
FQDN address is not supported in split tunnel.
Scope
FortiGate 7.2 and FortiOS 4.
Solution
To achieve this requirement, follow the below steps:
- Keep the Split Tunneling routing address blank in the SSL VPN portal.
In FortiOS 7.0.x and above, split tunneling must be enabled based on policy destination.
- Configure the SSL VPN setting to allow access to the portal.
- Configure the FQDN for which it is required to allow access using SSL VPN split tunnel. Go to Policy & Objects -> Addresses -> Create New.
Note:
Address Type should be FQDN.
Example here below of FQDN: example.com.
- Create a firewall policy with the destination address as the FQDN object created in step 3.
- After logging in via split tunnel SSL VPN, the IP address of example.com is installed in the routing table of the SSL VPN client.
At client's computer, the route of FQDN example.com ( 93.184.16.34) is shown:
C:\Users\fortinet>route print
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.201.3.146 10.201.3.153 6
10.201.0.0 255.255.240.0 On-link 10.201.3.153 261
10.201.3.146 255.255.255.255 On-link 10.201.3.153 5
10.212.134.200 255.255.255.255 On-link 10.212.134.200 257
93.184.216.34 255.255.255.255 10.212.134.201 10.212.134.200 1 <----- Prefix for FQDN.
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.201.3.153 261
224.0.0.0 240.0.0.0 On-link 10.212.134.200 257
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.201.3.146 10.201.3.153 6
10.201.0.0 255.255.240.0 On-link 10.201.3.153 261
10.201.3.146 255.255.255.255 On-link 10.201.3.153 5
10.212.134.200 255.255.255.255 On-link 10.212.134.200 257
93.184.216.34 255.255.255.255 10.212.134.201 10.212.134.200 1 <----- Prefix for FQDN.
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.201.3.153 261
224.0.0.0 240.0.0.0 On-link 10.212.134.200 257
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
===========================================================================
- Add other external addresses in the Firewall policy also, if the customer wants to access an external address and particular FQDN.
At the client's computer, the route of FQDN example.com (93.184.16.34) and prefix 8.8.8.8/32, which was added in the policy, is shown:
C:\Users\fortinet>route print
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.201.3.146 10.201.3.153 6
8.8.8.8 255.255.255.255 10.212.134.201 10.212.134.200 1 <----- Prefix that was added in the policy.
10.201.0.0 255.255.240.0 On-link 10.201.3.153 261
10.201.15.255 255.255.255.255 On-link 10.201.3.153 261
10.212.134.200 255.255.255.255 On-link 10.212.134.200 257
93.184.216.34 255.255.255.255 10.212.134.201 10.212.134.200 1 <----- Prefix for FQDN.
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.201.3.153 261
224.0.0.0 240.0.0.0 On-link 10.212.134.200 257
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.201.3.146 10.201.3.153 6
8.8.8.8 255.255.255.255 10.212.134.201 10.212.134.200 1 <----- Prefix that was added in the policy.
10.201.0.0 255.255.240.0 On-link 10.201.3.153 261
10.201.15.255 255.255.255.255 On-link 10.201.3.153 261
10.212.134.200 255.255.255.255 On-link 10.212.134.200 257
93.184.216.34 255.255.255.255 10.212.134.201 10.212.134.200 1 <----- Prefix for FQDN.
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.201.3.153 261
224.0.0.0 240.0.0.0 On-link 10.212.134.200 257
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
===========================================================================
Whichever address or FQDN is added to the firewall policy of the SSL VPN IPv4 policy that route will get installed in the routing table of the PC it is only needed to keep the Split Tunneling routing address blank in the SSL VPN portal.
- To reach internal resources, create a policy to inject the proper subnets into the Client routing table.
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.201.3.146 10.201.3.153 6
8.8.8.8 255.255.255.255 10.212.134.201 10.212.134.200 1 <----- subnet that was added in the first policy.
192.168.108.0 255.255.255.0 10.212.134.201 10.212.134.200 1 <----- subnet that was added in the second policy.
192.168.112.0 255.255.255.0 10.212.134.201 10.212.134.200 1 <----- subnet that was added in the second policy.
192.168.200.0 255.255.255.0 10.212.134.201 10.212.134.200 1 <----- subnet that was added in the second policy.
10.201.0.0 255.255.240.0 On-link 10.201.3.153 261
10.201.15.255 255.255.255.255 On-link 10.201.3.153 261
10.212.134.200 255.255.255.255 On-link 10.212.134.200 257
93.184.216.34 255.255.255.255 10.212.134.201 10.212.134.200 1 <----- Prefix for FQDN.
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.201.3.153 261
224.0.0.0 240.0.0.0 On-link 10.212.134.200 257
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
===========================================================================
Note.
Be sure that the FortiGate resolves the FQDN address object.
Unresolved FQDN can cause connection failure.
Note that this feature does not support FQDN with dynamic IP resolution or wildcard FQDN, as FortiClient only installs routes when it connects. If the IP address gets changed while it is connected, a new IP address will not be added to the client routing table. A full tunnel is required to access wildcard FQDN or dynamic IP FQDN.
Note that this feature does not support FQDN with dynamic IP resolution or wildcard FQDN, as FortiClient only installs routes when it connects. If the IP address gets changed while it is connected, a new IP address will not be added to the client routing table. A full tunnel is required to access wildcard FQDN or dynamic IP FQDN.
