Technical Tip: Convert SSL VPN Full tunnel to Split tunnel

[Mrinmoy]

Description	This article describes the process of converting an SSL VPN Full tunnel configuration into a split tunnel configuration.
Scope	FortiOS 6.4 or later.
Solution	For this conversion, modification is required to two parts of configuration: SSL VPN portals. Firewall policy. In this case, note that the split tunnel is disabled, which means the VPN is configured for the full tunnel. To change from full tunnel to split tunnel under SSL VPN portal settings, tunnel mode should be changed from 'Disabled' to 'Enabled Based on Policy Destination'. Selecting 'Enabled Based on Policy Destination' will check the firewall policy 'SSL VPN tunnel to the internal network' and, based on the policy configuration, the firewall will send route information to the SSL VPN client.  For SSL VPN full tunnel to allow traffic from the SSL VPN tunnel to the internal and public networks, two firewall policies are required. From SSL VPN to LAN. From SSL VPN to WAN. While converting the VPN, the firewall policy 'SSL VPN to WAN' should be deleted. The following picture shows that unnecessary firewall policy. The following firewall policy will remain in FortiGate: Results: Before converting the VPN config, the route table in user's computer is (2 default routes and via VPN has higher priority): After converting the VPN config, the route table in the user's computer is (Only 1 default route and specific destination route for the LAN):