Description
This article describes how to disable the 'Split-Tunnel' feature and create an IPv4 policy for WAN access.
Scope
FortiGate.
Solution
Disabling the 'Split-Tunnel' option for SSL VPN or IPSec Dialup.
For SSL VPN refer to the following:
Go to VPN -> SSL VPN Portals -> Edit SSL VPN Portal and under 'Tunnel Mode' disable 'Enable Split Tunneling'.
Once the split tunnel option is disabled, all user Internet traffic will reach FortiGate, and a VPN interface to WAN policy is needed.
The incoming interface will be the SSL VPN interface, the outgoing interface will be the WAN interface, and in the above example, port1 is the WAN interface.
For IPSec Dialup refer to the following:
Go to VPN -> IPSec Tunnels and under Network, the option for IPv4 Split Tunnel must be disabled.
Once the IPv4 split tunnel is disabled, a firewall policy from the IPSec Dialup to the WAN policy is needed.
Note:
Doing changes in the IPsec VPN while a user is active will disconnect them. It will then be necessary to reconnect.
