Description
This article describes how to enable/disable split tunnel for IPsec dial-up VPN.
Scope
FortiGate.
Solution
Enable this feature while configuring the VPN tunnel via wizard as shown below.
If this option is enabled, then only internal traffic will be routed via VPN tunnel.
If this option has been missed and to re-enable or disable this option after configuring the tunnel, follow these steps:
Go to VPN -> IPSec Tunnels, edit the respective tunnel under 'Network', select the 'Enable IPv4 Split Tunnel' checkbox and specify the internal subnet under 'Accessible Network'.
Go to VPN -> IPSec Tunnels, edit the respective tunnel under 'Network', select the 'Enable IPv4 Split Tunnel' checkbox and specify the internal subnet under 'Accessible Network'.
Note: the 'all' subnet can not be used under 'Accessible Network' for the Split tunnel configuration, as split tunnel will not work.
Enable/disable this via CLI:
config vpn ipsec phase1-interface
edit DialUPVPN
set ipv4-split-include "DialUPVPN_split"
end
Important:
The 'Accessible Networks' Address needs to be of the subnet type - using an IP range is not supported and will ignore the split tunnel enable settings by adding a default route instead of the range.
IKE debug will contain the following error when using IP ranges:
mode-cfg ignoring range 0:10.0.1.240-10.0.1.254:0, only ip/subnet supported
