Technical Tip: How to access specific public IPs using SSL VPN Split Tunnel

[Shashwati]

Description	This article describes how to access specific public IPs using SSL VPN Split Tunnel.
Scope	FortiGate v6.X and v7.X.
Solution	Configure the SSL VPN portal using Split tunnel mode based on policy destination: Configure SSL VPN settings using the portal: Configure the Firewall Address object using the specific Public IP address required to access using the SSL VPN Tunnel: Configure the Firewall policy from SSL VPN to WAN using a destination-specific Public IP address object: Note: When using Central SNAT, an SNAT policy needs to be created to translate traffic from the SSL VPN interface to the WAN interface. This includes specifying the user group(s) and the destination IP address object. Connect to the SSL VPN and Confirm the Public IP route is installed using the Route Print command on the user's machine SSL VPN users will be able to access only the specific public IP and  Internal network using the VPN Tunnel. Also, it is possible to add an address object that consists of addresses of the particular domain, for example, Facebook.                                                                                Configure the routing address override to route Facebook traffic through the SSL VPN.                                                                                                                                                             Configure the policy from SSL VPN to WAN to allow traffic for the Facebook domain.                                                                                            Logs:                                                                        Debugs flow to validate the traffic flow Debugs flow to validate the traffic flow:                                                                              Note: Starting v7.6.3, the SSL VPN tunnel mode will no longer be supported by all FortiGate models and SSL VPN web mode will be called 'Agentless VPN'.