Technical Tip: Split tunneling on L2TP/IPSEC VPN between FortiGate and Windows 10/11

[syordanov]

Description

This article describes how to set up split tunneling on L2TP/IPSEC VPN between FortiGate and Windows 10/11. 

FortiOS does not support split tunneling unless FortiClient is used. 

To enable L2TP split tunneling directly in Windows 10/11 host: Technical Tip: How to enable split-tunneling in Windows 10/11 (L2TP/PPTP VPN)

Some users have mixed environments, and it is necessary to be able to utilize the OS native VPN client.

Related documents:
IP to HEX: https://codebeautify.org/ip-to-hex-converter
HEX to IP: https://codebeautify.org/hex-to-ip-converter
Decimal to IP : https://codebeautify.org/decimal-to-ip-converter

Scope

For v7.0.1 and above.

Solution

L2TP VPN over IPSEC is still used in many environments, some customers want to have split tunneling when L2TP VPN over IPSEC is configured. 

If the traditional way is used, the configured L2TP range can access only IP addresses from that range, because the Firewall does not provide additional routes.

This can be solved by using a DHCP server configured on the L2TP interface with option 121.

Starting with FortiOS 7.0.1 it is possible to configure DHCP on L2TP with specifying a range.

Topology example.

Configure L2TP over an IPsec tunnel from GUI.

Configure a user, in this example, 'FW user authentication' will be used:

1. Go to User & Authentication -> User Definition and select 'Create New'. 
2. Select 'Local User' and select 'Next'.

3. Enter the user name, in this case, 'l2tpuser'.

4. Select 'Next' to be ready.

A newly created user will be included in the user group 'l2tp_usergroup':

5. Create an L2TP VPN using the building VPN wizard:

6. As a local interface and addresses configure those IP addresses and interfaces which remote VPN users need to connect, for example, 'port2' and 'port3' of the FortiGate.

This wizard created 2 policy rules from the 'l2tp.root' interface to 'port2' and 'port3', but with this configuration, the remote VPN users can access only 192.168.60.0/24 network, and no other routes are received. 

For that reason, it is possible to configure DHCP on the 'l2tp.root' interface with option 121, which is only possible with FortiOS v7.0.1 onwards.

7. Configure the IP address for the 'l2tp.root' interface, using the first usable IP address from the L2tp range. Make sure to add the Remote IP/Nestmak with the second available usable IP from the L2tp range otherwise the route to the L2tp subnet will not be added accordingly and cause the split-tunnel route to fail to be pushed.

8. Enable the DHCP server, lease address range 0.0.0.0-0.0.0.0, and select 'advanced':

9. On the additional DHCP options, select 'Create new':

Option 121 will push static routes from DHCP, this option uses the hexadecimal representation of decimal values, option 121 defines the following:

• The subnet mask in CIRD notation.
• Destination subnet.
• Next hop.

In this case, 2 static routes as follows are attempted to be pushed:

192.168.2.0/24 via 192.168.60.1 and 192.168.1.0/24 via 192.168.60.1 which are connected networks to port2 and port3.

Route 1: 192.168.2.0/24 via 192.168.60.1 converted to HEX value:

Decimal value                HEX value 

/24                                18

192.168.2.0                   C0A802

192.168.60.1                 C0A83C01

192.168.2.0/24 via 192.168.60.1 -> 18C0A802C0A83C01

Route 2: 192.168.1.0/24 via 192.168.60.1 converted to HEX value:

Decimal value                HEX value 

/24                                18

192.168.1.0                   C0A801

192.168.60.1                 C0A83C01

192.168.1.0/24 via 192.168.60.1 -> 18C0A801C0A83C01

Final HEX value:

18C0A802C0A83C0118C0A801C0A83C01

DHCP option 121 calculators can be used for the HEX value of the static routes

Configuring Classless Static Route Option

To push more than 2 routes, just add the third HEX-converted route after the last one.

From CLI.

config system dhcp server

    edit 1

        set default-gateway 192.168.60.1

        set netmask 255.255.255.255

        set interface "l2t.root"

            config options

                edit 1

                    set code 121

                    set value "18C0A802C0A83C0118C0A801C0A83C01"

                next

            end

    next

end

Windows 10 output:

If after connecting to the L2TP VPN the routes are not shown, one possible solution would be to try splitting up the networks.

For example, the following route is being pushed 172.16.1.0/22 via 192.168.89.1, the hex should be '16AC1001C0A85901'.

If this is not working try pushing routes for:

• 172.16.1.0/24 via 192.168.89.1
• 172.16.2.0/24 via 192.168.89.1
• 172.16.3.0/24 via 192.168.89.1

In this case, the hex value for the DHCP Option 121 will now look like '18AC1001C0A8590118AC1002C0A8590118AC1003C0A85901'.

Related article:

Technical Tip: How to connect Windows 10 client to L2TP VPN network