Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ivan_bermejo
New Contributor

FortiAP / FortiWifi split tunneling configuration not possible

Hi all,

 

we are trying to use the split tunneling configuration for FortiAPs in non-directectly connected VLANs to Fortigate. This APs are configured in a tunnel configuration (captive portal required) but it would be interesting to split the traffic, as said in the 5.6 configuration guide, to avoid loading the fortigate with unnecessary traffic to Internet. But... there seems to be no way to do so, since the networks to avoid the tunnel (being directly routed through the AP), must be declared wether in FortiAP Profile or AP, and it is not possible to do so for all Internet addresses.

 

So the question is: is it possible to declare which networks should be tunneled to the Fortigate, instead of the locally routed from the AP? Is there a possible configuration for routing locally all Internet but tunnelling to fortigate some IP networks/ranges?

 

Best regards

Ivan

4 REPLIES 4
_sergey_
New Contributor

ivan.bermejo@es.logicalis.com wrote:

So the question is: is it possible to declare which networks should be tunneled to the Fortigate, instead of the locally routed from the AP? Is there a possible configuration for routing locally all Internet but tunnelling to fortigate some IP networks/ranges?

 

Check this out https://forum.fortinet.com/tm.aspx?m=154038

wanglei_FTNT

Please post your complete config and we will check it out and get back to you. 

 

Thanks,

 

Lei

_sergey_

wanglei@fortinet.com wrote:

Please post your complete config and we will check it out and get back to you. 

 Thanks,

 Lei

Replied here https://forum.fortinet.com/tm.aspx?m=154038

Sumanth_FTNT

Yes its supported on latest 5.6.3 builds.. as per what i understand the Tunnel ACL can be done in two ways..

 

set split-tunneling-acl-path ? tunnel Split tunneling ACL list traffic will be tunnel. local Split tunneling ACL list traffic will be local NATed.