Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
vinch100
New Contributor

SSLVPN - Negated Split Tunneling

Hello,

 

we want to achieve a special case where our external users would use the VPN for all traffic EXCEPT some well known VoIP Gateway that we want them to access through their local breakout, IPSec VPN has the command ipv4-split-exclude but I cannot find the same feature on SSL-VPN... any idea ?

 

Best regards

 

Vincent

1 Solution
Kenundrum
Contributor III

This is by no means an elegant solution... but theoretically would work.

You can turn on split tunneling and then make the routed addresses be all the address space except the VOIP gateway. You'll probably have to create an address with all IPs before the address, and another with all the IPs after it and put both in the tunnel portal config. I've had to do something similar with packet captures in the past and it did work.

CISSP, NSE4

 

View solution in original post

3 REPLIES 3
Kenundrum
Contributor III

This is by no means an elegant solution... but theoretically would work.

You can turn on split tunneling and then make the routed addresses be all the address space except the VOIP gateway. You'll probably have to create an address with all IPs before the address, and another with all the IPs after it and put both in the tunnel portal config. I've had to do something similar with packet captures in the past and it did work.

CISSP, NSE4

 

vinch100

Thank you Kenundrum, that sound like a good workaround !

neonbit
Valued Contributor

6.2 introduced a negate feature for firewall addresses (in address groups). They work well with policies, but have never tested for SSLVPN tunnel mode. Worth giving it a try as it's alot easier to configure.