Dial-UP IPSec IKEv2 Split Tunnel

[JvLeur]

Hi,

I am trying to migrate IKEv1 to IKEv2 Dial-UP VPN tunnels for devices that use Forticlient and that do not use Forticlient(e.g. MacOS).
The configuration includes a split tunnel setup.
When a Forticlient enabled client attempts an IPSec connection the client acquires a split tunnel VPN session.

I can see the following few lines in the debug session that indicate routes will be installed in the routing table of the device.

ike 2:QDIPS_0:10843292: processed INITIAL-CONTACT

ike 2:QDIPS_0:10843292: mode-cfg assigned (1) IPv4 address 172.28.12.1

ike 2:QDIPS_0:10843292: mode-cfg assigned (2) IPv4 netmask 255.255.255.128

ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:10.0.0.0/255.0.0.0:0

ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:172.16.0.0/255.240.0.0:0

ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:192.168.0.0/255.255.0.0:0

ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:91.200.16.0/255.255.254.0:0

ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:141.176.34.0/255.255.255.0:0

ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:185.55.137.0/255.255.255.128:0

ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:193.105.144.0/255.255.255.0:0

ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:185.206.27.2/255.255.255.255:0

However, when a MacOS client connects with the Fortigate, using the Native Mac-OS client, the client does not acquire a split tunneling configuration and only receives an default route.

In the following KB there's an explanation how to configure IPSec VPN using IKEv2 using Native MAC-OS client:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Apple-IOS-native-VPN-using-IKEv2-connectio...

However, the "Configuration Attribute Internal IP Subnet" is nowhere to be found.

Is there a possibility to have a functioning IKEv2 setup without running Forticlient? IKEv1 works just fine with split tunneling.

[funkylicious]

well, when you connect to the VPN do the DNS servers configured under Phase-1 on the FGT , can you see them in /etc/resolv.conf installed ?

if they are, make sure that you have a firewall rule that allows DNS service for this traffic, if not then it's another thing to investigate why at connect they dont get pushed to the system.

maybe the you have to follow https://docs.fortinet.com/document/forticlient/7.4.3/macos-release-notes/223986 

L.E. i just read more carefully your previous post and saw that they are present so make sure that the firewall rules are in place to be able to access them to resolve DNS queries.

[JvLeur]

If the firewall rules weren't in place, DNS queries with using @ would not work either.