FQDN through Split tunnel overrides the default route and block internet for MAC users

[yanivg11]

Hi All,

We have followed this article to set FQDN access using Split tunnel:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Access-to-Specific-FQDN-using-Split-Tunnel...

The users are able to access the FQDN thought the split-tunnel as expected.

However we noticed that MAC users are unable to browse internet while connected with FortiClient.

While looking into this we noticed that both Windows users and MAC users get a new default route when connecting with FortiClient.

But while Windows users are still able to browse the internet, MAC users are not.

First screenshot is from Windows user with FortiClient connected, this user is still able to browse the internet although the new default route:

Second screenshot is from MAC user, before and after FortiClient connected,

Once the FortiClient is connected this user is unable to browse the internet:

Any advice? tnx

[yanivg11]

Thank you AEK, will do.

[hbac]

Hi @yanivg11,

Can you show the firewall policy with FQDN configuration? What is the FortiGate and FortiClient version? 

Regards, 

[yanivg11]

Hi hbac, thank you for your reply.

I can show my policy without the FQDN entries, I have checked them all and all resolve to specific IP addresses:

Forti version 7.2.3

FortiClient version 7.0.9.0493