Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor III

How to advertise a site-to-site VPN subnet to SSL VPN connections

Hi All,

The is an IPSec tunnel between a branch office and a head office. 

In the branch office there is a subnet


SSL VPN ( - HO-FG - IPSec VPN Tunnel - BO (


192168.166.0/24 route with interface BO-TUNNEL is added as a static route

Subnet - is added in the VPN phase 2 settings. 


At the moment the issue is that when SSL VPN users connect to the HO the subnet is not advertised so as a result SSL VPN users cannot access subnet in the branch office.


Could you please help to advertise subnet to SSL VPN connections.


Hi MadDog_2023,
I understood that you want to advertise ipsec vpn subnet to SSLVPN user, you can do the same under the SSLVPN portal which you are using for the SSLVPN users. If you are using split tunneling under the tunnel mode you can add ipsec vpn subnet into the routing address field. 

You have to configure the SSL VPN policies accordingly (add subnet in sslvpn policy) . Also the SSLVPN subnet should be part of phase2 selector in ipsec vpn configuration and policies should allow the traffic.


Below is the article for Split tunnel with SSL VPN:





New Contributor III

Hi @pjawalekar,

Thanks for your reply.

I will have a look on the articles you provided.

Interestingly, when under Policy & Objects - Addresses I changed to a more specific address it started to be advertised. 

Is it normal behavior for FortiGate?





Hi @MadDog_2023,


Ideally, Irrespective of specific IP or a subnet or supernet, if the object is added to the split-tunnel in the respective ssl-vpn portal mapped to the user, the same will be injected in the routing table towards ssl-vpn vnic when the user connects to ssl-vpn.


However, if you add any new IP/Subnet to split tunnel, the user must reconnect to SSL-VPN for the new routes to be injected.



- Have you found a solution? Then give your helper a "Kudos" and mark the solution

New Contributor



Have you configured the routing tables appropriately?

Proper routing configuration is crucial for directing traffic to the desired subnets. Have you added the necessary routes to ensure that traffic bound for the site-to-site VPN subnet is correctly routed through the SSL VPN connection?


Yes, a static route was added.

It works for IPSec site-to-site tunnel but did not for SSL VPN until I changed to a more specific

Esteemed Contributor III

What routes are in your client device routing-table? For Windows "route -print" for Mac "netstat -nr".

Do you see there? As @pjawalekar and @Keerthi_A explained, a common way to specify the subnets to be inserted (not advertised) in split-tunnel is to specify them in SSL VPN portals.

But you sounded like you didn't do that way but specified only at the ssl.root->BO-TUNNEL policy, which is referring to the "address" object you changed.

But I feel something is off. That's why I'd like to see what exactly in the client's table.




Hi @MadDog_2023,

When you add the whole subnet not the /32, what is the local routing table on client machine? Did you see the subnet via SSL VPN?


Top Kudoed Authors