Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
CrashtimeV
Visitor

How to route a specific domain over IPSec

My Setup:

I have a IPSec tunnel setup with the right side (Strongswan) sharing the internet 0.0.0.0/0.0.0.0 and left side (Fortigate) sharing a specific subnet.

 

What I want to do:d

I want to route a specific set of domains from the subnet over this tunnel and out to the internet. How exactly do I do this?

 

What I have tried: 

I have the tunnel up and am allowing all traffic to and from the tunnel to subnet and subnet to tunnel.

Created an address group with static routing selected. The route is setup as destination being my address group, interface being tunnel interface and distance is 10 there is also a blackhole route for the tunnel interface with distance 250. 

Trying this out, it didn't work. As a test I redid this for amazon and tried accessing it from incognito to see if I get redirected to the correct region and that doesnt work either. 

 

Am I missing something? What can I do to diagnose this?

2 REPLIES 2
AEK
SuperUser
SuperUser

What do you see in the routing table?

get router info routing-table all

 

AEK
AEK
arahman
Staff
Staff

Hi, are you speaking about site to site or remote access? if you are speaking about the remote access and you want the specific subnet to go over the tunnel then you can follow the article below  

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enable-split-tunnel-For-IPsec-VPN/ta-p/192...

and site to site by default work in a way that it will allow specific domain unless specified all in phase2

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors