Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
dbelflower
New Contributor

IPsec Split Tunnel with exception

We use a website that authenticates user access based on our office public IP address.  I have a vpn user that needs access to this website.  How can I force access to this site for vpn users to reflect our public IP rather than their home IP?  We would like to keep using split tunnel for all other internet access.

1 Solution
gfleming

OK.... so have you checked other stuff? Do you have a policy allowing that traffic? Have you verified that traffic is in fact going across the tunnel? Have you done debug flow? Traceroute? Anything to help us help you further?

Cheers,
Graham

View solution in original post

7 REPLIES 7
sagha
Staff
Staff

Hi dbelflower, 

 

For this specific website, you can add its public IP to the list of addresses in split tunneling. 

This way traffic would be routed to FGT via vpn tunnel and then you can allow the access towards internet for this traffic. Flow would look something like this: 

 

Client  -> VPN tunnel -> FGT --> internet -> website

This way traffic from client would use public IP of FGT. 


Hope this helps. 

 

Regards,

Shahan Agha

dbelflower

Unfortunately I can't access the website using its public IP from our office.  It redirects to another page.

gfleming

You would still add the public IP to the split tunnel list. When the remote user tries to access the page using domain name it will resolve to public IP and route over the VPN to your FGT and out your office public IP as source. However, the server will see that the client is using domain name and will present the correct web page.

 

https://www.educba.com/virtual-host/

Cheers,
Graham
dbelflower

Okay, thanks.  I added the IP address to the "Accessible Networks" for my tunnel and now it just times out when trying to access the site.

gfleming

OK.... so have you checked other stuff? Do you have a policy allowing that traffic? Have you verified that traffic is in fact going across the tunnel? Have you done debug flow? Traceroute? Anything to help us help you further?

Cheers,
Graham
alif

Hi @dbelflower ,

 

The debug flow would help to understand the traffic flow.

diagnose debug reset

diagnose debug flow filter addr <source_IP> <dest_IP> and

diagnose debug console timestamp enable

diagnose debug flow show iprope enable

diagnose  debug flow show function-name enable

diagnose debug flow trace start 1000

diagnose debug enable

 

After performing the test, you can stop debugging;

diagnose debug disable

diagnose debug reset

Regards,
SFA
dbelflower

Thanks for the help.  Once I fixed an issue with a firewall policy it worked!

Labels
Top Kudoed Authors