IPsec won't split tunnel

[noc]

Hello,

I'm trying to configure an IPsec tunnel to replace ssl-vpn, but i can't make split tunnel to work.

I have split-tunnel enabled with just an internal network allowed, and a policy that explicity allows traffic to that network.

The problem is, once connected, the tunnel pushes a default route to the client, so all the traffic goes thru the Fortigate.

I already tried things i saw on this forum but nothing worked

To add info; doesn't matter what config i do on the forti or client side, doing "route print" always show a default route to the Forti (when i'm connected). 

[FortiDor]

Thanks for the reply.

I have 0.0.0.0/0.0.0.0 for the IPSec Phase 2 Selector.
A specific policy from the IPSec interface to the destination interface

I see the split tunneling routing working from Windows : 

> 192.168.30.0 255.255.255.0 10.212.136.2 10.212.136.1 1

And the debug flow from the FGT with the ICMP request but not reply :

diag sniff packet any 'host 192.168.30.10 and icmp' 4 0 l
interfaces=[any]
filters=[host 192.168.30.10 and icmp]
2025-07-20 22:35:12.577011 IPsec-TCP in 10.212.136.1 -> 192.168.30.10: icmp: echo request
2025-07-20 22:35:17.529982 IPsec-TCP in 10.212.136.1 -> 192.168.30.10: icmp: echo request

The routing monitor is ok, the Outgoing Data in the FGT is ok but nothing in the FCT :

Duration
00:04:41
Byte sended
0 Ko
Byte received
8.1 Ko

Any ideas ?

[sjoshi]

Here the traffic is coming to the FGT but it is not matching policy for some reason.

debug flow will help us identify it

diagnose debug enable
diagnose debug flow filter addr 192.168.30.10
diagnose debug flow show function-name enable
diagnose debug flow trace start 9999

diag debug disable >> to stop it

Also share below output

get router info routing-table details 192.168.30.10

[noc]

I couldn't try it until now.

I freshly reinstalled Forticlient and now it works as expected, thanks!

[michael2406]

For me the solution was to check network adapters from Fortinet in "Device-Manager". There were Fortinet Adapters with #2 or #3 at the end. Delete them, afterwars it started to work. 

[FortiDor]

Thanks @michael2406  !

Indeed it works ! 

Is it a bug in the FCT 7.4.3 with the workaround of deleting the both network adapters ? Something in the Release Notes ? 

[michael2406]

I opened a ticket and there was nothing about a bug... they just confirmed that it is a solution to solve the problem. Seems this issue is present in many forticlient versions.. maybe a "normal" behaviour in some cirumstances when you update your forticlient....

[FortiDor]

Thanks @michael2406 

Very strange if it’s not a bug regarding the Support. 
Now it’s not working again and only the SSL VPN is stable enough

I hope it will better in the next releases 

[sferoz]

Hi Noc,
Can you help share the config, TAC case no and relevant PC route print logs if any to sferoz@fortinet.com for more investigation. Also, please update as per previous suggestions  once you re-install the FCT 7.4.3 if you are still having the same issue. 

[michael2406]

I send you an email with case number. When reinstalling 7.4.3 with previous removal of FortiClient with FortiClient-Remover-Tool, than it also works. But these adapters where coming with some previous version of FortiClient. We had issues with clients which only had 7.4.2 installed before. So may it was a issue when updating from 7.4.2 to 7.4.3?