IPsec won't split tunnel

[noc]

Hello,

I'm trying to configure an IPsec tunnel to replace ssl-vpn, but i can't make split tunnel to work.

I have split-tunnel enabled with just an internal network allowed, and a policy that explicity allows traffic to that network.

The problem is, once connected, the tunnel pushes a default route to the client, so all the traffic goes thru the Fortigate.

I already tried things i saw on this forum but nothing worked

To add info; doesn't matter what config i do on the forti or client side, doing "route print" always show a default route to the Forti (when i'm connected). 

[sjoshi]

Hi,

Could you please try with FCT v7.4.3 and check. If the issue still persists can you show me VPN and policy config for that TNL

[noc]

I forgot to add my Forti's version, it's a 80E on v7.0.17, i can't upgrade it right now.

[sjoshi]

Hi noc,

I was not suggesting to upgrade the FGT version but the forticlient version in one PC

[noc]

Oh, i already have 7.4.3, it's on config mode too.

this is ipsec config and the policy:

    edit "TEST-IPSEC"

        set type dynamic

        set interface "wan1"

        set peertype any

        set net-device disable

        set mode-cfg enable

        set add-route disable

        set xauthtype auto

        set ipv4-start-ip 10.51.244.10

        set ipv4-end-ip 10.51.244.50

        set dns-mode auto

        set ipv4-split-include "LAN-NETWORK"

        set unity-support disable

    next

edit 15

        set srcintf "TEST-IPSEC"

        set dstintf "LAN"

        set action accept

        set srcaddr "TEST-IPSEC_range"  <-- It's the same range as the configured

        set dstaddr "LAN-NETWORK"

        set schedule "always"

        set service "ALL"

        set groups "IPSEC-GROUP"

    next

end

I've tried different configs (different IKE, range-subnet, add-route, etc..) but anything will work

[sjoshi]

can you show me the route print output from the PC and what is the IP range for the address "TEST-IPSEC_range"

[noc]

Hello,

This is the output of route print on my pc once i'm connected to the vpn:

Destino de red        Máscara de red   Puerta de enlace   Interfaz  Métrica
          0.0.0.0          0.0.0.0     10.51.244.11     10.51.244.10     25
          0.0.0.0          0.0.0.0     192.168.49.1    192.168.49.44     35
     10.51.244.10  255.255.255.255      En vínculo      10.51.244.10    281
        127.0.0.0        255.0.0.0      En vínculo         127.0.0.1    331

Addr range:

edit "TEST-IPSEC_range"
set type iprange
set start-ip 10.51.244.10
set end-ip 10.51.244.50
next

Thanks,

[sjoshi · Accepted solution]

Hi ,

This issue appears to occur only when upgrading from a previous version of FortiClient. Installing FortiClient v7.4.3 on a system where FortiClient was never previously installed works as expected.

However, if FortiClient v7.2.x is upgraded directly to v7.4.3, the default route is incorrectly installed.

As a workaround, you can uninstalled FortiClient from the affected system and performed a clean installation of v7.4.3, which should resolve the issue.

[FortiDor]

Hi @sjoshi, thanks for the feedback.

Same problem and the resolution works for me too !

Other question : I see no Outgoing Data from the VPN even if the NAT-T is enabled on both sided (FGT and FCT), any ideas ? 
The route to the splited networks is on the windows routing table.

Thanks for your help

[sjoshi]

Hi @FortiDor ,

You may share me below output post connecting the vpn

From FGT:-

diag sniff packet any 'host x.x.x.x and icmp' 4  0 l >> where x.x.x.x is the dst srv ip

From PC:-

route print

tracert -d x.x.x.x