Metric for VPN routes

[Demetrios]

Hello!

Faced with the problem, when VPN clients receive their routes from VPN IPSEC or SSL VPN with metric '1'. Reseived routes take precedence on local routes and broke client routing. 

Maybe someone have any idea how to increase routing metric?

FG1500D v5.4.8,build1183 (GA)

[FortiKoala]

Have you enabled split tunnelling? 

http://kb.fortinet.com/kb/microsites/microsite.do?cmd=displayKC&docType=kc&externalId=FD36253

Can you post the "router print" from the client? and highlight the routes with the low metric causing the problem

[Demetrios]

Yes, split tunnelling is enable.

Активные маршруты: Сетевой адрес Маска сети Адрес шлюза Интерфейс Метрика 0.0.0.0 0.0.0.0 192.168.112.1 192.168.112.18 20 10.9.6.0 255.255.255.0 172.18.8.10 172.18.8.9 1 10.10.0.0 255.255.0.0 172.18.8.10 172.18.8.9 1 10.89.0.0 255.255.0.0 172.18.8.10 172.18.8.9 1 10.89.66.11 255.255.255.255 192.168.112.1 192.168.112.18 21 10.89.66.12 255.255.255.255 192.168.112.1 192.168.112.18 21 10.89.66.13 255.255.255.255 192.168.112.1 192.168.112.18 21 10.89.66.21 255.255.255.255 192.168.112.1 192.168.112.18 20 10.126.0.0 255.254.0.0 172.18.8.10 172.18.8.9 1 10.126.169.74 255.255.255.255 192.168.112.1 192.168.112.18 21 10.126.240.161 255.255.255.255 192.168.112.1 192.168.112.18 21 10.127.17.30 255.255.255.255 192.168.112.1 192.168.112.18 21 10.127.21.1 255.255.255.255 192.168.112.1 192.168.112.18 21 10.127.120.3 255.255.255.255 192.168.112.1 192.168.112.18 21 37.230.149.12 255.255.255.255 192.168.112.1 192.168.112.18 20 169.254.0.0 255.255.0.0 On-link 169.254.71.130 266 169.254.1.1 255.255.255.255 172.18.8.10 172.18.8.9 1 169.254.71.130 255.255.255.255 On-link 169.254.71.130 266 169.254.255.255 255.255.255.255 On-link 169.254.71.130 266 172.16.0.0 255.254.0.0 172.18.8.10 172.18.8.9 1 172.18.8.9 255.255.255.255 On-link 172.18.8.9 257 192.168.112.0 255.255.255.0 On-link 192.168.112.18 276

[FortiKoala]

The following routes are taking precedence because of the lower subnet mask

10.9.6.0/16 255.255.255.0

Local 10.9.6.x routes 10.10.0.0/16 255.255.0.0

Local10.10.6.x routes 10.89.0.0/24 255.255.0.0

Local10.89.0.x routes

This means that the FortiClient interface is prioritised over your local routing and interface. 

[size="2"]On your FGT VPN conf you will need to remove the advertising of the routes if they are local to the FortiClient network, limit to the networks to the actual networks behind the FGT rather than class B subnets[/size]

[size="2"][size="2"]10.89.0.0/24 255.255.0, [size="2"]10.9.6.0/16 255.255.255, 10.126.0.0 255.254.0.0  [/size] [/size][/size]