Native Windows VPN and local Lan access

[speedy96]

Hi All

I have manged to setup a windows native VPN connection to my FortiGate and also gain internet access via the VPN which is all great. However I was hoping by unticking  "use default gateway on remote network" on the windows VPN interface it would then allow me to browse the internet and access local resources on the LAN I am connecting from. Unfortunately this does give me local internet and resource access back but I lose connection to the remote LAN behind the FortiGate VPN. Is it possible to have access to both via the windows VPN client?

I hope that makes sense and many thanks for your help

Kind Regards

Speedy

[kajlasunil · Accepted solution]

Hi @speedy96  https://community.fortinet.com/t5/FortiGate/Technical-Tip-Split-tunneling-on-L2TP-IPSEC-VPN-between/... Please have a look on this KB.

This indeed worked in my lab

[adambomb1219]

Why not use FortiClient?  That being said does your local LAN subnet conflict with a subnet that exists on or behind the FortiGate?

[speedy96]

A few of the customers do not like installing extra VPN software and prefer to use the built in client. I know.... but it is what it is..

No the two subnets are completely different. One is 192.168.200.0 the other is 192.168.1.0

Cheers

[hbac]

Hi @speedy96,

Have you tried to disconnect and reconnect to the VPN after unchecking "use default gateway on remote network"? It should work based on this article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-split-tunneling-in-Windows-1...

Please check your routing table by running 'route print' in the cmd. 

Regards, 

[speedy96]

Hello,

Yes I have indeed done that and it makes no difference. I have tried it quite a times. Its strange as it works flawless on the Drayteks firewalls which are not as good as these.

[kajlasunil · Accepted solution]

Hi @speedy96  https://community.fortinet.com/t5/FortiGate/Technical-Tip-Split-tunneling-on-L2TP-IPSEC-VPN-between/... Please have a look on this KB.

This indeed worked in my lab

[speedy96]

KS,

I notice the article also talks about this type of vpn "still being used" in a way that makes it seem as though there are better solutions. What do you feel is the best type of VPN that windows clients should be using in this day and age? I am happy to change if there is something that is considered faster/better. Its just the native windows vpn client is very convenient to set up.

Thanks

[speedy96]

Thamks KS, I will have a look at this. Can I just ask this first Line below "

Description

This article describes how to setup split-tunnelling on L2TP/IPSEC VPN between FortiGate and Windows 10. 

FortiOS does not support Split-tunnelling unless we use FortiClient." is that saying that this is the way around FortiOS not supporting it?

[kajlasunil · Accepted solution]

In the VPN itself, there is no split tunnel option for L2TP. However, it is achievable by making certain changes to the DHCP parameters (indirect way to configure split tunnel)

[speedy96]

KS, thanks for this I will try this out tonight.

Cheers