Remote WLANs and split-tunneling subnets

[_sergey_]

Hi all,

I've already checked tons of manuals, forums, kbs and cookbooks, made hundreds of experiments on live hardware, but can't find the way to do very simple thing - negating defined split-tunneling subnets for remote WLANs. I mean subnets, which are defined in config wireless-controller wtp-profile / edit <profile> / conf split-tunneling-acl. It is nice feature but working opposite way it should - defined subnets are NOT routed to wireless controller.

In most cases, traveler with FAP expecting direct access to corp network without other external resources slowdowns, which is 100% occurs, if we route all SSID traffic to WLC. Just imagine, how slow it could be, if remote WLAN deployed in hotel in Hong Kong, but WLC is on duty at Portugal.

So I think it is quite normal to define just one (or few) subnets (internal corporate network) to route via WLC, and rest of traffic should go through local FAP GW. For now, to implement this, and make just one subnet (192.168.0.0/16) to be routed to WLC, I should define 15 subnets in wtp-profile, and it is almost maximum supported number (you can't define more than 16 subnets there). So it is not possible to add even one more routable subnet (lets say, 10.11.232.0/24).

Hope I'm missing something, that's why I decided to post it here - maybe someone already knows how to ...

Thanks!

[wanglei_FTNT · Accepted solution]

From release 5.4.6 and 5.6.3, an enhancement in this area has been added.  You can set a default action to either Local or tunnel and use ACL to configure exception. 

FW80CM3913601573 (S321C) # set split-tunneling-acl-path ? tunnel Split tunneling ACL list traffic will be tunnel. local Split tunneling ACL list traffic will be local NATed

[Toshi_Esumi]

As you've already figured through documentation you went through, FortiAP's sprit-tunnel seemed to have been designed to split local sutnet access from the rest going over the CAPWAP tunnel. I'm afraid it wouldn't work for you.

[_sergey_]

toshiesumi wrote:
As you've already figured through documentation you went through, FortiAP's sprit-tunnel seemed to have been designed to split local sutnet access from the rest going over the CAPWAP tunnel. I'm afraid it wouldn't work for you.

CAPWAP is not a tunnel, its just provisioning protocol, but thanks for answer.

[wanglei_FTNT · Accepted solution]

From release 5.4.6 and 5.6.3, an enhancement in this area has been added.  You can set a default action to either Local or tunnel and use ACL to configure exception. 

FW80CM3913601573 (S321C) # set split-tunneling-acl-path ? tunnel Split tunneling ACL list traffic will be tunnel. local Split tunneling ACL list traffic will be local NATed

[_sergey_]

wanglei@fortinet.com wrote:

From release 5.4.6 and 5.6.2, an enhancement in this area has been added.  You can set a default action to either Local or tunnel and use ACL to configure exception. 

FW80CM3913601573 (S321C) # set split-tunneling-acl-path ?

tunnel Split tunneling ACL list traffic will be tunnel. local Split tunneling ACL list traffic will be local NATed

Hi Wanglei, thank you for help, but unfortunately I don't have such command in 5.6.2, at least on fgt240d.

pmk240d (fap21d-split) # set ?
comment Comment.
dtls-policy WTP data channel DTLS policy.
max-clients Maximum number of STAs supported by the WTP.
handoff-rssi Minimum RSSI value for handoff.
handoff-sta-thresh Threshold value for AP handoff.
handoff-roaming Enable/disable handoff when a client is roaming.
ap-country AP country code.
ip-fragment-preventing Prevent IP fragmentation for CAPWAP tunneled control and data packets.
tun-mtu-uplink Uplink tunnel MTU.
tun-mtu-downlink Downlink tunnel MTU.
split-tunneling-acl-local-ap-subnet Enable/disable split tunneling ACL local AP subnet.
allowaccess Allow management access to managed AP.
login-passwd-change Configuration options for login password of managed AP.
lldp Enable/disable LLDP.

pmk240d (fap21d-split) # set split-tunneling-acl-path
command parse error before 'split-tunneling-acl-path'

I have also 100d with same result on 5.6.2, but have no plans to downgrade to 5.4 branch. Should I additionally set something somewhere to enable this piece of magic?

Thanks!

[wanglei_FTNT · Accepted solution]

Hi crasher, 

For 5.6, it will be in 5.6.3 I have corrected original post. 

[_sergey_]

wanglei@fortinet.com wrote:

Hi crasher, 

For 5.6, it will be in 5.6.3 I have corrected original post. 

Wow, thanks a lot, it is just great! Hope you release 5.6.3 soon, keeping eye on it.

By the way, I've created Telegram channel with automated firmware releases feed to simplify monitoring on fresh ftnt firmwares. Initially I've done it for myself, but if anyone interested, just join https://t.me/fortifw.

Cheers.

[_sergey_]

Wanglei, hello again, I'm back. :)

wanglei@fortinet.com wrote:

Hi crasher, 

For 5.6, it will be in 5.6.3 I have corrected original post. 

Upgraded to 5.6.3 and tried to use split-tunneling-acl-path with no luck. In my case this command just do nothing. I've made different tests on 100d/240d with fap21d, but unfortunately can't get it work as expected. I've even rebooted AP after modifying wtp-profile, but it does not help (and seems not needed, because changes in profile propagated to AP immediately after clicking OK/pressing Enter after next in cli).

I've made very simple tests just trying to tunnel 192.168.1.0/24 and right after I add it to split-tunnel-acl, it becomes unreachable - it is normal. But no changes after setting split-tunneling-acl-path to tunnel OR local - everything works same way as before, even after reboots/reconnects. So still impossible to invert (negate) ACLs for split tunneling.

Maybe I missing something because there is no any docs available for this feature at this moment?

Thanks in advance for your kind help!

[_sergey_]

This one from another message thread you answered me

wanglei@fortinet.com wrote:

Please post your complete config and we will check it out and get back to you. 

Thanks,

Lei

I think it is better to keep everything here.

So, I'm not sure you want complete FG config, or just wireless part? So here it is:

config wireless-controller wtp-profile
 edit "fap21d-new"
 config platform
 set type 21D
 end
 config lan
 set port-mode bridge-to-ssid
 set port-ssid "MyFAP21"
 end
 set ap-country US
 set split-tunneling-acl-path tunnel
 set split-tunneling-acl-local-ap-subnet enable
 config split-tunneling-acl
 edit 1
 set dest-ip 192.168.1.0 255.255.255.0
 next
 end
 set lldp enable
 config radio-1
 set band 802.11n-only
 set short-guard-interval enable
 set auto-power-level enable
 set auto-power-high 20
 set auto-power-low 2
 set wids-profile "default"
 set vap-all disable
 set vaps "MyFAP21"
 set channel "1" "6" "11"
 end
 next
end

config wireless-controller wtp
 edit "FAP21D3U16002729"
 set admin enable
 set name "fap21d-fortik"
 set wtp-profile "fap21d-new"
 config radio-1
 end
 next
end

config wireless-controller vap
 edit "MyFAP21"
 set vdom "root"
 set ssid "fortik"
 set schedule "always"
 set split-tunneling enable
 set multicast-enhance enable
 unset broadcast-suppression
 set passphrase ENC =*=
 next
end

config wireless-controller wids-profile
 edit "default"
 set comment "Default WIDS profile."
 set ap-scan enable
 set ap-bgscan-period 300
 set ap-scan-passive enable
 set wireless-bridge enable
 set deauth-broadcast enable
 set null-ssid-probe-resp enable
 set long-duration-attack enable
 set invalid-mac-oui enable
 set weak-wep-iv enable
 set auth-frame-flood enable
 set assoc-frame-flood enable
 set spoofed-deauth enable
 set asleap-attack enable
 set eapol-start-flood enable
 set eapol-logoff-flood enable
 set eapol-succ-flood enable
 set eapol-fail-flood enable
 set eapol-pre-succ-flood enable
 set eapol-pre-fail-flood enable
 next
end

config system interface
edit "MyFAP21"
set vdom "root"
set ip 192.168.22.254 255.255.255.0
set allowaccess ping
set type vap-switch
set scan-botnet-connections block
set device-identification enable
set role lan
set snmp-index 14
config ipv6
set ip6-address 2xxx:xx0:xx41:xx8x::1/64
set ip6-allowaccess ping
set ip6-send-adv enable
set ip6-other-flag enable
config ip6-prefix-list
edit 2xxx:xx0:xx41:xx8x::/64
set autonomous-flag enable
set onlink-flag enable
next
end
end
next
end

[wanglei_FTNT]

Tested with below config and it's working fine. 

-------------------------- config wtp-profile ------------

FG100D3G15802056 # show wireless-controller wtp-profile FAP14C-default

config wireless-controller wtp-profile

    edit "FAP14C-default"

        config platform

            set type 14C

        end

        config lan

            set port-mode bridge-to-ssid

            set port-ssid "splittun"

        end

        set ap-country US

        set split-tunneling-acl-path tunnel

        set split-tunneling-acl-local-ap-subnet enable

        config split-tunneling-acl

            edit 1

                set dest-ip 90.90.90.0 255.255.255.0

            next

            edit 3

                set dest-ip 8.8.8.8 255.255.255.255

            next

        end

        set allowaccess telnet http https ssh

        config radio-1

            set band 802.11n

            set darrp enable

            set frequency-handoff enable

            set vap-all disable

            set vaps "splittun"

            set channel "1" "6" "11"

        end

    next

end

---------------- config vap --------------

config wireless-controller vap

    edit "splittun"

        set vdom "root"

        set ssid "spltun-rt"

        set schedule "always"

        set split-tunneling enable

        unset broadcast-suppression

        set passphrase ENC U2NJE/4uVNzCEBCtXn8MK6kiSLYqY9z8RUHKg97F9+6hJvsy31Srowzk2/OH2Yv2jbWN00uIdW2miyxw7UVBSqKIJU9g98Vv+dP7QqqJ8WyRkSikML35iThKOuxa2biqCSbHdX/IcAhA1BBGHEuV/fVMbuOpxmEK4HVHpQnBDsRu5PC2ppvZ57vbDtCZl8qrKWIOeQ==

    next

end

Maybe you can let me know the AP version and output of  ifconfig br0, ifconfig br.ts.0 and vcfg from FAP. You can telnet into the AP