SSL VPN Split Tunnel - Route specific IP/FQDN out locally

[froggle]

Hello,

I can't seem to find any questions quite like mine, and I apologize if I have missed them.

Fortigate 300D - 6.0.4

We are setting up a SSL VPN with Split Tunneling. I can route our internal networks and some public IP Addresses through the tunnel. That much is easy.

What I am trying to find out is if I can switch this around? So I would specify 0.0.0.0/0 to go through the tunnel, but then specify IPs, or FQDNs out through the endpoints local ISP. Specifically Microsoft Office 365 traffic.

The reason I am thinking this way is because we currently have no control of internet access at the endpoint, like WebFilter/AppControl using FortiClient. Something I hope to get soon, but having to wait. I don't like the idea of internet access outside of the corp net that I cannot control. And this is why we don't use Split-Tunneling.

Feel free to change my mind here, I might be barking up the wrong tree. If I had EMS I wouldn't be doing this.

Many thanks!

[Abraham · Accepted solution]

Same Idea and same Problem. I tried the same approach but the split tunnel configuration allow to configure only IP address network or ranges no FQDN or Internet services. So the only solution possible is to configure network ranges of all IPv4 ip addresses and exclude those you want to split. ex.

You what to split: 10.255.255.0/24 (255 IP adresses) Two network ranges

1-Configure a network range 0.0.0.0-10.255.254.255

2-Configure a network range 11.0.0.0-255.255.255.255

3- Add IP ranges to under split-tunnel routing address   

[TecnetRuss · Accepted solution]

Sorry but it should be said that FortiOS 6.0.4 has three pretty serious SSL-VPN vulnerabilities and I would strongly recommend against deploying SSL-VPN before upgrading to at least 6.0.5 but preferably the latest 6.0.x release (currently 6.0.9).

https://www.fortinet.com/blog/business-and-technology/fortios-ssl-vulnerability.html

https://fortiguard.com/psirt/FG-IR-18-384

https://fortiguard.com/psirt/FG-IR-18-388

https://fortiguard.com/psirt/FG-IR-18-389

Russ

NSE7

[Abraham · Accepted solution]

Same Idea and same Problem. I tried the same approach but the split tunnel configuration allow to configure only IP address network or ranges no FQDN or Internet services. So the only solution possible is to configure network ranges of all IPv4 ip addresses and exclude those you want to split. ex.

You what to split: 10.255.255.0/24 (255 IP adresses) Two network ranges

1-Configure a network range 0.0.0.0-10.255.254.255

2-Configure a network range 11.0.0.0-255.255.255.255

3- Add IP ranges to under split-tunnel routing address   

[TecnetRuss · Accepted solution]

Sorry but it should be said that FortiOS 6.0.4 has three pretty serious SSL-VPN vulnerabilities and I would strongly recommend against deploying SSL-VPN before upgrading to at least 6.0.5 but preferably the latest 6.0.x release (currently 6.0.9).

https://www.fortinet.com/blog/business-and-technology/fortios-ssl-vulnerability.html

https://fortiguard.com/psirt/FG-IR-18-384

https://fortiguard.com/psirt/FG-IR-18-388

https://fortiguard.com/psirt/FG-IR-18-389

Russ

NSE7

[CHXGVA]

Hi Froggle ,

Same problem here, in order to configure Office 365 correctly Microsoft recommend Split Tunneling and they provide the required addresses.  We would like to keep the majority of Web traffic running through the Forti but to force 0365 traffic to be routed directly on the client. 0365 is becoming very very widely deployed and I imagine that we are not alone in the request.

[CHXGVA]

Finally, I did the following 1 : Download the list of Microsoft 365 IPs ( MS provides a Powershell script to do this) 2 : Strip of the data I dont want and compile a single numerically ordered list of the IPS. exemple : 

13.107.6.171 13.107.140.6 52.108.0.0 52.238.106.116 52.244.37.168 52.244.203.72 52.244.207.172 52.244.223.198 etc etc 

3 : Create a range of IP address starting from 1.1.1.1 to 255.255.255.255 "excluding" the IPs from Microsoft.      This results in  a list of 74 ranges. 4 : Using this list I created a script to add the ranges to the Firewall address list using the CLI.

config firewall address edit M365-0 set type iprange set start-ip 1.1.1.1 set end-ip 13.70.151.215 end config firewall address edit M365-1 set type iprange set start-ip 13.70.151.217 set end-ip 13.71.127.196 end config firewall address edit M365-2 set type iprange set start-ip 13.71.127.198 set end-ip 13.72.245.114 end config firewall address edit M365-3 set type iprange set start-ip 13.72.245.116 set end-ip 13.73.1.119 end etc etc etc   There are 72 in total

5 : I then create a group of addresses ( M365) that encompasses al lof the ranges in step 3. 6 : In the VPN Tunnel I added the Group (M365) to the address that get passed to the VPN. BUT and there is always a but, the FortiClient MUST be at least 6.2. With the 6.0.9, the client only receives the 1st 17 ranges of address , there appears to be a limit on the size of the Static Routing Config sent sent to the client.

[nsandone]

This is something a lot of people have been asking for.   It looks like 6.4.0 finally has this feature although I haven't tested it myself yet.   You need FortiOS 6.4.0 and FortiClient 6.4.0 for it to work from what I'm reading.    There is a CLI option:

set split-tunneling-routing-negate

[Kevin_Shanus · Accepted solution]

The below article would do the opposite by forcing specific FQDN to use the tunnel and not local internet? Thanks

https://kb.fortinet.com/kb/documentLink.do?externalID=FD46248

[Juquinha]

Kevin Shanus wrote:

The below article would do the opposite by forcing specific FQDN to use the tunnel and not local internet? Thanks

https://kb.fortinet.com/kb/documentLink.do?externalID=FD46248

This works like a charm for hostnames that resolves only to one IP address. Does anyone had problems qith hostnames that have more than one IP? Example, the URl xpto.com resolve to 200.200.200.200 and 200.200.1.1. The Forticlient will only route one of them to inside the SSLVPN tunnel.

[NicolasC]

Hi,

I have same probleme when fqdn resolves more than 1 IP, it doesn't work.

I have a website hosted out of my organization with ip restriction (ip public of the office). The website is behind a WAF (Cloudflare) and the FQDN resolve 4 IP. I try a lot of thing but it doesn't work.. :(

Somebody have a tips please ?

Thanks.

Nico