SSL VPN full tunnel prevent on-link connection but still allow hosted VMs access

[fortibutt]

I ran into a conundrum this morning.  I want to prevent remote users from accessing their home resources while connected to SSL VPN, but I also want them to be able to run VMs on their workstation that can access resources through the tunnel.  Enabling exclusive-routing on the portal solves the first part but prevents the second.  Are there any ways around this in a full tunnel required environment?

[pmeet]

Once you enable the exclusive routing the on-link won't be able to get any traffic so I can't think of any way how your VM's can even communicate , I don't think its even possible may be it could be by creating a static route entry on your computer after it connects to the VPN

[fortibutt]

Yea the VM is basically on an island at that point.  So it sounds like exclusive routing isn't the ideal solution.  Is there another way to prevent remote users from accessing their printers but still allow their VMs to communicate?

[Rajan_kohli]

Hi @fortibutt,

you can use this article to Disable local network access: https://community.fortinet.com/t5/FortiClient/Technical-Tip-Disable-local-network-access-when-split-...

Please let us know if it doesn't work

Regards

Rajan

[fortibutt]

Hi Rajan,

Yes that's the article I implemented, but when you enable that, any VM that the remote endpoint has running on their machine can't communicate externally (the island comment I mentioned above).