SSL VPN routing to multiple networks

[#1]

Hi Guys, This is a 2 part question; Part1. I am using FortiOS MR2 revision 3 and have configured an SSL VPN. The tunnel works correctly and I can ping hosts internally (for example from SSL client 10.1.1.1/32 to internal network 10.9.9.0/24) I also have split tunneling available so the remote client can browse the internet resources locally instead of over the tunnel and therefore impacting on the total bandwidth available on the primary internet connection. My fortigate is configured in Interface mode and I have another network configured on the Internal2 interface which is 10.8.8.0/24. How can I push the route to the remote client for the 10.8.8.0 network? I notice if I manually configure the route on the remote PC (e.g " route add 10.8.8.0 mask 255.255.255.0 10.9.9.254 metric 10" ) I am able to ping hosts on the internal network. How can I configure my tunnel so that this is not required? Part2. I have installed the CA certificate of the internal DC on the remote hosts which are not joined to the domain, I have imported a self signed certificate into the fortigate and I am using that certificate for SSL VPN connections. When I visit the web page for SSL VPN login I do not get a certificate warning however when I connect using the new tunnel mode VPN client I get a warning about Revocation information not available. Does anyone have any ideas about why this is? Cheers. SR.

[jmac]

You may find a better response if you create a separate post for each question. Regarding part 1, you probably already have a firewall policy with WAN interface as source, destination of Internal1 interface and 10.9.9.0/24, and type of SSL-VPN. You need to add another policy from WAN source to interface Internal2 and 10.8.8.0/24 with a type of SSL-VPN. Then the other route should be added when connecting with the tunnel client. Regarding part 2, if the question is about the warning for the self-signed cert when using the VPN client, there is an option in the client connection settings (when starting the VPN client manually) to not warn about server certificate validation errors.

[#3]

Thanks a lot Jmac that fixed my routing problem.. The second part is fine too, I already had my customer selecting to ignore certificates but I wanted to try and get the certificate working as this customer knows just enough about IT to be dangerous and isnt happy with simply ticking the box to ignore the error. Can a certificate guru humor me and help out with this one? :) Thanks in advance.