SSLVPN Split tunnel 6.4.0

[dhodgson]

I recently upgraded our test firewalls to 6.4.0 and now split tunneling doesn't work. The VPN connects fine but all portals push a default route instead of the routes I specify. 

Creating new portals with the GUI or CLI have the same issue. 

[jbrule]

I've been able to get split-tunnelling & split-DNS to work fine for users who connect with a Windows machine; however, it is not working for my MacOS users.  The MacOS users are able to access the internal resources that I permit by policy, but their internet access is broken.  Confirmed on MacOS Mojave and Catalina.  We're using Forticlient VPN 6.2.6.0951.  Firewall is 6.4.0.  I've attached a copy of my SSL-VPN Settings, Portal, and the FW policy.

I'm still doing various experiments.  Today, I think I am going to take the split-DNS out of the picture and see if that changes the MacOS behavior.

[Belgarioz]

Same behaviour here.

At the moment i am using a MacOS Catalina and a iOS device and there is no way to make split tunnel work. I haven't tested a windows machine since i have none available right now, i will update this topic asap.

Checked with a colleague: Indeed, it works only on windows

[tzals · Accepted solution]

Last week after upgrading Fortigate 60E from v6.2.2 to v6.4.0, I noticed having VPN-SSL split-tunnel issues 2 days after the upgrade.

I can remotely connect using SSL-VPN but the Internet doesn't work, only internal addresses (split tunnel is not working). Devices used:

MacOS Catalina version 10.15.5 running FortiClient 6.4.0.1231

iPhone iOS13.5 running FortiClient 6.0.5.0218.

However, using a Windows device with Forticlient 6.4 and trying with the same VPN user account, both internet and internal address work. It was working fine on all MacOS, iOS and Windows devices when I had Fortigate v6.2.2 installed.

From the Fortigate Log Details below I can see the Deny action. But I thought split tunnel prevents internet traffic access to the firewall in the first place.

Action: Deny:policy violation

Policy: 0

Policy Type: Firewall

[SOLVED] AFTER upgrading FortiGate firmware to v6.4.1 (released June 5th, 2020).

https://docs.fortinet.com/document/fortigate/6.4.1/fortios-release-notes/289806/resolved-issues

624477

FortiClient SSL VPN split tunnel is not working from macOS Catalina.