Split Tunnel with SSL VPN and Local Resource Access Prevention

[shocko]

We are using Forticlient EMS 7.2.3 and 7.2.3 and split-tunnel for certain traffic (MS Teams for example). To prevent accessing local services (NAS box for example) we enabled exclusive routing on our Fortigate 7.0.0 as per Enabling SSL VPN Full Tunnel - Fortinet Community. However, we can still access local resources/services. 

[pminarik · Accepted solution]

Given that "exclusive-routing" is available as an option only when full-tunnel is enabled ("set split-tunneling disable", I would question whether these two options are compatible at all.

AFAIK app-based split-tunnel is a local routing decision made by FCT (and configured by EMS), so there's a chance that this completely overrides any routing directives received from FGT.

edit: Yes, this is as designed. App-based split-routing disables exclusive-routing. Confirmed internally.

edit 2: The community article you referenced is now updated with a note about the incompatibility.

edit 3: There is a FortiClient/EMS-specific option to disable local LAN access - <enable_local_lan>, which should work with app-based split routing. XML docs reference: https://docs.fortinet.com/document/forticlient/7.2.4/xml-reference-guide/858086/ssl-vpn

[shocko]

Thanks for the feedback @pminarik .I have verified this is the case via testing. This seems like quite a big deal to me and something without an alternative workaround. I think most users of any modern VPN solution will want split-tunnel capabilty for things like MS Teams but it seems that unless we use the Domain/FQDN option for same (which is not scalable/maintainable for cloud sevrices in my opinion) we intoruced a huge security hole where local service access is available? Is there any option to block local service access with Web Filter or Application firewall within the EMS suite?

[pminarik]

Unfortunately the FGT-imposed setting and the EMS-imposed setting are incompatible in this case. You would need some option from EMS to force this. And now that I thought of that, what about enable_local_lan = 0? Have you tried it?

XML docs reference: https://docs.fortinet.com/document/forticlient/7.2.4/xml-reference-guide/858086/ssl-vpn

[shocko]

Thanks @pminarik . I'll go an test this and revert. 

[shocko]

On initial testing it seems this setting has no effect. Is there anywhere client side I could see if this had been configured? 

[pminarik]

See if you can export a backup of the configuration on the FortiClient. If yes, you should be able to open the resulting backup (XML) and check if the setting is set.

[shocko]

Ok so I can see that enable_local_lan=0 is in my FC exporte config but on fabric I can still connect to my local NAS box etc. So this setting seem to have no material impact.

It also bascially a deal breaker for us to use this product as we must restrict access to local services for DLP. 

[pminarik]

Please open a support ticket with the EMS serial number and get it looked at.

As far as I can tell from a bit of internal research, this combination (enable_local_lan=0 + app based split routing) should work. With that said, I am not an authoritative source, so I may be wrong.

[shocko]

It seems a work colleague of min has this open with support for 8 days. They have recommended the same setting so I will tie in with that support ticket.