Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
shocko
Contributor

Split Tunnel with SSL VPN and Local Resource Access Prevention

We are using Forticlient EMS 7.2.3 and 7.2.3 and split-tunnel for certain traffic (MS Teams for example). To prevent accessing local services (NAS box for example) we enabled exclusive routing on our Fortigate 7.0.0 as per Enabling SSL VPN Full Tunnel - Fortinet Community. However, we can still access local resources/services. 

1 Solution
pminarik
Staff
Staff

 

Given that "exclusive-routing" is available as an option only when full-tunnel is enabled ("set split-tunneling disable", I would question whether these two options are compatible at all.

 

AFAIK app-based split-tunnel is a local routing decision made by FCT (and configured by EMS), so there's a chance that this completely overrides any routing directives received from FGT.

 

edit: Yes, this is as designed. App-based split-routing disables exclusive-routing. Confirmed internally.

 

edit 2: The community article you referenced is now updated with a note about the incompatibility.

 

edit 3: There is a FortiClient/EMS-specific option to disable local LAN access - <enable_local_lan>, which should work with app-based split routingXML docs reference: https://docs.fortinet.com/document/forticlient/7.2.4/xml-reference-guide/858086/ssl-vpn

[ corrections always welcome ]

View solution in original post

11 REPLIES 11
pminarik
Staff
Staff

 

Given that "exclusive-routing" is available as an option only when full-tunnel is enabled ("set split-tunneling disable", I would question whether these two options are compatible at all.

 

AFAIK app-based split-tunnel is a local routing decision made by FCT (and configured by EMS), so there's a chance that this completely overrides any routing directives received from FGT.

 

edit: Yes, this is as designed. App-based split-routing disables exclusive-routing. Confirmed internally.

 

edit 2: The community article you referenced is now updated with a note about the incompatibility.

 

edit 3: There is a FortiClient/EMS-specific option to disable local LAN access - <enable_local_lan>, which should work with app-based split routingXML docs reference: https://docs.fortinet.com/document/forticlient/7.2.4/xml-reference-guide/858086/ssl-vpn

[ corrections always welcome ]
shocko
Contributor

Thanks for the feedback @pminarik .I have verified this is the case via testing. This seems like quite a big deal to me and something without an alternative workaround. I think most users of any modern VPN solution will want split-tunnel capabilty for things like MS Teams but it seems that unless we use the Domain/FQDN option for same (which is not scalable/maintainable for cloud sevrices in my opinion) we intoruced a huge security hole where local service access is available? Is there any option to block local service access with Web Filter or Application firewall within the EMS suite?

pminarik

Unfortunately the FGT-imposed setting and the EMS-imposed setting are incompatible in this case. You would need some option from EMS to force this. And now that I thought of that, what about enable_local_lan = 0? Have you tried it?

 

XML docs reference: https://docs.fortinet.com/document/forticlient/7.2.4/xml-reference-guide/858086/ssl-vpn

[ corrections always welcome ]
shocko

Thanks @pminarik . I'll go an test this and revert. 

shocko

On initial testing it seems this setting has no effect. Is there anywhere client side I could see if this had been configured? 

pminarik

See if you can export a backup of the configuration on the FortiClient. If yes, you should be able to open the resulting backup (XML) and check if the setting is set.

[ corrections always welcome ]
shocko

Ok so I can see that enable_local_lan=0 is in my FC exporte config but on fabric I can still connect to my local NAS box etc. So this setting seem to have no material impact.

 

It also bascially a deal breaker for us to use this product as we must restrict access to local services for DLP. 

pminarik

Please open a support ticket with the EMS serial number and get it looked at.

 

As far as I can tell from a bit of internal research, this combination (enable_local_lan=0 + app based split routing) should work. With that said, I am not an authoritative source, so I may be wrong.

[ corrections always welcome ]
shocko

It seems a work colleague of min has this open with support for 8 days. They have recommended the same setting so I will tie in with that support ticket. 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors