Split Tunneling with SSL-VPN to Access AWS Services (Dynamic IP Issue)

[hwyoon]

English is not my first language, and I wrote this post with the help of ChatGPT. If any part of this message sounds strange or unclear, please feel free to point it out

Our goal:

• Users connect to Fortinet SSL-VPN.

• We want to enable split tunneling, so that only traffic destined for AWS goes through the VPN.

• All other traffic should go through the user's local internet connection.

Challenge:
Since AWS services use dynamic IP addresses, it’s difficult to keep the split tunnel routing accurate and up to date. Even when we try to add known AWS IP ranges manually, they change often, which breaks connectivity.

We also tried DNS-based split tunneling — defining domains (like *.amazonaws.com) instead of IPs — but this approach hasn’t worked reliably either, possibly due to how Fortinet handles DNS resolution and route injection.

Has anyone dealt with similar issues? What's the best way to implement split tunneling to AWS services when IPs are constantly changing? Is there a reliable method using FQDNs or other mechanisms?

Any insights or proven approaches would be really appreciated.

[syordanov · Accepted solution]

Dear hwyoon,

For this scenario  SSL VPN (tunnel mode, because web mode does not support ISDB) use an ISDB.

More information for ISDB you can find on the link bellow :

https://docs.fortinet.com/document/fortigate-cnf/latest/administration-guide/613009/internet-service...

FortiGate SSL VPN tunnel mode with split tunnel :

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-SSL-VPN-split-tunnel-mode...

Please let us know if you have more questions.

Best regards,

Fortinet