Split tunnel not working for IPSec dial up vpn's

[network123]

We use multiple dial up IPSec vpn's on our vm Fortigate (7.2.9) for remote support. 

But for windows 11 devices (forticlient 7.4.2) the split tunnel routes are not installed, only default route over the VPN. Because of this user do not receive 2fa token on the windows device as internet is not permitted. work around is to use a secondary device to receive 2fa token (mail). VPN is working for the rest, just not split tunnel.

config vpn:

config vpn ipsec phase1-interface
edit "xxx"
set type dynamic
set interface "port5"
set local-gw xxx
set mode aggressive
set peertype one
set net-device disable
set mode-cfg enable
set ipv4-dns-server1 xx
set ipv4-dns-server2 xx
set proposal aes256-sha256 aes128-sha1
set xauthtype auto
set authusrgrp "xxx"
set nattraversal forced
set peerid "xxx"
set ipv4-start-ip 172.29.2.0
set ipv4-end-ip 172.29.2.7
set ipv4-split-include "Remote-Access-VPN-Split"
set save-password enable
set psksecret xxx
next
end
config vpn ipsec phase2-interface
edit "xxx"
set phase1name "xx"
set proposal aes128-sha1 aes256-sha256
next
end

config firewall addrgrp

edit "Remote-Access-VPN-Split"
set member "10.0.0.0/8"
next

end

config firewall address

edit "10.0.0.0/8"
set subnet 10.0.0.0 255.0.0.0
next

I created a firewall policy for the zone of this vpn with split tunnel objects as dst (recommended by support). They don't want to assist anymore as we don't have EMS licenses for this. Can someone assist with this?

Thanks in advance!

[MattBate]

I'm setting up a new ipsec ikev2 RA tunnel as well (no other tunnels) and am seeing the same thing. Using a subnet for the split tunnel object. Firewall is 7.2.11 and using latest 7.4.2.1737 client. I can see in the ike debug that it's pushing the correct subnet for split tunneling (mode-cfg send (13) 0:10.0.0.0/255.255.255.0:0), but none of the pc's i've tried on will show that they should be split tunneling - keep trying to tunnel all traffic via the vpn.

[Ryctas]

Just want to put my 2 cents in, as I'm facing the same issue. 

This is initially a new setup. Unfortunately, it was not working either. I got the proper IP address, and forward traffic logs shows DNS traffic is going nicely, but outside of that I was not getting good reply back from pings. Forward traffic did not register any of my ping attempts.

I went with Packet sniffer on the IPSec interface and see that it's registering it from my 192.168.x.x local IP at home. 

Now, I did have a working setup. Months back I had setup an IPSec VPN Client tunnel on a separate Fortigate, it was splitting tunnel smoothlessly. I do not have the FCT version number I used; however, I chose to reconnect to it for testing purposes. It did not work. Same Problem. I did not touch that old VPN connection; the only thing that's changed is the FCT version (and recently Windows 11 version). 

This post is my only hint that it's not my configuration on Fortigate's side. Pending more research, I hope to help you out if I find something :)

Edit: The plot thickens. Using 7.4.0 worked fine on my Work laptop. Everything mentioned in the original comment was on my Personal Laptop. I uninstalled FCT 7.4.0 and reinstalled the new version 7.4.2.1737 same as my Personal laptop to do some more diagnostics/fixes. It worked fine....The Route table updated properly instead of defaulting to Full Tunnel. It just works now. Unsure where the issue lies now.

[msauve]

Happy to see I'm not the only one, and it wasn't me doing an incorrect config.

This seems to be an issue with Forticlient.

Running Fortigate 7.4.7.2731 and Forticlient VPN (the free one) 7.4.2.1737, I was having the same issue. The split route and also a default route via the VPN would get installed on the client, making all traffic route via the VPN. 

I uninstalled the client and installed an older one (7.2.3.0929). Split tunneling is now working correctly - no incorrect default route on the client. Unfortunately, "no support" for the free client (boo!), but hopefully they fix it. Anyone successfully using the licensed 7.4.2 FortiClient with split tunnelling? I'd imagine it has the same issue.

[funkylicious]

I had a similar issue in the weekend while testing ipsec with ikev2 and saml, whereas the split tunnel wasnt working, I was getting the full tunnel config.

Had to manually change the Automatic metric for the SSLVPN adapter and it started working for some reason.

L.E. i also installed FCT 7.2.8, i was running either 7.2.4 or 7.2.5 

[funkylicious]

ok, new test environment with IPsec IKEv1 where split tunnel doesn't work while using FCT 7.2.8 .

only the default route is installed although I have the split-tunnel ( ipv4-split-include ) with a object that is also a network mentioned and not a range.

same applied to the firewall rule, not using all anywhere and still doesnt push the correct one.

L.E. installed FCT 7.4.2 and did a IKEv2 DialUp, no change still getting default route.

[bates]

yeah based off that I uninstalled the 7.4 and installed 7.2.8. it did split tunnel correctly, however apparently 7.2.8 will skip the MS saml if the pc already is authenticated to MS - just one problem after another.

[network123]

Hello, thanks for the feedback.  Do you have an url to download the free version 7.2.8?

[Gerd]

I can also confirm split tunneling doesn't work for dial-up vpn  ZTNA Forticlient 7.2.9 to a firewall running FortiOS 7.4.7. I only get a default route. 

Good to know IKE works "great" while Fortinet is planning on removing SSLVPN :). Downgrading to 7.2.8 fixed the issue for me. 

[alex3sr]

Hey all,

yes, 2 weeks that I'm fighting split tunneling with IPSEC on FGT 7.6.3 with FCT 7.4.3, and always having 0.0.0.0 route and VPN traffic not working well in more. Raisins a support ticket and lost time with them by requesting reinstalling client, using different computer, some screenshot, ... nothing with a real strategy and knowledge for help me and finally found this thread.

And yes, juste downgraded Forticlient to 7.2.8 without changing anything in FGT, works perfectly in a row !

Are there someone was able to work with Dialup VPN IPSec on FGT 7.6.3 with FCT client > 7.2.8 ? Goal is to use a recent version as more as possible.

Thank you

Regards

Alexandre

[funkylicious]

as fas as I know, 7.4.3 real advantage is support for ARM.

is there a reason that 7.2.8/7.2.9 or 7.4.1/7.4.2 would not do it ? there arent any major issues or vulnerabilities for them, if im not mistaken.