Split tunnel not working for IPSec dial up vpn's

[network123]

We use multiple dial up IPSec vpn's on our vm Fortigate (7.2.9) for remote support. 

But for windows 11 devices (forticlient 7.4.2) the split tunnel routes are not installed, only default route over the VPN. Because of this user do not receive 2fa token on the windows device as internet is not permitted. work around is to use a secondary device to receive 2fa token (mail). VPN is working for the rest, just not split tunnel.

config vpn:

config vpn ipsec phase1-interface
edit "xxx"
set type dynamic
set interface "port5"
set local-gw xxx
set mode aggressive
set peertype one
set net-device disable
set mode-cfg enable
set ipv4-dns-server1 xx
set ipv4-dns-server2 xx
set proposal aes256-sha256 aes128-sha1
set xauthtype auto
set authusrgrp "xxx"
set nattraversal forced
set peerid "xxx"
set ipv4-start-ip 172.29.2.0
set ipv4-end-ip 172.29.2.7
set ipv4-split-include "Remote-Access-VPN-Split"
set save-password enable
set psksecret xxx
next
end
config vpn ipsec phase2-interface
edit "xxx"
set phase1name "xx"
set proposal aes128-sha1 aes256-sha256
next
end

config firewall addrgrp

edit "Remote-Access-VPN-Split"
set member "10.0.0.0/8"
next

end

config firewall address

edit "10.0.0.0/8"
set subnet 10.0.0.0 255.0.0.0
next

I created a firewall policy for the zone of this vpn with split tunnel objects as dst (recommended by support). They don't want to assist anymore as we don't have EMS licenses for this. Can someone assist with this?

Thanks in advance!

[funkylicious]

hi,

have you tried following this guide, https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enable-split-tunnel-For-IPsec-VPN/ta-p/192... ?

also, in FCT try doing a backup of the config and edit it and change these params after the export

https://docs.fortinet.com/document/forticlient/7.4.2/xml-reference-guide/739387/ipsec-vpn 

<enable_local_lan>1</enable_local_lan>

also, <implied_SPDO>1</implied_SPDO>

then import back the config in the client

[network123]

Hello,

Yes I followed this step by step.

I tried with local lan but no solution (or only the local LAN but this is not enough for us)

[dingjerry_FTNT]

Hi @network123 ,

First of all, can you capture the local routing table once connected to the IPSec VPN? 

This is to confirm whether the routing table is in issue or not.

[network123]

Hello, yes this confirm what I explained. So 0.0.0.0/0 over the vpn. When I debugged the fortigate he told me that split tunnel was active but I think windows or the app doesn't accept it. 

[dingjerry_FTNT]

Hi @network123 ,

Can you confirm that there is only one dial-up IPSec VPN tunnel "xxx"?

[network123]

Hello, we have multiple dial up vpn's. all same split tunnel objects but of course all have a different name. 

[dingjerry_FTNT]

Hi @network123 ,

1) Please make sure that your FCT is connected to which IPSec VPN tunnel;

2) Double check all address objects used for split tunneling settings to confirm nothing wrong with them.

I suspect that maybe one of them is configured with 0.0.0.0/0.0.0.0 accidentally and you were connected to the IPSec VPN using that address object.

[dingjerry_FTNT]

Since you have multiple dialup VPNs, wondering whether you are using peer IDs to identify them.

[network123]

Hello, we use different shared keys and ID and I get the correct IP's. Looks like a bug if I see other responses.