Split tunnel not working for IPSec dial up vpn's

[network123]

We use multiple dial up IPSec vpn's on our vm Fortigate (7.2.9) for remote support. 

But for windows 11 devices (forticlient 7.4.2) the split tunnel routes are not installed, only default route over the VPN. Because of this user do not receive 2fa token on the windows device as internet is not permitted. work around is to use a secondary device to receive 2fa token (mail). VPN is working for the rest, just not split tunnel.

config vpn:

config vpn ipsec phase1-interface
edit "xxx"
set type dynamic
set interface "port5"
set local-gw xxx
set mode aggressive
set peertype one
set net-device disable
set mode-cfg enable
set ipv4-dns-server1 xx
set ipv4-dns-server2 xx
set proposal aes256-sha256 aes128-sha1
set xauthtype auto
set authusrgrp "xxx"
set nattraversal forced
set peerid "xxx"
set ipv4-start-ip 172.29.2.0
set ipv4-end-ip 172.29.2.7
set ipv4-split-include "Remote-Access-VPN-Split"
set save-password enable
set psksecret xxx
next
end
config vpn ipsec phase2-interface
edit "xxx"
set phase1name "xx"
set proposal aes128-sha1 aes256-sha256
next
end

config firewall addrgrp

edit "Remote-Access-VPN-Split"
set member "10.0.0.0/8"
next

end

config firewall address

edit "10.0.0.0/8"
set subnet 10.0.0.0 255.0.0.0
next

I created a firewall policy for the zone of this vpn with split tunnel objects as dst (recommended by support). They don't want to assist anymore as we don't have EMS licenses for this. Can someone assist with this?

Thanks in advance!

[5g6tdcv41]

First time on the forum. I had similar problems if the Split-tunnel acl had anything other than ipv4 address. (FQDN etc)

Once I removed those my route table showed the correct routes.

[vics]

I'm having the same problem. I have an IPSec configured on a FortiGate running 7.4.7 (build 2731) and I am using FortiClient version 7.4.3 (build 1790). And only some clients are having this issue. For example, from my laptop, I have no problem at all. I believe that FortiClient might be using a cache and doesn't add the new route when it connects to the VPN. I'm going to downgrade the FortiClient on the user's computers that are having this problem. Hopefully Fortinet will release an update to fix this problem.

[Ryctas]

I fixed the problem by uninstalling, restarting, and installing from scratch again. In my previous comment I was doing the same thing you were doing and whatnots. 

[vics]

I could fix the problem by reinstalling the FortiClient on the user's computers that were having issues. Thanks