Understanding local application Split-tunnelling with Forticlient EMS

[shocko]

We have an odd issue trying to split tunnel a local application myapp.exe. We are using Forticlient EMS 7.2.1 and Forticlient 7.2.1 connecting back to a Fortigate 6.4 on-prem for SSL VPN. We wish to split tunnel all traffic from myapp.exe. What appears to be happening though is that certain traffic from this app is simple not appearing on the wire on either the tunnel interface or the no-tunnel interface (direct to internet) when on the VPN. 

The logs of the application seem to indicate it cannot resolve the FQDNs it uses to IPs when on the VPN hence the issue but it's only specific FQDNs. I even spun up a dummy .NET/C# app to test this and called it myapp.exe and it works fine with the same local application rule and can connect to any location and is routed outside of the tunnel.

So there's something specific to this app that does not play nice with the split tunnel and it seems to be around DNS. So

I'm trying to figure out exactly how Forticlient/EMS implements application based split tunnelling?

• Does it intercept the traffic with a filter driver of the like?
• Is there anything specific Forticlient does in relation to DNS? 
• Is the DNS traffic/requests generated from the app that is excluded via the local application split tunnel policy sent out the non-tunnel adapter? 

[shocko]

I moved from using the local application rule to using a domain based rule and added all the FQDNs myapp.exe needs to talk to to this rule. This worked immediately although it does allow anything on the device talking to those endpoints to go straight to them outside of the tunnel interface rather than just myapp.exe.

So to me my issue seems to be with how the Forticlient handles/implements ,local application split tunnell

[bgodfrey]

Hello @shocko 
I have a few questions to get clarification on your issue at hand:
1. are you using Fortigate as your DNS server?
2. is your PC DNS using that same server?
From my understanding, if you are using a DNS source outside of the tunnel, any DNS queries will be routed outside the tunnel. 
That being said if you set up a DNS database, you can add a new database entry for your myapp.exe. This should then route all the traffic to the FortiGate- including all DNS queries.
the doc below is how to set up a DNS database. 
https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/960561/fortigate-dns-server

[shocko]

Thanks for the reply @bgodfrey 

1. On VPN we have a Windows DNS server defined. 

I'm not clear on how split tunnel is implemented for local application pattern though? 

[shocko]

Anyone?

[shocko]

Can anyone in Fortinet or community answer/comment on this one?