VPN Split Tunneling Issue – No Access to VLANs

[AC_CHANGE]

Hello,

I have two FortiGate 60F  7.4.7 devices configured for redundancy in case of failure. The setup includes two physical WAN interfaces: ISP-1 (wan1) and ISP-2 (wan2). There is also a virtual LACP-1 interface that combines internal1 and internal2. Several VLANs are configured on LACP-1.

I need to configure an IPSec VPN with Split Tunneling, where all internet traffic should go through the client's local internet, while traffic destined for the VLANs should be routed through the tunnel.

The VPN tunnel establishes successfully, and the client can connect. However, the client cannot access any network resources inside the VLANs or ping anything.

VPN Tunnel Configuration:

VPN Tunnel Configuration:

config vpn ipsec phase1-interface
    edit "Delta_VPN_IPSec"
        set type dynamic
        set interface "wan1"
        set mode aggressive
        set peertype any
        set net-device disable
        set mode-cfg enable
        set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
        set comments "VPN: Delta_VPN_IPSec (Created by VPN wizard)"
        set wizard-type dialup-forticlient
        set xauthtype auto
        set authusrgrp "TESTVPNSSL"
        set ipv4-start-ip 192.168.80.100
        set ipv4-end-ip 192.168.80.200
        set dns-mode auto
        set ipv4-split-include "Delta_VPN_IPSec_split"
        set save-password enable
    next
end

config vpn ipsec phase2-interface
    edit "Delta_VPN_IPSec"
        set phase1name "Delta_VPN_IPSec"
        set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
        set comments "VPN: Delta_VPN_IPSec (Created by VPN wizard)"
    next
end

Firewall Policy Configuration:

config firewall policy
    edit 31
        set name "vpn_Delta_VPN_IPSec_remote_0"
        set uuid a254b5f2-08bb-51f0-3a23-e904558689db
        set srcintf "Delta_VPN_IPSec"
        set dstintf "LACP-1"
        set action accept
        set srcaddr "Delta_VPN_IPSec_range"
        set dstaddr "VLAN-10 address" "VLAN-11 address" "VLAN-15 address" "VLAN-20 address"
        set schedule "always"
        set service "ALL"
        set comments "VPN: Delta_VPN_IPSec (Created by VPN wizard)"
    next
end

Issue:

Even with these settings, the VPN client cannot access VLAN-10, VLAN-11, VLAN-15, or VLAN-20. No communication is working between the VPN client and these VLANs.

Questions:

1. Are there any missing configurations (e.g., additional routes or security policies) that could be preventing VLAN access?

2. Is there a need for a policy from LACP-1 to Delta_VPN_IPSec to allow return traffic?

3. Are there any common FortiGate limitations or known issues that could cause this behavior?

Would be grateful for advice

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Toshi_Esumi]

Are you realizing the LACP interface "LACP-1" and VLAN subinterfaces are all independent interfaces in FGT policies? You need to have policies toward those VLAN interfaces or bind them in a zone if there is not much distinction in policies.

Toshi