VPN for Windows Clients with local Internet browsing

[DamianLozano]

Hello everyone!

I hope anyone can help me with this:

I have a L2TP+IPSec VPN (Dialup) configured in a Forti and Windows Clients are connecting fine.

I want to these Windows client can use Internet through theirs local default gateways, I dont want to clients navigate through the remote Fortinet.

Is it posible to create a VPN which I can use to connect from Windows OS to remote network through Forti but leaving the same local gateways?

Thanks in advance.

Regards,

[DamianLozano]

Hello,

I have created the same VPN in another Forti as:

https://kb.fortinet.com/kb/viewContent.do?externalId=FD36253

I set it to custom

I got forticlient 5.2 for a forti OS 5.2

I configured the forticlient with the default parameters, as ipsec

I can connect but I can not use Internet, I did not add a rule in the forti to go out to Internet because I want the forticlient use the local gateway to Internet access

Here the code:

config vpn ipsec phase1-interface

    edit "VPN_Fib"

        set type dynamic

        set interface "wan1"

        set mode aggressive

        set mode-cfg enable

        set proposal aes128-sha256 aes256-sha256

        set comments "VPN: VPN_Fib (Created by VPN wizard)

        set xauthtype auto

        set authusrgrp "VPN-Users"

        set ipv4-start-ip 172.20.5.64

        set ipv4-end-ip 172.20.5.70

        set ipv4-netmask 255.255.252.0

        set dns-mode auto

        set ipv4-split-include "-Clients172"

        set save-password enable

        set psksecret ENC JS+5e/6wwAFQk7sDdTBv9/ZGrZcZzVyErqo3YGwehXeDNXZNHnqqeVHB0NgAlNCKezaOjXHB1gOGwQaJyLxBr+FpNvcEPFyFWhbAQ9g+H79LfTMd67wiMV1uUxNpfKUd5ctlp6t4wrs/hodnVto5DkEs2pP4vdU4hXDScqFmFKReQWr155Fjn0xd/e9u0DTjd/5MGQ==

    next

end

Any Idea?

Thanks in advance

Regards

config vpn ipsec phase1-interface

    edit "VPN_Fib"

        set type dynamic

        set interface "wan1"

        set mode aggressive

        set mode-cfg enable

        set proposal aes128-sha256 aes256-sha256

        set comments "VPN: VPN_Fib (Created by VPN wizard)

Para utilización de telefonía IP desde Chile"

        set xauthtype auto

        set authusrgrp "VPN-Users"

        set ipv4-start-ip 172.20.5.64

        set ipv4-end-ip 172.20.5.70

        set ipv4-netmask 255.255.252.0

        set dns-mode auto

        set ipv4-split-include "-Clients172"

        set save-password enable

        set psksecret ENC JS+5e/6wwAFQk7sDdTBv9/ZGrZcZzVyErqo3YGwehXeDNXZNHnqqeVHB0NgAlNCKezaOjXHB1gOGwQaJyLxBr+FpNvcEPFyFWhbAQ9g+H79LfTMd67wiMV1uUxNpfKUd5ctlp6t4wrs/hodnVto5DkEs2pP4vdU4hXDScqFmFKReQWr155Fjn0xd/e9u0DTjd/5MGQ==

    next

end

[DamianLozano]

I realliced that when I connect to VPN, the default route in Windows clients, for 0.0.0.0/0 for VPN has 1 in metric

I change the metric on IPv4 settings but it sets again to 1 automatically the next time I connect

I think this is the problem.

Any Idea?

Thanks in advance

[sw2090]

without split tunneling your default route will be changed to the vpn once you connect and reverted back when vpn disconnects again.

[DamianLozano]

But split tunneling is enabled

I followed https://kb.fortinet.com/kb/viewContent.do?externalId=FD36253

[mr_vaughn]

it is called "split tunnel" .You specify the IP subnets that the are routed across the IPSEC VPN to your site. and this get injected into the client apon connection of IPSEC VPN. so traffic is routed to internet or across VPN.

in Windows you can see this from CMD when executing "route print"

[AlexL]

Hi guys!

I have a similar problem, a set of several networks is included in ipv4-split-include (172.22.0.0/16, 172.25.0.0/16, 172.29.0.0/16 and others), but this does not work, clients (Windows VPN IKEv2) by still get one route, regardless of whether networks are added to ipv4-split-include or not:

172.25.0.0 255.255.0.0 On-link 172.25.151.51 36

FortiOS 6.0.9

What's wrong? How can I change this behavior?

Configured under the article https://kb.fortinet.com/k....do?externalId=FD36253