VPNSSL Split tunneling using internet services

[Felix1213]

Hello,

I would like to configure SSLVPN in split tunneling mode in order to reach local resources, but also some objects in GCP that have an ACL allowing the primary public IP of the Fortigate as source.

I thought of using Internet Services to allow whole GCP from the tunnel, and I was expecting the forticlient to install those routes, but it didn't.

config firewall policy
  edit <rulenumber>
    set uuid xxx
    set srcintf "ssl.root"
    set dstintf "<wanport>"
    set action accept
    set srcaddr "<vpnaddresspool>"
    set internet-service enable
    set internet-service-name "Google-Google.Cloud"
    set schedule "always"
    set nat enable
    set groups "<groupname>"
  next
end

In SSLVPN Portals -> Routing Address override: I don't have access to Internet Policies.

The device is a F3501F, running latest mature version available. (7.2.10)

What would be the less time consuming of doing what I want?

Is there a way to make those Internet policies work for split tunneling? Or maybe create a project on github that build the list of ip in a .txt every day and make Fortigate query it?

Thanks,

[johnathan]

ISDB may not work for SSLVPN split tunnel, but FQDN objects should. If you know the FQDN of the destinations you need to reach, you can specify this in your policy and those routes should be injected in the FortiClient.  See this document: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Access-to-Specific-FQDN-using-Split-Tunnel...

[Felix1213]

Thank you, unfortunately I cannot use FQDN because I have a list of subnet, and I cannot add a subnet to a DNS A record.

I also tried "IP Address Threat Feed" but it doesn't work either.

Is there some solution where I don't have to create 200 subnets that change pretty often on the Fortigate?