Hi,
I want people to be able to connect to our office over vpn.
When they do this I prefer all their internet traffic also goes through our fortigate.
This works when I setup a ipsec vpn without split tunnel.
But some users need to be able to print on their local network printer.
If I set up a split vpn tunnel this works but then the internet traffic goes over their local gateway.
So how can I solve this?
I'm on fortios 5.2.10
thanks!
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
no split-tunnel vpn shouldn't break local LAN device access. Just default route going into the tunnel. If remote user's PC is 192.168.1.10/24 and he/she should be able to reach a printer with 192.168.1.100 regardless the tunnel is up or not. Did you check the routing table on the PC when the tunnel is up?
hi tx for the answer.
my local network 192.168.4.0/24
vpn 10.10.254.100-10.10.254.150
this is the routing table:
IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.4.100 192.168.4.54 36 0.0.0.0 0.0.0.0 10.10.254.101 10.10.254.100 1 10.10.254.100 255.255.255.255 On-link 10.10.254.100 257 remote ip 255.255.255.255 192.168.4.100 192.168.4.54 35 127.0.0.0 255.0.0.0 On-link 127.0.0.1 331 127.0.0.1 255.255.255.255 On-link 127.0.0.1 331 127.255.255.255 255.255.255.255 On-link 127.0.0.1 331 169.254.1.1 255.255.255.255 10.10.254.101 10.10.254.100 1 192.168.4.0 255.255.255.0 On-link 192.168.4.54 291 192.168.4.54 255.255.255.255 On-link 192.168.4.54 291 192.168.4.255 255.255.255.255 On-link 192.168.4.54 291 224.0.0.0 240.0.0.0 On-link 127.0.0.1 331 224.0.0.0 240.0.0.0 On-link 10.10.254.100 257 224.0.0.0 240.0.0.0 On-link 192.168.4.54 291 255.255.255.255 255.255.255.255 On-link 127.0.0.1 331 255.255.255.255 255.255.255.255 On-link 10.10.254.100 257 255.255.255.255 255.255.255.255 On-link 192.168.4.54 291
So if I look at this I think its normal i cannot reach my local network.
0.0.0.0 0.0.0.0 10.10.254.101 10.10.254.100 1
this catches everything and send it to my remote network.
If I use a split tunnel the metric of this route is much higher
So I guess I need to change the metric of that route and put a route before it that points to my local network.
I could program it on my local computer but thats no solution since I dont know what lan other users will have.
So how do I do this on the fortigate?
tx
I have a similar problem with an added concern.
Local network 192.168.1.x
Remote network 192.168.1.x
VPN Works
Split tunnel enabled
When connected via VPN , user can access remote resources no issue.
Issues:
When connected via VPN user is not able to print to printer on local LAN
When connected via VPN, user is not able to change their Active Directory password
No. The routing table is normal but you still should be able to reach IPs in the connected subnet. Otherwise you can't reach even the GW device 192.168.4.100 for the tunnel to work. The default routes are used only when more specific routes don't exist in the table. Something else seems to be wrong if you can't ping the local devices. I would suggest run Wireshark to see if the ping packets leave the PC or not.
With some help of fortinet support this problem is solved.
Config ip tunnel without split on your fortigate
Connect your forticlient and test if connection works.
backup your config in forticlient and edit the backup file
add following:
In the <ipsecvpn> section after </options> add these xml tags so it would with the xml file structure: <connections> <connection> <ike_settings> <enable_local_lan>1</enable_local_lan> </ike_settings> </connection> </connections> </ipsecvpn>
save and restore this file in your forticlient.
Test again. you can now access your local Lan.
grts
Hi, thank you. But i backup the file and searched for the strings you wrote. i can´t find it. The only thing i can find is the vpn config section like this :
edit "vpn1" set type dynamic set interface "wan1" set xauthtype auto set mode aggressive set mode-cfg enable set proposal 3des-sha1 aes128-sha1 set authusrgrp "Wizard_users" set ipv4-start-ip 192.168.50.10 set ipv4-end-ip 192.168.50.40 set ipv4-netmask 255.255.255.0 set dns-mode auto set ipv4-split-include „**********“ set psksecret ENC ****************
bashrael wrote about configuration file from FortiClient not from Fortigate.
Oh, thank you. Is this file local on the mac ? or where i can find it ?
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1705 | |
1093 | |
752 | |
446 | |
230 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.