Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

ipsec vpn / access local printer


I want people to be able to connect to our office over vpn.  

When they do this I prefer all their internet traffic also goes through our fortigate.

This works when I setup a ipsec vpn without split tunnel.


But some users need to be able to print on their local network printer.

If I set up a split vpn tunnel this works but then the internet traffic goes over their local gateway.


So how can I solve this?

I'm on fortios 5.2.10


Esteemed Contributor III

no split-tunnel vpn shouldn't break local LAN device access. Just default route going into the tunnel.  If remote user's PC is and he/she should be able to reach a printer with regardless the tunnel is up or not. Did you check the routing table on the PC when the tunnel is up?


hi tx for the answer.

my local network


this is the routing table:

IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 36 1 On-link 257 remote ip 35 On-link 331 On-link 331 On-link 331 1 On-link 291 On-link 291 On-link 291 On-link 331 On-link 257 On-link 291 On-link 331 On-link 257 On-link 291


So if I look at this I think its normal i cannot reach my local network. 1

this catches everything and send it to my remote network.

If I use a split tunnel the metric of this route is much higher


So I guess I need to change the metric of that route and put a route before it that points to my local network.

I could program it on my local computer but thats no solution since I dont know what lan other users will have.

So how do I do this on the fortigate?





I have a  similar  problem with an added  concern. 

Local  network 192.168.1.x

Remote  network 192.168.1.x

VPN  Works 

Split  tunnel  enabled 

When connected  via VPN , user can access remote  resources no issue.



When connected  via VPN user  is  not able to print to printer  on  local  LAN  

When  connected  via VPN, user  is not able to change their  Active  Directory  password




Esteemed Contributor III

No. The routing table is normal but you still should be able to reach IPs in the connected subnet. Otherwise you can't reach even the GW device for the tunnel to work. The default routes are used only when more specific routes don't exist in the table. Something else seems to be wrong if you can't ping the local devices. I would suggest run Wireshark to see if the ping packets leave the PC or not. 


With some help of fortinet support this problem is solved.

Config ip tunnel without split on your fortigate

Connect your forticlient and test if connection works.

backup your config in forticlient and edit the backup file

add following:

In the <ipsecvpn> section after </options> add these xml tags so it would with the xml file structure:  <connections>  <connection>  <ike_settings>  <enable_local_lan>1</enable_local_lan>  </ike_settings>  </connection>  </connections>  </ipsecvpn> 


save and restore this file in your forticlient.

Test again.  you can now access your local Lan.



Hi, thank you. But i backup the file and searched for the strings you wrote. i can´t find it. The only thing i can find is the vpn config section like this :


edit "vpn1"

        set type dynamic

        set interface "wan1"

        set xauthtype auto

        set mode aggressive

        set mode-cfg enable

        set proposal 3des-sha1 aes128-sha1

        set authusrgrp "Wizard_users"

        set ipv4-start-ip

        set ipv4-end-ip

        set ipv4-netmask

        set dns-mode auto

        set ipv4-split-include „**********“

        set psksecret ENC ****************


bashrael wrote about configuration file from FortiClient not from Fortigate.


Oh, thank you. Is this file local on the mac ? or where i can find it ?

New Contributor

I use only windows version. Run the FCT with administrator privileges -> File-> Settings-> Backup button -> save *.conf file. Edit this backup file and find section described by bashrael
Top Kudoed Authors