FortiAP / FortiWifi split tunneling configuration not possible

[ivan_bermejo]

Hi all,

we are trying to use the split tunneling configuration for FortiAPs in non-directectly connected VLANs to Fortigate. This APs are configured in a tunnel configuration (captive portal required) but it would be interesting to split the traffic, as said in the 5.6 configuration guide, to avoid loading the fortigate with unnecessary traffic to Internet. But... there seems to be no way to do so, since the networks to avoid the tunnel (being directly routed through the AP), must be declared wether in FortiAP Profile or AP, and it is not possible to do so for all Internet addresses.

So the question is: is it possible to declare which networks should be tunneled to the Fortigate, instead of the locally routed from the AP? Is there a possible configuration for routing locally all Internet but tunnelling to fortigate some IP networks/ranges?

Best regards

Ivan

[_sergey_]

ivan.bermejo@es.logicalis.com wrote:

So the question is: is it possible to declare which networks should be tunneled to the Fortigate, instead of the locally routed from the AP? Is there a possible configuration for routing locally all Internet but tunnelling to fortigate some IP networks/ranges?

Check this out https://forum.fortinet.com/tm.aspx?m=154038

[wanglei_FTNT]

Please post your complete config and we will check it out and get back to you. 

Thanks,

Lei

[_sergey_]

wanglei@fortinet.com wrote:

Please post your complete config and we will check it out and get back to you. 

 Thanks,

 Lei

Replied here https://forum.fortinet.com/tm.aspx?m=154038

[Sumanth_FTNT]

Yes its supported on latest 5.6.3 builds.. as per what i understand the Tunnel ACL can be done in two ways..

set split-tunneling-acl-path ? tunnel Split tunneling ACL list traffic will be tunnel. local Split tunneling ACL list traffic will be local NATed.