Hi,
I'm trying to figure out how set split-tunneling-routing-negate works. The kb article is also not very helpful. My goal is to route all traffic into the tunnel, but exclude some IP addresses. Current config without excludes: split-tunneling : enable split-tunneling-routing-negate: disable split-tunneling-routing-address: "AllRanges" (this is a range from 0.0.0.1-255.255.255.255 which is almost all, as you cant add 0.0.0.0/0 to a split tunnel config) Now I want to exclude some ranges/ip's so I need to enable split-tunneling-routing-negate, but then the split-tunneling-routing-address starts to work as the excludes list. So how can I combine split-tunnel with destination ranges together with excluding some. I'm confused. Kind regards, Bastiaan
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
well if you want all traffic to go through the tunnel you don't need split tunneling at all.
You could filter the rest by policy.
--
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
I don't think this will work with split tunneling at all. Split tunneling means the client will get routes to the subnet(s) set in split tunneling pushed from the fortigate.
So if you set 40.40.0.0/16 (which is ipv4 class B) in there the client will get a route to 40.40.0.0/16 pushed.
That route also covers all smaller subnets beyond that class B which includes 40.40.10.0/24 (which is ipv4 class C).
So you cannot strike 40.40.10.0/24 by routing with that.
You would have to forbid that trafic by policy. Make one that covers traffic from vpn to 40.40.10.0/24 and forbids or drops it and make sure it comes before any other policy that matches 40.40.0.0/16.
Then you cannot reach 40.40.10.0/24 from out of vpn but you can still reach the rest of 40.40.0.0/16 of course.
--
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
Hello,
you have to define IP group you want to exclude e.g. 'MS-Teams'
Then you need the following 3 commands:
set split-tunneling enable set split-tunneling-routing-negate enable set split-tunneling-routing-address "MS-Teams"
That's it.
Default routing goes to the tunnel
The network from the group goes to the local breakout.
Thanks and best regards,
Christian
yes with the consequence that then all non local client traffic will go through the tunnel.
--
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
You can define in the group public ranges. These ranges will be routed to the local gateway and not through the tunnel.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.