IKEv2 Dialup VPN - Split Tunnel doesn't work because route to internal LAN isn't pushed to

[71F6B385D38F]

Hi,

I set up IKEv2 dialup VPN on a Foritgate 92D Cluster to enable remote users to connect to our enterprise network. Remote users are using native Windows IKEv2 VPN Clients. The tunnel can be established successfully on Windows 7/8/10.

Clients are only able to connect to our on premise internal LAN if they check the box "Use default gateway on remote network" in the VPN clients settings. If the box is unchecked, clients do not get an entry in the local routing table to the on premise internal LAN.

According to this article (http://kb.fortinet.com/kb...do?externalID=FD36253) I have to enable ipv4-split-include in phase 1 settings of the VPN interface. Although I set this parameter and referenced our internal LAN, the Route doesn't get pushed to clients.

My current settings are:

FG1 (ikev2-p1) # show config vpn ipsec phase1-interface edit "ikev2-p1" set type dynamic set interface "internal2" set ike-version 2 set authmethod signature set mode-cfg enable set ipv4-dns-server1 192.168.0.1 set ipv4-dns-server2 192.168.0.2 set proposal aes256-sha1 aes256-sha256 aes128-sha1 aes128-sha256 set dhgrp 2 14 15 set eap enable set eap-identity send-request set authusrgrp "IKEv2VPN" set certificate "cert" set ipv4-start-ip 10.64.3.1 set ipv4-end-ip 10.64.3.253 set ipv4-netmask 255.255.255.0 set ipv4-split-include "internalLAN" next end

FG1 # show firewall address internalLAN config firewall address edit "internalLAN" set uuid 4c70eafe-5e40-51e6-bee4-80c54cccf955 set subnet 192.168.0.0 255.255.255.0 next end

After establishing a VPN connection, a client is assigned and IP address as well as the DNS server according to phase 1 configuration:

IPv4 Address. . . . . . . . . . . : 10.64.3.3(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.255 Default Gateway . . . . . . . . . : DNS Servers . . . . . . . . . . . : 192.168.0.1 192.168.0.2

The routing table (extract):

Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.178.1 192.168.178.40 20 10.0.0.0 255.0.0.0 On-link 10.64.3.3 11 10.64.3.3 255.255.255.255 On-link 10.64.3.3 266 10.255.255.255 255.255.255.255 On-link 10.64.3.3 266 Public IP Fortigate 255.255.255.255 192.168.178.1 192.168.178.40 21 192.168.178.0 255.255.255.0 On-link 192.168.178.40 276 192.168.178.40 255.255.255.255 On-link 192.168.178.40 276 192.168.178.255 255.255.255.255 On-link 192.168.178.40 276

Whats odd about the routes is:

- network should be 10.64.3.0/24 instead of 10/8, as well as the broadcast address accordingly - no route to internal LAN 192.168.0.0/24

Conclusion:

Some of the phase1-interface's settings are applied to the clients (DNS server), some are applied in a "wrong" manner (network and broadcast address of the remote assigned ip addresses) and some are not applied at all (route to on premise LAN).

Any help on how to troubleshoot and resolve this issue is greatly appreciated.

Edit: using Fortigate 5.4.1

Edit:

If I'm using the GUI to enable split tunneling for this IPSec Tunnel, it tries to look up addressesn, but it is stuck at "processing" forever.