IPSec VPN with multiple split-tunnel networks

[kfrauendienst]

Good afternoon.  I have a situation where I would like to enable split-tunnel for multiple subnets that can't be expressed in a single subnet or range.  For example let's say 10.0.0.0/16 and 192.168.0.0/24.  On Cisco ASA this is done by creating a standard ACL for the split-tunnel that permits the desired networks.

I'm trying to do this on a FortiGate 200D running version 5.2.  The VPN type is IPSec created with the iOS native client template, and it's working fine with just one of the split-tunnel networks defined.  I couldn't see a way via the GUI or CLI to add more than one split-tunnel network to the VPN tunnel.  Can this be done?

Thanks

[Toshi_Esumi · Accepted solution]

GUI would differ from FortiOS version to version, but at lease in CLI, you just need to duplicate the phase2-interface entry you already have after modifying the name and subnet pair (so-called selector) like below. The key is both need to be referring to the same phase1-interface.

config vpn ipsec phase2-interface

    edit "IPsecTest1-1"

        set phase1name "IPsecTest1"

        set proposal aes256-sha256         set dhgrp 19         set dst-subnet 192.168.0.0 255.255.255.0

        set src-subnet 172.16.0.0 255.255.0.0     next

    edit "IPsecTest1-2"

        set phase1name "IPsecTest1"

        set proposal aes256-sha256         set dhgrp 19         set dst-subnet 10.0.0.0 255.0.0.0

        set src-subnet 172.16.0.0 255.255.0.0     next

end

[urho · Accepted solution]

Hi, 

You need to create a address group and put all your split-tunnel networks on that group. Then on GUI or CLI put that address group to your split-tunnel-network.

[Toshi_Esumi · Accepted solution]

GUI would differ from FortiOS version to version, but at lease in CLI, you just need to duplicate the phase2-interface entry you already have after modifying the name and subnet pair (so-called selector) like below. The key is both need to be referring to the same phase1-interface.

config vpn ipsec phase2-interface

    edit "IPsecTest1-1"

        set phase1name "IPsecTest1"

        set proposal aes256-sha256         set dhgrp 19         set dst-subnet 192.168.0.0 255.255.255.0

        set src-subnet 172.16.0.0 255.255.0.0     next

    edit "IPsecTest1-2"

        set phase1name "IPsecTest1"

        set proposal aes256-sha256         set dhgrp 19         set dst-subnet 10.0.0.0 255.0.0.0

        set src-subnet 172.16.0.0 255.255.0.0     next

end

[urho · Accepted solution]

Hi, 

You need to create a address group and put all your split-tunnel networks on that group. Then on GUI or CLI put that address group to your split-tunnel-network.

[rwpatterson · Accepted solution]

urho wrote:

Hi, 

You need to create a address group and put all your split-tunnel networks on that group. Then on GUI or CLI put that address group to your split-tunnel-network.

This is actually optional. If you do it group wise like above, then all tunnels have the same access. If you leave them split, you can apply different services/access/schedules to the different tunnel segments.

My two cents

[Myth]

"If you leave them split, you can apply different services/access/schedules to the different tunnel segments."

Could you explain how this is done? Config multiple IPsec tunnels with a single subnet each? Then connect from the remote side as needed to each tunnel?

[hutchenaround]

Have you tried Policy Routes?

[emnoc]

I wrote this up many,many ,many years ago  this  the simple means to include split-tunnel for vpn and ipsec.SSLVPN is similar approach btw

http://socpuppet.blogspot.com/2013/09/forticlient-split-tunnel-fortigate.html

Ken