Helpful ReplyHot!SSL VPN Split Tunnel - Route specific IP/FQDN out locally

Author
froggle
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/03/24 09:23:27
  • Status: offline
2020/03/24 09:36:22 (permalink) 6.0
0

SSL VPN Split Tunnel - Route specific IP/FQDN out locally

Hello,
 
I can't seem to find any questions quite like mine, and I apologize if I have missed them.
 
Fortigate 300D - 6.0.4
 
We are setting up a SSL VPN with Split Tunneling. I can route our internal networks and some public IP Addresses through the tunnel. That much is easy.
 
What I am trying to find out is if I can switch this around? So I would specify 0.0.0.0/0 to go through the tunnel, but then specify IPs, or FQDNs out through the endpoints local ISP. Specifically Microsoft Office 365 traffic.
 
The reason I am thinking this way is because we currently have no control of internet access at the endpoint, like WebFilter/AppControl using FortiClient. Something I hope to get soon, but having to wait. I don't like the idea of internet access outside of the corp net that I cannot control. And this is why we don't use Split-Tunneling.
 
Feel free to change my mind here, I might be barking up the wrong tree. If I had EMS I wouldn't be doing this.
 
Many thanks!
#1
Abraham
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/05/29 09:22:53
  • Status: offline
Re: SSL VPN Split Tunnel - Route specific IP/FQDN out locally 2020/03/30 09:34:43 (permalink) ☄ Helpfulby froggle 2020/04/06 02:28:43
0
Same Idea and same Problem. I tried the same approach but the split tunnel configuration allow to configure only IP address network or ranges no FQDN or Internet services. So the only solution possible is to configure network ranges of all IPv4 ip addresses and exclude those you want to split. ex.
 
You what to split: 10.255.255.0/24 (255 IP adresses) Two network ranges
1-Configure a network range 0.0.0.0-10.255.254.255
2-Configure a network range 11.0.0.0-255.255.255.255
3- Add IP ranges to under split-tunnel routing address   
#2
TecnetRuss
Bronze Member
  • Total Posts : 24
  • Scores: 8
  • Reward points: 0
  • Joined: 2017/02/27 13:14:44
  • Status: offline
Re: SSL VPN Split Tunnel - Route specific IP/FQDN out locally 2020/03/30 11:36:00 (permalink) ☄ Helpfulby froggle 2020/04/06 02:17:23
0
Sorry but it should be said that FortiOS 6.0.4 has three pretty serious SSL-VPN vulnerabilities and I would strongly recommend against deploying SSL-VPN before upgrading to at least 6.0.5 but preferably the latest 6.0.x release (currently 6.0.9).
 
https://www.fortinet.com/blog/business-and-technology/fortios-ssl-vulnerability.html
https://fortiguard.com/psirt/FG-IR-18-384
https://fortiguard.com/psirt/FG-IR-18-388
https://fortiguard.com/psirt/FG-IR-18-389
 
Russ
NSE7
post edited by TecnetRuss - 2020/03/30 11:37:51
#3
CHXGVA
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/03/26 05:10:56
  • Status: offline
Re: SSL VPN Split Tunnel - Route specific IP/FQDN out locally 2020/04/21 06:50:24 (permalink)
0
Hi Froggle ,
 
Same problem here, in order to configure Office 365 correctly Microsoft recommend Split Tunneling and they provide the required addresses.  We would like to keep the majority of Web traffic running through the Forti but to force 0365 traffic to be routed directly on the client.

0365 is becoming very very widely deployed and I imagine that we are not alone in the request.
#4
CHXGVA
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/03/26 05:10:56
  • Status: offline
Re: SSL VPN Split Tunnel - Route specific IP/FQDN out locally 2020/04/30 08:19:07 (permalink)
0
Finally, I did the following

1 : Download the list of Microsoft 365 IPs ( MS provides a Powershell script to do this)
2 : Strip of the data I dont want and compile a single numerically ordered list of the IPS.

exemple : 
13.107.6.171
13.107.140.6
52.108.0.0
52.238.106.116
52.244.37.168
52.244.203.72
52.244.207.172
52.244.223.198
etc etc 


3 : Create a range of IP address starting from 1.1.1.1 to 255.255.255.255 "excluding" the IPs from Microsoft.
     This results in  a list of 74 ranges.
4 : Using this list I created a script to add the ranges to the Firewall address list using the CLI.


config firewall address
edit M365-0
set type iprange
set start-ip 1.1.1.1
set end-ip 13.70.151.215
end
config firewall address
edit M365-1
set type iprange
set start-ip 13.70.151.217
set end-ip 13.71.127.196
end
config firewall address
edit M365-2
set type iprange
set start-ip 13.71.127.198
set end-ip 13.72.245.114
end
config firewall address
edit M365-3
set type iprange
set start-ip 13.72.245.116
set end-ip 13.73.1.119
end

etc etc etc   There are 72 in total



5 : I then create a group of addresses ( M365) that encompasses al lof the ranges in step 3.

6 : In the VPN Tunnel I added the Group (M365) to the address that get passed to the VPN.

BUT and there is always a but, the FortiClient MUST be at least 6.2.
With the 6.0.9, the client only receives the 1st 17 ranges of address , there appears to be a limit on the size of the Static Routing Config sent sent to the client.





#5
nsandone
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/09/20 05:31:59
  • Status: offline
Re: SSL VPN Split Tunnel - Route specific IP/FQDN out locally 2020/05/18 10:15:58 (permalink)
0
This is something a lot of people have been asking for.   It looks like 6.4.0 finally has this feature although I haven't tested it myself yet.   You need FortiOS 6.4.0 and FortiClient 6.4.0 for it to work from what I'm reading.    There is a CLI option:
 
set split-tunneling-routing-negate
 
 
#6
Kevin Shanus
New Member
  • Total Posts : 8
  • Scores: 1
  • Reward points: 0
  • Joined: 2014/05/15 04:56:43
  • Status: offline
Re: SSL VPN Split Tunnel - Route specific IP/FQDN out locally 2020/05/22 07:32:46 (permalink)
3 (1)
The below article would do the opposite by forcing specific FQDN to use the tunnel and not local internet? Thanks
 
https://kb.fortinet.com/kb/documentLink.do?externalID=FD46248
 
 
#7
Jump to:
© 2020 APG vNext Commercial Version 5.5