The ticket
HQ WAN is melting after the WFH memo. get vpn ssl monitor shows twenty users. Split tunneling is off. Every Netflix stream is now an HQ firewall session. Meanwhile the portal still listens on WAN 443 with password-only.
Split tunnel = the client routes only listed prefixes (this lab: 10.20.30.0/24) into the SSL-VPN. Full tunnel = default route via the tunnel, so internet hairpins HQ. FortiOS 7.4: VPN → SSL-VPN Settings (Listen on Interface(s), Listen on Port, Server Certificate, IP Pools 10.20.40.0/24) + VPN → SSL-VPN Portals (Enable Split Tunneling, Routing Address) + Authentication/Portal Mapping + firewall policy from ssl.root to LAN. Full tunnel is for forced inspection, not for “it connected.”
FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.
Mental model
| Split | Full | |
|---|---|---|
| Client route | Only 10.20.30.0/24 via tunnel | 0.0.0.0/0 via tunnel |
| YouTube / 1.1.1.1 | Home ISP | HQ WAN (hairpin) |
| Use when | Users need LAN apps, not HQ web proxy | You must inspect or lock all egress |
| This lab | Split on, Routing Address = LAN | Off unless the ticket says inspect |
| Policy from | ssl.root → LAN | ssl.root → LAN and often ssl.root → WAN |
Full tunnel would draw YouTube through fgt-hq WAN 203.0.113.10.
Listen on WAN, split LAN
How to choose
Default for this class: split to 10.20.30.0/24. Full tunnel only when the security policy says all internet must exit HQ (then size the WAN and write ssl.root → WAN). Contractors who need one app: ZTNA (lesson 1), not a bigger SSL-VPN.
Runbook
Side A - portal
Certificate matches the hostname, port 10443, restrict source if you can, MFA on the group. Pool 10.20.40.0/24 not overlapping LAN or Azure/AWS hubs.
Side B - split + policy
Portal: Enable Split Tunneling, Routing Address = 10.20.30.0/24. Policy: ssl.root → LAN, dest 10.20.30.0/24, log. Do not use WAN as the incoming interface.
Side C - prove
get vpn ssl monitorshows priya + 10.20.40.10. Ping 10.20.30.1 works. tracert 1.1.1.1 does not list 203.0.113.10.
get vpn ssl monitor # index user assigned remote # 0 priya 10.20.40.10 198.51.100.80 get firewall policy # srcintf: ssl.root dstintf: LAN dstaddr: 10.20.30.0/24 nat: disable # On Priya's laptop (split expected): # route print → 10.20.30.0/24 via 10.20.40.1 # tracert 1.1.1.1 → home ISP, not 203.0.113.10
Four failures
1 · Full tunnel by accident
Split unchecked. HQ WAN dies. Enable split or own the hairpin with capacity.
2 · Policy from WAN, not ssl.root
Tunnel-mode users never match. Incoming interface is ssl.root.
3 · Pool overlaps LAN or cloud hubs
10.20.40.0/24 must not collide with 10.20.30.0/24, 10.30.0.0/24, 10.40.0.0/16, 10.50.0.0/16.
4 · Portal on 443 fights VIP, or password-only to the world
Move the listen port. Restrict source, MFA, current FortiOS. SSL-VPN is a scanned surface.
How to prove it
1) User in ssl monitor with 10.20.40.x. 2) LAN ping works. 3) Internet does not hairpin unless you designed full tunnel. 4) Policy is ssl.root → LAN.
Traps
| Symptom | Cause | Wrong fix |
|---|---|---|
| Connects, no apps | Missing ssl.root → LAN / DNS | New PSK on IPsec S2S |
| Home internet dies | Full tunnel | Buy more WAN before checking split |
| Cert warning | Portal cert ≠ listen hostname | Disable SSL-VPN |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
VPN scenario class series: S2S vs RA vs ZTNA · Phase-1 down · Phase-2 / proxy ID · Route vs policy · SSL split tunnel · FGT → Azure · FGT → AWS · VPN interview
Sources
- FortiOS 7.4 Administration Guide - SSL-VPN.
- FortiOS 7.4 - SSL-VPN (settings, portals, split tunneling).
- FortiGuard PSIRT - treat internet-facing SSL-VPN as a scanned surface.
Related: FortiGate IPsec · Azure hub-spoke · AWS TGW.