# Split tunnel: only 10.20.30.0/24 goes through HQ Source: https://ai.techclick.in/blog_vpn_ssl_split_tunnel Markdown: https://ai.techclick.in/blog_vpn_ssl_split_tunnel.md Publisher: Techclick Infosec Pvt Ltd SSL-VPN split vs full tunnel. Full tunnel hairpins YouTube via HQ WAN. Split only 10.20.30.0/24. Pool 10.20.40.0/24. ## The ticket HQ WAN is melting after the WFH memo. get vpn ssl monitor shows twenty users. Split tunneling is off. Every Netflix stream is now an HQ firewall session. Meanwhile the portal still listens on WAN 443 with password-only. Quick interview answer Split tunnel = the client routes only listed prefixes (this lab: 10.20.30.0/24) into the SSL-VPN. Full tunnel = default route via the tunnel, so internet hairpins HQ. FortiOS 7.4: VPN → SSL-VPN Settings (Listen on Interface(s), Listen on Port, Server Certificate, IP Pools 10.20.40.0/24) + VPN → SSL-VPN Portals (Enable Split Tunneling, Routing Address) + Authentication/Portal Mapping + firewall policy from ssl.root to LAN. Full tunnel is for forced inspection, not for “it connected.” Hero · home routes If 1.1.1.1 goes via 203.0.113.10, you built full tunnel. Lab data · dummy only FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60 . RFC 5737. Not a customer. ## Mental model Split Full Client route Only 10.20.30.0/24 via tunnel 0.0.0.0/0 via tunnel YouTube / 1.1.1.1 Home ISP HQ WAN (hairpin) Use when Users need LAN apps, not HQ web proxy You must inspect or lock all egress This lab Split on, Routing Address = LAN Off unless the ticket says inspect Policy from ssl.root → LAN ssl.root → LAN and often ssl.root → WAN Where Priya’s packets go Split sends LAN via SSL-VPN, internet via home ISP Priya home pool 10.20.40.10 - Split: SSL-VPN 10.20.30.0/24 only Home ISP YouTube / 1.1.1.1 fgt-hq ssl.root LAN 10.20.30.0/24 Internet (home path) Full tunnel would draw YouTube through fgt-hq WAN 203.0.113.10. https://fgt-hq.techclick-lab.in Training mock · not live FortiOS Dashboard Network VPN Policy VPN → SSL-VPN Settings + Portals ### Listen on WAN, split LAN Listen on Interface(s) port1 (WAN) Listen on Port 10443 (leave 443 for VIP/admin if needed) Server Certificate users.techclick-lab.in IP Pools / Address range 10.20.40.0/24 Enable Split Tunneling Enabled Routing Address 10.20.30.0/24 Authentication/Portal Mapping TECHCLICK VPN group → full-access / tunnel Cancel Save FortiOS 7.4 VPN → SSL-VPN Settings and SSL-VPN Portals. Training mock. ## How to choose Default for this class: split to 10.20.30.0/24 . Full tunnel only when the security policy says all internet must exit HQ (then size the WAN and write ssl.root → WAN). Contractors who need one app: ZTNA (lesson 1), not a bigger SSL-VPN. ## Runbook #### Side A - portal Certificate matches the hostname, port 10443, restrict source if you can, MFA on the group. Pool 10.20.40.0/24 not overlapping LAN or Azure/AWS hubs. - #### Side B - split + policy Portal: Enable Split Tunneling, Routing Address = 10.20.30.0/24. Policy: ssl.root → LAN, dest 10.20.30.0/24, log. Do not use WAN as the incoming interface. - #### Side C - prove get vpn ssl monitor shows priya + 10.20.40.10. Ping 10.20.30.1 works. tracert 1.1.1.1 does not list 203.0.113.10. fgt-hq · SSL-VPN proof get vpn ssl monitor # index user assigned remote # 0 priya 10.20.40.10 198.51.100.80 get firewall policy # srcintf: ssl.root dstintf: LAN dstaddr: 10.20.30.0/24 nat: disable # On Priya's laptop (split expected): # route print → 10.20.30.0/24 via 10.20.40.1 # tracert 1.1.1.1 → home ISP, not 203.0.113.10 ## Four failures ### 1 · Full tunnel by accident Split unchecked. HQ WAN dies. Enable split or own the hairpin with capacity. ### 2 · Policy from WAN, not ssl.root Tunnel-mode users never match. Incoming interface is ssl.root. ### 3 · Pool overlaps LAN or cloud hubs 10.20.40.0/24 must not collide with 10.20.30.0/24, 10.30.0.0/24, 10.40.0.0/16, 10.50.0.0/16. ### 4 · Portal on 443 fights VIP, or password-only to the world Move the listen port. Restrict source, MFA, current FortiOS. SSL-VPN is a scanned surface. ## How to prove it Close only when 1) User in ssl monitor with 10.20.40.x. 2) LAN ping works. 3) Internet does not hairpin unless you designed full tunnel. 4) Policy is ssl.root → LAN. ## Traps Symptom Cause Wrong fix Connects, no apps Missing ssl.root → LAN / DNS New PSK on IPsec S2S Home internet dies Full tunnel Buy more WAN before checking split Cert warning Portal cert ≠ listen hostname Disable SSL-VPN ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Split tunnel in this lab should install… 0.0.0.0/0 via HQ Only 10.20.30.0/24 via SSL-VPN 10.40.0.0/16 only UDP 500 only Correct: b . This lesson. Q2 Tunnel-mode SSL-VPN policies start from… WAN ssl.root vpn-branch ha1 Correct: b . FortiOS ssl.root. Q3 Full tunnel hairpins YouTube because… The client default route goes via HQ IKE Phase-1 is down Azure LNG is wrong PFS is off Correct: a . Ticket. Q4 SSL-VPN pool in this dummy lab? 10.20.40.0/24 10.20.30.0/24 10.40.0.0/16 203.0.113.0/24 Correct: a . Lab data. Q5 Proof split is working on Priya’s laptop? tracert 1.1.1.1 does not go via 203.0.113.10 get system status diagnose vpn ike gateway list is empty FAZ is down Correct: a . Runbook. Q6 Internet-facing SSL-VPN should at least have… MFA, restrict sources, current FortiOS Password admin/admin on 443 HTTP Any-any ssl.root to WAN forever Correct: a . Failure 4. Check answers Reset VPN scenario class series: S2S vs RA vs ZTNA · Phase-1 down · Phase-2 / proxy ID · Route vs policy · SSL split tunnel · FGT → Azure · FGT → AWS · VPN interview ## Sources - FortiOS 7.4 Administration Guide - SSL-VPN . - FortiOS 7.4 - SSL-VPN (settings, portals, split tunneling) . - FortiGuard PSIRT - treat internet-facing SSL-VPN as a scanned surface . Related: FortiGate IPsec · Azure hub-spoke · AWS TGW . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt