Technical Tip: How to configure IPsec remote access with full tunnelling

hazim · ‎09-25-2023

Description

This article describes how to configure IPsec remote access via FortiClient with full tunneling.

Scope

FortiGate v7.0, v7.2, and above.

Solution

Follow the steps below to enable full tunneling for IPsec remote access via FortiClient:

Create an IPsec tunnel and make sure to turn off the 'ipv4-split-include' configuration:

CLI configuration example:

PHASE1.

config vpn ipsec phase1-interface
edit "No-Split-Tunnel"
set type dynamic
set interface "port1"
set mode aggressive
set peertype any
set net-device disable
set mode-cfg enable
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set comments "VPN: No-Split-Tunnel (Created by VPN wizard)"
set wizard-type dialup-forticlient
set xauthtype auto
set authusrgrp "LDAP"
set ipv4-start-ip 10.0.0.1
set ipv4-end-ip 10.0.0.100
set dns-mode auto
set save-password enable
set psksecret admin
next
end

PHASE2.

config vpn ipsec phase2-interface
edit "No-Split-Tunnel"
set phase1name "No-Split-Tunnel"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set comments "VPN: No-Split-Tunnel (Created by VPN wizard)"
next
end

Once the user is connected to the IPsec VPN, all the traffic will redirect to the FortiGate, including public IP access such as google.com, fortinet.com, etc.
Make sure to add a dedicated firewall policy for IPsec users to access the Internet once connected to the IPsec VPN.