Configuring a split tunneling destination on FortiSASE

An endpoint can access private resources using zero trust network access (ZTNA) TCP forwarding when it has established a secure connection to FortiSASE. For FortiClient to forward this traffic directly to the FortiGate ZTNA access proxy without passing through FortiSASE, you must add a split tunneling destination corresponding to the IP or FQDN of the FortiGate. You can create this split tunneling destination on FortiSASE and push it to all managed endpoints.

To create a split tunneling destination on FortiSASE:

1. Go to Configuration > Profiles.
2. Select the Default profile and click Edit.

   You cannot create subnet destinations in a custom endpoint profile. Therefore, subnet destinations defined in the Default profile also apply to all custom profiles.

3. On the Access tab, under Bypass FortiSASE, configure Split tunneling destinations by clicking Create. Configure the following:
   1. In the Type field, select FQDN or Subnet depending on whether you defined the ZTNA Access Proxy fields in the ZTNA connection rules using an FQDN or IP address.
   2. From the Match dropdown list, do one of the following:
      1. Select the FQDN host for the FQDN type.
      2. Select the subnet host for the subnet type.

      If you have not created the FQDN or subnet host yet, click + to create a new FQDN or subnet host corresponding to the ZTNA access proxy.

      FortiSASE does not support wildcard FQDNs when configuring an FQDN split tunneling destination.

   3. Click OK.
4. Configure additional split tunneling destinations corresponding to the ZTNA connection rules.
5. Click Apply. FortiSASE pushes the split tunnel destinations to managed endpoints via an endpoint profile update.