A tunnel-mode SSL VPN portal has split tunnelling disabled. A remote client connects, authenticates, and receives an address from the tunnel pool. How is the client's traffic routed while the tunnel is up?
- AOnly traffic destined for the configured internal routing addresses crosses the tunnel; all other traffic uses the client's local default gateway.
- BAll of the client's traffic, including general internet browsing, is sent through the tunnel to the FortiGate for forwarding and inspection. Correct
- CInternal traffic crosses the tunnel while DNS queries alone are sent to the client's local resolver to speed up name lookups.
- DTraffic is load-balanced between the tunnel and the local gateway based on which path reports lower latency at connect time.
Why A is wrong: Tempting because this is exactly what split tunnelling does, but it describes split tunnelling ENABLED, the opposite of the disabled state in the stem.
Why B is correct: Correct: with split tunnelling disabled the client installs a default route over the tunnel interface, so every destination including the internet is carried to the FortiGate (full tunnel).
Why C is wrong: Tempting because split-DNS sounds related, but DNS handling is a separate setting and does not define the full-tunnel routing behaviour described here.
Why D is wrong: Tempting because it sounds like an optimisation, but SSL VPN tunnel mode performs no such per-path load balancing; the split tunnel setting alone decides what enters the tunnel.