Fortinet black logo

Administration Guide

FQDN-based ZTNA TCP forwarding services

FQDN-based ZTNA TCP forwarding services

FortiClient supports using fully qualified domain names (FQDN) as destination hosts in zero trust network access TCP forwarding rules. This allows you to avoid exposing private/internal IP addresses to end users by using FQDNs instead.

The following shows the topology for this example. This example uses two FQDNs, rdp.win.test and ssh.win.test, in place of the Windows server IP address, 10.8.24.100. This hides the internal IP address, 10.8.24.100, from end users.

To configure FortiOS:
  1. In FortiOS, go to Policy & Objects > ZTNA > ZTNA Servers.
  2. Click Create New.
  3. For Type, select IPv4.
  4. For Service, select TCP Forwarding.
  5. Under Servers, configure RDP and SSH services.

  6. Click OK.
  7. In the CLI, add the rdp.win.test FQDN to RDP and SSH services as the domain:
    config firewall access-proxy
        edit "ZTNA-test"
            set vip "ZTNA-test"
            set client-cert enable
            config api-gateway
                edit 2
                    set url-map "/tcp"
                    set service tcp-forwarding
                    config realservers
                        edit 1
                            set address "internal_server"
                            set domain "rdp.win.test"
                            set mappedport 3389 
                        next
                        edit 2
                            set address "ssh_test"
                            set domain "ssh.win.test"
                            set mappedport 22 
                        next
                    end
                next
            end
        next
    end
  8. Ensure that you have configured the ZTNA policy rule and firewall policy as desired.
To configure ZTNA rules:
  1. You can configure ZTNA rules from FortiClient or EMS. If using FortiClient, connect to the EMS that is connected to the FortiGate acting as the TCP forwarding server.
  2. Do one of the following:
    1. If using FortiClient, go to ZTNA Connection Rules.
    2. If using EMS, go to Endpoint Profiles > ZTNA Connection Rules.
  3. Create the RDP server rule:
    1. Click Add Rule.
    2. In the Rule Name field, enter the desired name.
    3. In the Destination Host field, enter rdp.win.test:<port number>.
    4. In the Proxy Gateway field, enter the FortiGate IP address and port number. In this example, it is 172.17.81.250:8443.
    5. Click Create.

  4. Create the SSH server rule:
    1. Click Add Rule.
    2. In the Rule Name field, enter the desired name.
    3. In the Destination Host field, enter ssh.win.test:<port number>.
    4. In the Proxy Gateway field, enter the FortiGate IP address and port number. In this example, it is 172.17.81.250:8443.
    5. Click Create.

FQDN-based ZTNA TCP forwarding services

FortiClient supports using fully qualified domain names (FQDN) as destination hosts in zero trust network access TCP forwarding rules. This allows you to avoid exposing private/internal IP addresses to end users by using FQDNs instead.

The following shows the topology for this example. This example uses two FQDNs, rdp.win.test and ssh.win.test, in place of the Windows server IP address, 10.8.24.100. This hides the internal IP address, 10.8.24.100, from end users.

To configure FortiOS:
  1. In FortiOS, go to Policy & Objects > ZTNA > ZTNA Servers.
  2. Click Create New.
  3. For Type, select IPv4.
  4. For Service, select TCP Forwarding.
  5. Under Servers, configure RDP and SSH services.

  6. Click OK.
  7. In the CLI, add the rdp.win.test FQDN to RDP and SSH services as the domain:
    config firewall access-proxy
        edit "ZTNA-test"
            set vip "ZTNA-test"
            set client-cert enable
            config api-gateway
                edit 2
                    set url-map "/tcp"
                    set service tcp-forwarding
                    config realservers
                        edit 1
                            set address "internal_server"
                            set domain "rdp.win.test"
                            set mappedport 3389 
                        next
                        edit 2
                            set address "ssh_test"
                            set domain "ssh.win.test"
                            set mappedport 22 
                        next
                    end
                next
            end
        next
    end
  8. Ensure that you have configured the ZTNA policy rule and firewall policy as desired.
To configure ZTNA rules:
  1. You can configure ZTNA rules from FortiClient or EMS. If using FortiClient, connect to the EMS that is connected to the FortiGate acting as the TCP forwarding server.
  2. Do one of the following:
    1. If using FortiClient, go to ZTNA Connection Rules.
    2. If using EMS, go to Endpoint Profiles > ZTNA Connection Rules.
  3. Create the RDP server rule:
    1. Click Add Rule.
    2. In the Rule Name field, enter the desired name.
    3. In the Destination Host field, enter rdp.win.test:<port number>.
    4. In the Proxy Gateway field, enter the FortiGate IP address and port number. In this example, it is 172.17.81.250:8443.
    5. Click Create.

  4. Create the SSH server rule:
    1. Click Add Rule.
    2. In the Rule Name field, enter the desired name.
    3. In the Destination Host field, enter ssh.win.test:<port number>.
    4. In the Proxy Gateway field, enter the FortiGate IP address and port number. In this example, it is 172.17.81.250:8443.
    5. Click Create.