Basic ZTNA configuration

To deploy a ZTNA access proxy, configure the following components on the FortiGate:

1. Configure a FortiClient EMS connector

2. Configure a ZTNA server

3. Configure a ZTNA rule

4. Optional authentication

To configure ZTNA in the GUI, go to System > Feature Visibility and enable Zero Trust Network Access.

Configure a FortiClient EMS connector

To add an on-premise FortiClient EMS server in the GUI:

1. Go to Security Fabric > Fabric Connectors.

2. Click Create New and click FortiClient EMS.

3. Enter a name for the connector and the IP address or FQDN of the EMS.

4. Click OK.

5. A window appears to verify the EMS server certificate. Click Accept.

   See FortiClient EMS for more information.

To add an on-premise FortiClient EMS server in the CLI:

config endpoint-control fctems
    edit <name>
        set server <server IP or domain>
    next
end

To add FortiClient EMS Cloud in the GUI:

1. Go to Security Fabric > Fabric Connectors.
2. Double-click FortiClient EMS to open it for editing.
3. Set Type to FortiClient EMS Cloud.
4. Enter a name for the connector.
5. Click OK. A window appears to verify the EMS server certificate.
6. Click Accept.

   See FortiClient EMS for more information.

To add FortiClient EMS Cloud in the CLI:

config endpoint-control fctems
    edit <name>
        set fortinetone-cloud-authentication enable
        set certificate <string>
    next
end

ZTNA tags

After the FortiGate connects to the FortiClient EMS, it automatically synchronizes ZTNA tags. ZTNA tags are generated from tagging rules configured on the FortiClient EMS. These tagging rules are based on various posture checks that can be applied on the endpoints. See Endpoint Posture Check Reference.

To view the synchronized ZTNA tags in the GUI:

1. Go to Policy & Objects > ZTNA and select the ZTNA Tags tab.

2. Hover the cursor over a tag name to view more information about the tag, such as its resolved addresses.

   

To create a ZTNA tag group in the GUI:

1. Go to Policy & Objects > ZTNA and select the ZTNA Tags tab.

2. Click Create New Group.

3. Enter a name for the group and select the group members.

   

4. Click OK.

To view the synchronized ZTNA tags in the CLI:

# diagnose firewall dynamic address
# diagnose firewall dynamic list

To create a ZTNA tag group in the CLI:

config firewall addrgrp
    edit <group name>
        set category ztna-ems-tag
        set member <members>
    next
end

Configure a ZTNA server

To configure a ZTNA server, define the access proxy VIP and the real servers that clients will connect to. The access proxy VIP is the FortiGate ZTNA gateway that clients make HTTPS connections to. The service/server mappings define the virtual host matching rules and the real server mappings of the HTTPS requests.

To create a ZTNA server for HTTPS access proxy in the GUI:

1. Go to Policy & Objects > ZTNA and select the ZTNA Servers tab.

2. Click Create New.

3. Enter a name for the server.

4. Select an external interface, enter the external IP address, and select the external port that the clients will connect to.

5. Select the Default certificate. Clients will be presented with this certificate when they connect to the access proxy VIP.

   

6. Add server mapping:

   1. In the Service/server mapping table, click Create New.

   2. Set Service to HTTPS.

   3. Set Virtual Host to Any Host or Specify.

      • Any Host: Any request that resolves to the access proxy VIP will be mapped to your real servers. For example, if both www.example1.com and www.example2.com resolve to the VIP, then both requests are mapped to your real servers.

      • Specify: Enter the name or IP address of the host that the request must match. For example, if www.example1.com is entered as the host, then only requests to www.example1.com will match.

   4. Configure the path as needed.

      The path can be matched by substring, wildcard, or regular expression. For example, if the virtual host is specified as www.example1.com, and the path substring is map1, then www.example1/map1 will be matched.

      

   5. If multiple servers will be configured, enable Load balancing and select an algorithm.

   6. Add a server:

      1. In the Servers table, click Create New.

      2. Enter the server IP address and port number.

      3. Set the server status.

      4. Click OK.

      5. Add more servers as needed.

   7. Click OK.

   8. Add more server mappings as needed.

7. Click OK.

To create a ZTNA server and access proxy VIP in the CLI:

1. Configure an access proxy VIP:

   config firewall vip
       edit <name>
           set type access-proxy
           set extip <external IP>
           set extintf <external interface>
           set server-type { https | ssh }
           set extport <external port>
           set ssl-certificate <certificate>
       next
   end
   

2. If the virtual host is specified, configure the virtual host:

   config firewall access-proxy-virtual-host
       edit <auto generated when configured from GUI>
           set ssl-certificate <certificate>
           set host <host name or IP>
           set host-type { sub-string | wildcard }
       next
   end
   

3. Configure the server and path mapping:

   config firewall access-proxy
       edit <name>
           set vip <vip name>
           set client-cert { enable | disable }
           set empty-cert-action { accept | block }
           set log-blocked-traffic {enable | disable}
           config api-gateway
               edit 1
                   set url-map <mapped path>
                   set service { http | https | tcp-forwarding | samlsp }
                   set virtual-host <name of virtual-host if specified>
                   set url-map-type { sub-string | wildcard | regex }
                   config realservers
                       edit 1
                           set addr-type ip
                           set ip <ip of real server>
                           set port <port>
                           set status { active | standby | disable }
                           set health-check { enable | disable }
                       next
                   end
                   set ldb-method static
                   set persistence none
                   set ssl-dh-bits 2048
                   set ssl-algorithm high
                   set ssl-min-version tls-1.1
                   set ssl-max-version tls-1.3
               next
           end
       next
   end
   

Configure a ZTNA rule

A ZTNA rule is a proxy policy used to enforce access control. ZTNA tags or tag groups can be defined to enforce zero trust role based access. Security profiles can be configured to protect this traffic.

To configure a ZTNA rule in the GUI:

1. Go to Policy & Objects > ZTNA and select the ZTNA Rules tab.

2. Click Create New.

3. Enter a name for the rule.

4. Select an Incoming Interface and Source.

5. Add the ZTNA tags or tag groups that are allowed access. If multiple tags are included, select the Match ZTNA Tags method, Any or All.

6. Select the ZTNA Server.

7. Select the Destination.

   

8. Configure the remaining options as needed.

9. Click OK.

To configure a ZTNA rule in the CLI:

config firewall proxy-policy
    edit 1
        set name <ZTNA rule name>
        set proxy access-proxy
        set access-proxy <access proxy>
        set srcintf <interface>
        set srcaddr "all"
        set transparent {enable | disable}
        set dstaddr "all"
        set ztna-ems-tag <ZTNA tag(s)>
        set ztna-tags-match-logic {or | and} 
        set action accept
        set schedule "always"
        set logtraffic all
        set poolname <ip_pool>
        set utm-status enable
        set ssl-ssh-profile <inspection profile>
    next
end

The transparent and poolname settings cannot be enabled at the same time. Use one setting at a time when configuring ZTNA rules.

Optional authentication

To configure authentication to the access proxy, you must configure an authentication scheme and authentication rule in the GUI or CLI. They are used to authenticate proxy-based policies, similar to configuring authentication for explicit and transparent proxy.

The authentication scheme defines the method of authentication that is applied. For ZTNA, basic HTTP and SAML methods are supported. Each method has additional settings to define the data source to check against. For example, with basic HTTP authentication, a user database can reference an LDAP server, RADIUS server, local database, or other supported authentication servers that the user is authenticated against.

The authentication rule defines the proxy sources and destinations that require authentication, and which authentication scheme to apply. For ZTNA, active authentication method is supported. The active authentication method references a scheme where users are actively prompted for authentication, like with basic authentication.

After the authentication rule triggers the method to authenticate the user, a successful authentication returns the groups that the user belongs to. In the ZTNA rule and proxy policy you can define a user or user group as the allowed source. Only users that match that user or group are allowed through the proxy policy.

To configure a basic authentication scheme:

config authentication scheme
    edit <name>
        set method basic
        set user-database <auth server>
    next
end

To configure an authentication rule:

config authentication rule
    edit <name>
        set status enable
        set protocol http
        set srcintf <interface>
        set srcaddr <address>
        set dstaddr <address>
        set ip-based enable
        set active-auth-method <active auth scheme>
    next
end

To apply a user group to a ZTNA rule in the GUI:

1. Go to Policy & Objects > ZTNA and select the ZTNA Rules tab.

2. Edit an existing rule, or click Create New to create a new rule.

3. Click in the Source field, select the User tab, and select the users and user groups that will be allowed access.

4. Configure the remaining settings as required.

5. Click OK.

To apply a user group to a ZTNA rule in the CLI:

config firewall proxy-policy
    edit <policy ID>
        set name <ZTNA rule name>
        set proxy access-proxy
        set access-proxy <access proxy>
        set srcintf <interface>
        set srcaddr "all"
        set dstaddr "all"
        set ztna-ems-tag <ZTNA tags>
        set ztna-tags-match-logic {or | and}
        set action accept
        set schedule "always"
        set logtraffic all
        set groups <user group>
        set utm-status enable
        set ssl-ssh-profile <inspection profile>
    next
end

The authentication rule and scheme defines the method used to authenticate users. With basic HTTP authentication, a sign in prompt is shown after the client certificate prompt. After the authentication passes, the returned groups that the user is a member of are checked against the user groups that are defined in the ZTNA rule. If a group matches, then the user is allowed access after passing a posture check.

For basic setup information, see ZTNA HTTPS access proxy with basic authentication example.

For advanced setup information, see ZTNA proxy access with SAML authentication example and ZTNA access proxy with SAML and MFA using FortiAuthenticator example.

HTTP access proxy vs TCP forwarding access proxy

In an HTTP access proxy connection, there is no configurations needed on the client endpoint. Users can simply access the HTTP website on a browser by entering its URL. For TCP forwarding access proxy, a ZTNA rule must be configured on the FortiClient endpoint. This rule instructs the FortiClient to listen to traffic to the destination address and port, and redirects the traffic to the FortiGate access proxy over HTTPS.

For more information, see:

• ZTNA TCP forwarding access proxy example

• ZTNA TCP forwarding access proxy without encryption example