ZTNA service connector NEW
In certain environments, we may want to prevent users from accessing the FortiGate ZTNA access proxy directly or expose ports and services on the FortiGate to the public. In these scenarios, another layer of ZTNA proxy may be required to serve as the ZTNA Edge.
The FortiGate can act as a ZTNA service connector to reverse proxy service connections upstream to the ZTNA Edge. In this scenario, the ZTNA Edge may be a FortiPAM or FortiProxy which acts as the ZTNA access proxy to the end users. The FortiGate, as the ZTNA service connector, forms a persistent control connection with ZTNA Edge. The ZTNA Edge forwards connection requests through the control tunnel to the FortiGate ZTNA service connector, which proxies the request to the protected server.
The ZTNA Edge in this scenario completes the ZTNA checks and enforces the ZTNA policy. If the connection is allowed, the request is forwarded to the ZTNA service connector.
The ZTNA service connector is responsible for proxying the connection and establishing a data connection back to the ZTNA Edge to forward the response. This effectively forms a proxy chain where the FortiGate service connector provides reverse proxy connection back to the ZTNA Edge.
Usage
CLI syntax
The following CLI settings configure the connection with the ZTNA Edge:
config ztna reverse-connector
edit <name>
set address <IP or FQDN address>
set port <port number>
set certificate <local certificate>
set trusted-server-ca <CA certificate>
next
end
|
Field |
Description |
|---|---|
|
address <IP or FQDN address> |
Address of the ZTNA Edge |
|
port <port number> |
The port number for connecting to the ZTNA Edge |
|
certificate <local certificate> |
The local client certificate used for mTLS negotiation |
|
trusted-server-ca <CA certificate> |
The root CA certificate to authenticate the mTLS connection |
GUI settings
-
Go to System > Feature Visibility and enable Zero Trust Network Access and ZTNA Reverse Proxy Connector.
-
Go to Policy & Objects > ZTNA and select the Traffic Forwarding tab.
-
Select the Reverse Proxy Connector sub-menu and click Create New.
-
Configure the following, then click OK:
Field
Description
Name
Name of the connector
Address
IP or FQDN Address of the ZTNA Edge
Port
The port number for connecting to the ZTNA Edge
CA certificate
The root CA certificate to authenticate the mTLS connection
Default certificate
The local client certificate used for mTLS negotiation
Example
In the example topology shown in the introduction, we will configure a TCP forwarding destination on the FortiGate service connector to allow RDP connection to the Server (172.18.62.213). We will also configure a ZTNA reverse-connector to connect to the upstream FortiPAM.
The FortiPAM will follow the FortiPAM server (ZTNA Edge) configuration as illustrated in the Configuring FortiPAM/FortiGate as reverse gateway example. We will configure a secret on the FortiPAM server to allow users to RDP into the Server.
Alternatively, if deploying using a FortiProxy on the ZTNA Edge, follow the FortiProxy as reverse proxy to service connector example in the FortiProxy admin guide.
To configuring the reverse proxy connection in the FortiOS GUI:
-
Go to System > Feature Visibility and enable Zero Trust Network Access and ZTNA Reverse Proxy Connector.
-
Go to Policy & Objects > ZTNA and select the Traffic Forwarding tab.
-
Select the Reverse Proxy Connector sub-menu and click Create New.
-
Configure the following:
Field
Description
Name
Fpam
Address
172.16.200.234
Port
8443 CA certificate
CSF_CA_Cert_2 Default certificate
mTLS_rev_conn -
Click OK
To configure the ZTNA reverse-connector in the FortiOS CLI:
config ztna reverse-connector
edit "fpam"
set address "172.16.200.234"
set port 8443
set certificate "mTLS_rev_conn"
set trusted-server-ca "CSF_CA_Cert__2"
next
end
To configure the TCP forwarding proxy, destination, and rules in the FortiOS CLI:
config firewall vip
edit "vip"
set type access-proxy
set server-type https
set extip 10.1.100.2
set extintf "port2"
set client-cert disable
set extport 4443
set ssl-certificate "Fortinet_SSL"
next
end
config ztna traffic-forward-proxy
edit "ztfp"
set vip "vip"
next
end
config firewall address
edit "to_server_214"
set subnet 172.18.62.214 255.255.255.255
next
end
config ztna destination
edit "RDP_214"
set address "to_server_214"
set mappedport 3389
next
end
config firewall proxy-policy
edit 1
set proxy ztna-proxy
set ztna-proxy "ztfp"
set ztna-destination "RDP_214"
set srcintf "any"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set logtraffic all
set srcaddr6 "all"
set dstaddr6 "all"
set utm-status enable
set profile-protocol-options "protocol"
next
end
To configure the FortiPAM ZTNA Edge:
-
On the FortiPAM, go to Network > Secret Gateway > Reverse Service.
-
Enable the service and enter the server settings.
-
Click Save.
-
Under Network > Secret Gateway, create a new Gateway.
-
Enter the settings below and input the FortiGate VIP address to identify the desired gateway.
For the Gateway ID, enter the CN string from the FortiGate client certificate (mTLS_rev_conn in this example).
-
Save and view the Gateway from the Gateway List.
-
Go to Secrets > Targets and define a Target using this Gateway. Enter the address of the Server as the Domain-Controller and select the Gateway that was created earlier.
-
Go to Secrets > Secrets and define a Secret using this Target.
-
Save the settings.
To access the server through RDP:
On the Windows Client, you can login to the FortiPAM as a user, then access a secret from the FortiPAM portal. The client itself will not directly connect to the server itself. In fact, the FortiPAM will not initiate a connection to the server or the ZTNA service connector. It is the FortiGate ZTNA service connector which initiates the control channel and data channel to the FortiPAM to facilicate the communications.
On the client, use the Web RDP button from the FortiPAM GUI to RDP to the server.
