Create a new Zero Trust Network Access (ZTNA) rule
A ZTNA rule is a proxy policy used to enforce access control. ZTNA tags or tag groups can be defined to enforce zero trust role-based access. Security profiles can be configured to protect this traffic.
|
You must enable the visibility of this feature in Policy & Objects before it can be configured. To toggle feature visibility, go to Policy & Objects > Tools > Feature Visibility, and add or remove a checkmark for the corresponding feature. |
To configure a ZTNA rule:
- If using ADOMs, ensure that you are in the correct ADOM.
- Go to Policy & Objects > Policy Packages.
- In the tree menu for the policy package in which you will be creating the new policy, select ZTNA Rules.
- Click Create New.
- Enter the following information:
Option
Description
Name
Enter a unique name for the policy. Each policy must have a unique name.
Incoming Interface
Click the field then select interfaces.
Click the remove icon to remove interfaces.
New objects can be created by clicking the Create New icon in the Object Selector frame. See Create a new object for more information.
Source
Select source addresses, address groups, virtual IPs, virtual IP groups, users, and user groups.
ZTNA Tag
Select the ZTNA tags and tag groups that are allowed access. See Zero Trust Network Access (ZTNA) objects.
Match ZTNA Tags
Select Any to match one or more tags or All to match all tags.
ZTNA Server
Select a ZTNA server. See Configuring a ZTNA server.
Destination
Select destination addresses, address groups, virtual IPs, and virtual IP groups.
Schedule
Select a one-time schedule, recurring schedule, or schedule group.
Action
Select an action for the policy to take: DENY or ACCEPT.
Log Violation Traffic
Turn violation logging on or off.
Comments
Add a description of the policy, such as its purpose, or the changes that have been made to it. Advanced Options
Configure advanced options, see Advanced options below.
For more information on advanced option, see the FortiOS CLI Reference.
Change Note
Add a description of the changes being made to the policy. This field is required. - Click OK to create the policy. You can select to enable or disable the policy in the right-click menu. When disabled, a disabled icon will be displayed in the Seq.# column to the left of the number. By default, policies will be added to the bottom of the list, but above the implicit policy.
Advanced options
|
Option |
Description |
Default |
|---|---|---|
|
block-notification |
Enable or disable block notification. |
disable |
|
decrypted-traffic-mirror |
Select a decrypted traffic mirror. |
none |
|
device-ownership |
Enable or disable ownership enforcement at the policy level. |
disable |
|
disclaimer |
Disable or select where to display the web proxy disclaimer. |
disable |
|
dlp-profile |
Select an existing data leak prevention (DLP) profile. |
none |
|
dstaddr-negate |
Enable to negate the destination IP address. |
disable |
|
dstintf |
Select destination interfaces. |
none |
|
global-label |
Enter a global label for this policy for use in the GUI. |
none |
|
internet-service |
Enable or disable the use of internet services for this policy. If enabled, the destination address and service set in the policy are not used. |
disable |
|
internet-service-custom |
Select a custom internet service. |
none |
|
internet-service-custom-group |
Select a custom internet service group. |
none |
|
internet-service-group |
Select an internet service group. |
none |
|
internet-service-name |
Select an internet service. |
none |
|
internet-service-negate |
Enable to negate the internet service set in the policy. |
disable |
|
label |
Enter a VDOM-specific label for this policy for use in the GUI. |
none |
|
logtraffic-start |
Enable or disable policy log traffic start. |
disable |
|
poolname |
Select the IP pool object. |
none |
|
redirect-url |
Set the URL to which users are redirected after seeing and accepting the disclaimer or authenticating. |
none |
|
replacemsg-override-group |
Select the authentication message override group. |
none |
|
sctp-filter-profile |
Select an existing SCTP filter profile. |
none |
|
service |
Select services. |
none |
|
service-negate |
Enable or disable negation of the service set in the policy. |
disable |
|
session-ttl |
Enter a value for the session time-to-live (TTL), in seconds, from 300 to 604800, or type 0 for no limitation. |
0 |
|
srcaddr-negate |
Enable or disable negation of the source address. |
disable |
|
ssh-filter-profile |
Select an SSH filter profile from the drop-down list. |
None |
|
ssh-policy-redirect |
Enable or disable SSH policy redirect. |
disable |
|
transparent |
Enable or disable connection using the client IP address. |
disable |
|
uuid |
Enter the universally unique identifier (UUID). This value is automatically assigned but can be manually reset. |
00000000-0000- 0000-0000- 000000000000 |
|
webcache |
Enable or disable web cache (IPv4 only). |
disable |
|
webcache-https |
Enable or disable the web cache for HTTPS (IPv4 only). |
none |
|
webproxy-forward-server |
Select the webproxy forward server (IPv4 only). |
none |
|
webproxy-profile |
Select the webproxy profile (IPv4 only). |
none |