Technical Tip: A solution of the error 'ZTNA Traffic denied because HTTP url failed to match an API-gateway with vhost name'

Description

This article describes a solution to fix the ZTNA access-proxy issue when using SAML authentication. Indeed, the ZTNA traffic log shows an error 'ZTNA Traffic denied because HTTP url failed to match an API-gateway with vhost name', after upgraded FortiOS firmware from v7.6.0 to v7.6.2.

These configurations worked well in v7.6.0 but did not work anymore after upgrading to v7.6.2 or later:

"...



config firewall vip

edit "ZTNA"

set uuid 5d30cc8a-fce5-51f0-b58e-c193ba498dcb

set type access-proxy

set server-type https

set extip X.X.X.X

set extintf "any"

set extport 10543

set ssl-certificate "SSL_cert_here"

next

end

...

config firewall access-proxy

edit "ZTNA_server"

set vip "ZTNA"

config api-gateway

edit 1

set url-map "/tcp"

set service tcp-forwarding

config realservers

edit 1

set address "SwitchSG350"

set mappedport 22 443

end

end

..."

Scope

 FortiOS v7.6.1 or later.

Solution

The issue happens due to the change from FortiOS v7.6.1 onward, when FortiGate Firewall will implicitly create a virtual-host with the domain defined in the SAML server configurations. It requires defining access-proxy-virtual-host and define it in the API Gateway of ZTNA access-proxy to work again:

"...

config firewall access-proxy

edit "ZTNA-EMS-Azure"

set vip "ZTNA-EMS-Azure"

config api-gateway

edit 1

set url-map "/tcp"

set service tcp-forwarding

set virtual-host "new_VH"

config realservers

edit 1

set address "SwitchSG350"

set mappedport 22 443

end

end

...

config firewall access-proxy-virtual-host

edit "new_VH"

set ssl-certificate "SSL_cert_here"

set host "FQDN_in_FortiClient_ZTNA_Destination"

next

end

..."