Technical Tip: Block access to ZTNA clientless portal

Description

This article describes the steps to block access to the ZTNA Clientless portal. This can be useful when administrators need to apply geo-restrictions or block malicious IP addresses from loading the Web portal.

Scope

FortiOS v7.6+, v8.0+.

Solution

This article assumes that ZTNA clientless access is already configured as per the steps described in Technical Tip: How to configure Agentless ZTNA with FortiGate v7.6.

The following VIP will be used as the example:

config firewall vip
    edit "ZTNA_PROXY"
        set uuid d365ced4-7ba0-51f1-4f96-a2bfd22c8236
        set type access-proxy
        set server-type https
        set extip 10.9.11.209
        set extintf "any"
        set client-cert disable
        set extport 443
        set ssl-certificate "Wilcard2026"
    next
end

Create an address group containing the IP addresses that need to be blocked. The group can contain geography objects, individual IPs or subnets. For this example, a geography objects will be used to block the country of Monaco and Subnet object will be used to block the individual IP 172.25.181.121.

config firewall address
    edit "172.25.181.121"
        set subnet 172.25.181.121 255.255.255.255
    next
end

config firewall address
    edit "GEO-Monaco"
        set type geography
        set country "MC"
    next
end

config firewall addrgrp
    edit "ZTNA_Blocked"
        set member "GEO-Monaco" "172.25.181.121"
    next
end

To restrict access to the ZTNA clientless portal a regular firewall policy must be configured with 'config firewall policy' and the VIP must be referenced as the dstaddr. This policy can only be configured via CLI:

config firewall policy
    edit 0
        set name "Test DENY"
        set uuid 1b8b8188-aac5-51f1-9e92-3868d873c1d7
        set srcintf "wan1"
        set dstintf "wan1"
        set srcaddr "ZTNA_Blocked"
        set dstaddr "ZTNA_PROXY"
        set schedule "always"
        set logtraffic all
    next
end

Note:

The following error may be encountered when selecting the VIP as dstaddr.

FG-LAB (0) # set dstaddr "ZTNA_PROXY"
entry not found in datasource

value parse error before 'ZTNA_PROXY'
Command fail. Return code -3

This error occurs because an access-proxy VIP can only be set as a firewall-policy dstaddr if it's already bound to a firewall access-proxy object. This restriction does not apply in FortiOS v8.0.

If there are no acess-proxy objects in the configuration, a dummy one can be configured:

config firewall address
    edit "DummyObjectZTNA"
        set type fqdn
        set fqdn "fortinet.com"
    next
end

config firewall access-proxy
    edit "ZTNA_PROXYDummyObjectt"
        set vip "ZTNA_PROXY"
        config api-gateway
            edit 1
                set url-map "/tcp"
                set service tcp-forwarding
                config realservers
                    edit 1
                        set address "DummyObjectZTNA"
                    next
                end
            next
        end
    next
end

After this the policy can be configured:

config firewall policy
    edit 0
        set name "Test DENY"
        set srcintf "wan1"
        set dstintf "wan1"
        set srcaddr "ZTNA_Blocked"  
        set dstaddr "ZTNA_PROXY" 
        set schedule "always"
        set logtraffic all
    next
end

Results:

A debug flow will show that the traffic from the blocked ip address 172.25.181.121 is being denied:

diagnose debug flow filter saddr 172.25.181.121
diagnose debug flow filter daddr 10.9.11.209
diagnose debug console timestamp enable
diagnose debug enable
diagnose debug flow trace start 10

FG-LAB # 2026-09-09 11:17:08 id=65308 trace_id=3 func=print_pkt_detail line=6393 msg="vd-root:0 received a packet(proto=6, 172.25.181.121:6401->10.9.11.209:443) tun_id=0.0.0.0 from port1. flag [S], seq 1817739918, ack 0, win 65535"
2026-09-09 11:17:08 id=65308 trace_id=3 func=init_ip_session_common line=6607 msg="allocate a new session-0018bf33"
2026-09-09 11:17:08 id=65308 trace_id=3 func=__vf_ip_route_input_rcu line=2116 msg="find a route: flag=80000000 gw-0.0.0.0 via root"
2026-09-09 11:17:08 id=65308 trace_id=3 func=fw_local_in_handler line=579 msg="ZTNA denied."