Technical Tip: ZTNA TCP forwarding access proxy

Description

This article describes a ZTNA access proxy configuration example.

Scope

FortiOS, FortiClient.

Solution

This article focuses on a TCP forwarding access proxy configured for RDP connections.

For the HTTP/HTTPS access-proxy traffic, appropriate services should be configured on ZTNA-Server settings.

Network diagram:

 
In this example, FortiGate has a successful connection with FortiClient EMS, and ZTNA tags are synced to the FortiGate.

FortiClient EMS is deployed on the Windows Server and the same server has port 3389 open for the RDP connection.

Configuration details:
On FortiGate, navigate to Policy & Objects -> ZTNA -> ZTNA Server and configure the access proxy VIP for the RDP access:

To configure the mapped port and TCP forwarding to the access proxy VIP, edit Service/Server mapping and configure the settings as follows. Note: If a mapped port is not defined for the real servers, any port will be matched.

Configuration of access proxy in the CLI:

config firewall vip
    edit "RDP"
        set uuid c961eb5a-cba8-51f0-0bd0-83f230f0c5cd
        set type access-proxy
        set server-type https
        set extip 10.109.22.118
        set extintf "port2"
        set extport 8443
        set ssl-certificate "Fortinet_Factory"
    next
end

config firewall access-proxy
    edit "RDP"
        set vip "RDP"
            config api-gateway
                edit 1
                    set url-map "/tcp"
                    set service tcp-forwarding
                        config realservers
                            edit 1
                                set address "Internal RDP"
                                set mappedport 3389 
                            next
                        end
                next
            end
    next
end

The address object for the forwarding server is configured as follows:

Here, a proxy firewall policy with type 'ZTNA' is configured, defining the ZTNA server and destination as the real server address, with ZTNA tags enforced. Simple ZTNA firewall policies also could be configured - Full versus simple ZTNA policies.

Multiple ZTNA tags can be defined with 'AND'/'OR' operations on the proxy policy by enabling the following setting from the CLI, or by enabling it in the GUI by selecting 'Security Posture Tag: Any/All':

<set ztna-tags-match-logic and | or> 

On the FortiClient, ZTNA destinations are configured as follows:

On the client PC, navigate to RDP and open the connection for the internal server IP. A successful connection will provide RDP access.

Logs for the successful RDP connection:

Debugging: WAD debug logs can generate too much output and debug lines. It is highly recommended to use as many filters as possible that can narrow down the logs generated by the WAD daemon.

diagnose debug disable
diagnose debug reset
diagnose wad filter clear
diagnose debug console time enable
diagnose wad filter src x.x.x.x
diagnose wad filter dport xxx
diagnose wad debug enable category all 
diagnose wad debug enable level verbose
diagnose wad filter list 
diagnose wad debug show 
diagnose debug enable

In the example above, note that 'src x.x.x.x' is the client IP address, and 'dport xxx' is the destination port in ZTNA configuration.

To stop WAD debugging:

diagnose debug disable
diagnose wad filter clear 
diagnose debug reset