Environment:
Refer to the documentation in ZTNA support for UDP traffic for more information about this feature that is not working as expected with an IPsec tunnel ZTNA Access proxy for UDP traffic.
In this scenario:
FortiGate is running FortiOS v7.6.5 or v7.6.6. A ZTNA access-proxy deployment is in place with UDP-based DNS resolution. An IPsec policy is configured with SNAT enabled and an IP pool assigned.
Traffic flow:
User --- ZTNA access-proxy WAN [FortiGate] --- IPsec tunnel --- DNS server 10.10.10.1.
config firewall ippool
edit "ZTNA-POOL"
set startip 172.16.10.1
set endip 172.16.10.1
next
end
config firewall proxy-policy
edit 1
set uuid 2ddae2e8-d744-51f0-c294-11f1ac9a1921
set name "ZTNA_TEST"
set proxy access-proxy
set access-proxy "ZTNA-SERVER-11389"
set srcintf "any"
set srcaddr "all"
set poolname "ZTNA-POOL"
set dstaddr "DNS_server"
set ztna-ems-tag "MAC_EMS1_ZTNA_admin" "EMS1_ZTNA_IT_Network"
set action accept
set schedule "always"
set logtraffic all
next
end
Observed behavior:
DNS traffic is forwarded through the IPsec tunnel as expected. However, the source IP address remains 14.10.10.1. The traffic should be source NATed using the configured IP pool address 172.16.10.1.
As a result, the expected SNAT translation is not occurring for the ZTNA access-proxy traffic.
Refer to the PCAP output on the IPsec side:
Frame 121: 83 bytes on wire (664 bits), 83 bytes captured (664 bits)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol Version 4, Src: 149.242.225.90, Dst: 10.124.19.60
User Datagram Protocol, Src Port: 7731, Dst Port: 53
Domain Name System (query)
Transaction ID: 0x0004
Flags: 0x0100 Standard query
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 0
Queries
abdlab.net: type A, class IN
Name: abdlab.net
[Name Length: 23]
[Label Count: 4]
Type: A (1) (Host Address)
Class: IN (0x0001)
Expected behavior:
Traffic matching the IPsec policy should have its source IP translated to the configured IP pool address (172.16.10.1) before being forwarded through the IPsec tunnel.
This issue has been fixed from FortiOS v7.6.7 onwards.
| 
