ZTNA traffic is allowed by the correct policy, however, it is terminated at FortiGate.
FGT_2 # diagnose debug reset FGT_2 # diagnose debug flow filter addr 10.7.7.9 FGT_2 # diagnose debug flow filter port 3389 FGT_2 # diagnose debug flow show function enable FGT_2 # diagnose debug flow show iprope enable FGT_2 # diagnose debug flow trace start 999 FGT_2 # diagnose debug enable FGT_2 # id=65308 trace_id=1 func=print_pkt_detail line=5920 msg="vd-root:0 received a packet(proto=6, 10.7.7.9:51070->10.7.7.4:3389) tun_id=0.0.0.0 from port1. flag [S], seq 246806623, ack 0, win 64240"
id=65308 trace_id=1 func=init_ip_session_common line=6110 msg="allocate a new session-0001edf9"
id=65308 trace_id=1 func=iprope_dnat_check line=5480 msg="in-[port1], out-[]"
id=65308 trace_id=1 func=iprope_dnat_tree_check line=824 msg="len=0"
id=65308 trace_id=1 func=iprope_dnat_check line=5505 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
id=65308 trace_id=1 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=80000000 gw-0.0.0.0 via root"
id=65308 trace_id=1 func=iprope_access_proxy_check line=458 msg="in-[port1], out-[], skb_flags-02000000, vid-0"
id=65308 trace_id=1 func=__iprope_check line=2404 msg="gnum-100017, check-ffffffffa002c9f7"
id=65308 trace_id=1 func=__iprope_check_one_policy line=2140 msg="checked gnum-100017 policy-9, ret-matched, act-accept"
id=65308 trace_id=1 func=__iprope_user_identity_check line=1903 msg="ret-matched"
id=65308 trace_id=1 func=__iprope_check_one_policy line=2374 msg="policy-9 is matched, act-accept"
id=65308 trace_id=1 func=__iprope_check line=2421 msg="gnum-100017 check result: ret-matched, act-accept, flag-08810000, flag2-00000000"
id=65308 trace_id=1 func=iprope_policy_group_check line=4902 msg="after check: ret-matched, act-accept, flag-08810000, flag2-00000000"
id=65308 trace_id=1 func=iprope_access_proxy_check line=470 msg="in-[port1], out-[] matched ztna pol."
id=65308 trace_id=1 func=ip_session_confirm_final line=3128 msg="npu_state=0x0, hook=1"
Running packet capture on the client machine, the error 'bad certificate' is observed:
Checking the ZTNA profile on EMS, the option 'Enforce Valid Server Certificate' is enabled. With this enabled, FortiGate is required to have a valid certificate and must be signed by a public CA or the one shared through the system setting profile component.
Disable the option 'Enforce Valid Server Certificate' and test again.
On the scenario above, the output of the wad debugs will show the following errors: diagnose wad debug enable category all
diagnose wad debug enable level verbose
diagnose wad filter src 157.x.x.x <----- Source IP of endpoint public IP on EMS portal. diagnose debug enable [I] [p:2279][s:110520844] wad_vs_ssl_port_caps_c2p_on_client_hello:10750 15961:ZTNA-tcp-server.: wsp(0x7f8d15345048) handshake recv ClientHello record 3.1 cli
ent 3.3 supported 3.3
[V] [p:3471][s:75723206] wad_vs_proxy_match_vhost :4414 15961:ZTNA-tcp-server.: matching vhost by: x.x.x.x
[V] [p:3471][s:75723206] wad_vs_matcher_map_find :764 Empty matcher!
[V] [p:3471][s:75723206] wad_vs_proxy_match_vhost :4417 15961:ZTNA-tcp-server.: no host matched.
[I] [p:3471][s:75723206] wad_elliptic_curve :3351 found elliptic curve 25 ... [I][p:3471][s:75723206] wad_tcp_port_on_event :1906 start processing tcp event=0x1 events=0x1 fd=12
5 n_out_block=0 state=2 close/shut=0/0 n_out_block=0
[I][p:3471][s:75723206] wad_tcp_port_on_read :1782 sock 125 read (193,3887)
[3471] read [(193,7) (15 03 03 00 02 02 2a )(......*)]
[V][p:3471][s:75723206] wad_ssl_sock_port_in_ops_read_buff:16587 sp=0x7ff83e42f798/10 len=7
[V][p:3471][s:75723206] wad_ssl_sock_port_in_ops_sync :16597 sp=0x7ff83e42f798/10 sync state=1 start
[V][p:3471][s:75723206] wad_ssl_sock_port_exec_up_forward :16270 sp=0x7ff83e42f798/10
[I][p:3471][s:75723206] wad_ssl_sock_port_exec_up_forward_txn:16251 sp=0x7ff83e42f798/10 forwarded len=7/200
[V][p:3471][s:75723206] wad_ssl_port_caps_on_dec_start :15075 sp=0x7ff83e42f798/10 dec start 0x7ff84142d428 t
ype 21 ver 0303 len 2 (02 2a )
[V][p:3471][s:75723206] wad_ssl_port_caps_on_dec_done :15100 sp=0x7ff83e42f798/10 dec done 0x7ff84142d428 ty
pe 21 ver 0303 status 0 len 2 (02 2a )
[I][p:3471][s:75723206] wad_vs_ssl_port_caps_on_alert_recv:12104 fts recv alert level=2 desc=bad certificate
[I][p:3471][s:75723206] wad_ssl_app_port_fts_in_close :17477 sp=0x7ff83e42f798/10 recv close request from ft
s close-type=0 closed=0 Related articles: Technical Tip: Using the 'diagnose wad debug' command to troubleshoot Explicit Web Proxy related issues Technical Tip: ZTNA TCP forwarding access proxy | 
