Skip to main content
S
steven4
Explorer
May 4, 2026
Question

AGENTLESS ZTNA Tutorial

  • May 4, 2026
  • 37 replies
  • 408 views

Hello there,

can anyone suggest any other tutorial for agentless ZTNA rather than fortinet official documentation. I don’t understand it how to implement correctly. any video, documentation, guides, articles would be appreciated. 

37 replies

sjoshi
Staff
sjoshi
Staff
May 4, 2026

Hi ​@steven4 ,

 

Where are you setting up agentless ztna? Is it on fortigate or fortisase.

For FortiGate

https://docs.fortinet.com/document/fortigate/8.0.0/administration-guide/545125/ztna-agentless-web-based-application-access

https://docs.fortinet.com/document/fortigate/7.6.0/new-features/545125/ztna-agentless-web-based-application-access-7-6-1

 

For Fortisase

https://docs.fortinet.com/document/fortisase/latest/mature-administration-guide/329570/agentless-ztna

 

You can also follow the kb articles:

 

You can let me know if you are stuck in any step while configuring it

Thanks, Salon
    S
    steven4Author
    Explorer
    May 5, 2026

    Hello Sjoshi,

    thank you for the reply. I am doing it on fortigate vm. I have looked at those documentations and have done based on them. my problem is that ZTNA web portal is not accessible although the settings are pretty similar with the documentation. I am using local user database rather than ldap, radius or any other. 

     

    sjoshi
    Staff
    sjoshi
    Staff
    May 5, 2026

    Hi ​@steven4 

    Thanks for sharing the config via PM

    I will check it and let you know

    Thanks, Salon
      S
      steven4Author
      Explorer
      May 8, 2026

      ​@sjoshi any updates brother?

      sjoshi
      Staff
      sjoshi
      Staff
      May 8, 2026

      also collect HAR logs once. while accessing the page

      https://community.fortinet.com/fortigate-3/technical-tip-analyzing-website-access-issue-with-har-log-tools-175367

      Thanks, Salon
        S
        steven4Author
        Explorer
        May 8, 2026

        it shows cancelled. the site is taking longer to load. what i feel is that it is trying to render, but at the end it shows could not reach the page

        S
        steven4Author
        Explorer
        May 8, 2026

        I tried with both http and https

         

        S
        steven4Author
        Explorer
        May 8, 2026

        THIS IS MY CONFIGURATION
         

        FGVMEVYLSWRHYA98 # show firewall vip 
        config firewall vip
            edit "ZTNA-web-proxy"
                set uuid 65006b6c-42f6-51f1-97c1-5c559a60d09e
                set type access-proxy
                set server-type https
                set extip 192.168.173.132
                set extintf "port1"
                set client-cert disable
                set extport 15443
                set ssl-certificate "Fortinet_Factory"
                set ssl-algorithm high
                set ssl-min-version tls-1.2
            next
        end

        FGVMEVYLSWRHYA98 # show firewall access-proxy-virtual-host 
        config firewall access-proxy-virtual-host
            edit "ztna-portal-vh"
                set ssl-certificate "Fortinet_Factory"
                set host "portal.ztna.com"
                set client-cert disable
            next
        end

        FGVMEVYLSWRHYA98 # show authentication scheme 
        config authentication scheme
            edit "ztna-local-scheme"
                set method basic
                set user-database "local-user-db"
            next
        end

        FGVMEVYLSWRHYA98 # show authentication rule 
        config authentication rule
            edit "ztna-portal-rule"
                set protocol ztna-portal
                set active-auth-method "ztna-local-scheme"
            next
        end

        FGVMEVYLSWRHYA98 # show ztna web-portal 
        config ztna web-portal
            edit "portal1"
                set vip "ZTNA-web-proxy"
                set host "ztna-portal-vh"
                set auth-rule "ztna-portal-rule"
                set focus-bookmark enable
                set theme dark-matter
            next
        end

        FGVMEVYLSWRHYA98 # show ztna web-portal-bookmark 
        config ztna web-portal-bookmark
            edit "my-bookmarks"
                set groups "ZTNA_USERS"
                config bookmarks
                    edit "Google-Search"
                        set url "https://google.com"
                    next
                end
            next
        end

        FGVMEVYLSWRHYA98 # show firewall proxy-policy 
        config firewall proxy-policy
            edit 1
                set uuid 93a3f4c6-479b-51f1-688f-622ff50cb61b
                set name "ztna-policy"
                set proxy ztna-proxy
                set ztna-proxy "portal1"
                set srcintf "any"
                set srcaddr "all"
                set dstaddr "all"
                set action accept
                set schedule "always"
                set logtraffic all
            next
        end

         

        S
        steven4Author
        Explorer
        May 8, 2026

        This is my policy

        FGVMEVYLSWRHYA98 # show firewall policy 
        config firewall policy
            edit 1
                set status disable
                set name "LAN -> WAN"
                set uuid 71c92638-ae57-51f0-21cc-7dc591e39c8a
                set srcintf "port2"
                set dstintf "port1"
                set action accept
                set srcaddr "all"
                set dstaddr "all"
                set schedule "always"
                set service "ALL"
                set ssl-ssh-profile "certificate-inspection"
                set nat enable
            next
            edit 3
                set name "SSH IP BLOCK"
                set uuid 7de19978-4790-51f1-34a7-8617cbbd09d2
                set srcintf "port1"
                set dstintf "port2"
                set srcaddr "Malicious IP SSH"
                set dstaddr "all"
                set schedule "always"
                set service "ALL"
                set logtraffic disable
            next
        end

        sjoshi
        Staff
        sjoshi
        Staff
        May 8, 2026

        Hi ​@steven4 

         

        The config looks good and does not show error on wad debug

        can you let me know the FGT version? 

        can you share pcap

         

        diag sniff packet any ‘host 192.168.173.132’ 4 0 l

        Thanks, Salon
          S
          steven4Author
          Explorer
          May 8, 2026

          fortigate 7.6.4 VM

          here is the pcap
          FGVMEVYLSWRHYA98 # diag sniff packet any 'host 192.168.173.133' 4 0 I
          Using Original Sniffing Mode
          interfaces=[any]
          filters=[host 192.168.173.133]
          0.002786 port1 out 192.168.173.133.80 -> 192.168.173.1.49306: psh 1817820982 ack 4033490252 
          0.002895 port1 in 192.168.173.1.49306 -> 192.168.173.133.80: ack 1817820989 
          0.036904 port1 in 12.34.97.16.443 -> 192.168.173.133.12540: syn 758041655 ack 4078862296 
          0.036954 port1 out 192.168.173.133.12540 -> 12.34.97.16.443: ack 758041656 
          0.037195 port1 out 192.168.173.133.12540 -> 12.34.97.16.443: psh 4078862296 ack 758041656 
          0.037372 port1 in 12.34.97.16.443 -> 192.168.173.133.12540: ack 4078862469 
          0.241795 port1 in 12.34.97.16.443 -> 192.168.173.133.12540: psh fin 758041656 ack 4078862469 
          0.241944 port1 out 192.168.173.133.12540 -> 12.34.97.16.443: fin 4078862469 ack 758041664 
          0.242150 port1 in 12.34.97.16.443 -> 192.168.173.133.12540: ack 4078862470 
          0.256074 port1 out 192.168.173.133.3727 -> 192.168.173.2.53: udp 41
          0.290767 port1 in 192.168.173.2.53 -> 192.168.173.133.3727: udp 156
          0.981499 port1 in 192.168.173.1.35190 -> 192.168.173.133.80: ack 355924979 
          0.981554 port1 out 192.168.173.133.80 -> 192.168.173.1.35190: ack 2376294731 
          1.076085 port1 out 192.168.173.133.80 -> 192.168.173.1.49306: psh 1817820989 ack 4033490252 
          1.076260 port1 in 192.168.173.1.49306 -> 192.168.173.133.80: ack 1817821009 
          1.077047 port1 out 192.168.173.133.80 -> 192.168.173.1.49306: psh 1817821009 ack 4033490252 
          1.077123 port1 in 192.168.173.1.49306 -> 192.168.173.133.80: ack 1817821189 
          1.548944 port1 in 192.168.173.1.56898 -> 192.168.173.133.80: psh 3228551379 ack 3704461107 
          1.549016 port1 out 192.168.173.133.80 -> 192.168.173.1.56898: ack 3228552236 
          1.643126 port1 out 192.168.173.133.80 -> 192.168.173.1.56898: 3704461107 ack 3228552236 
          1.643240 port1 in 192.168.173.1.56898 -> 192.168.173.133.80: ack 3704462555 
          1.643286 port1 out 192.168.173.133.80 -> 192.168.173.1.56898: psh 3704462555 ack 3228552236 
          1.643337 port1 in 192.168.173.1.56898 -> 192.168.173.133.80: ack 3704462863 
          1.644849 port1 out 192.168.173.133.1136 -> 209.40.117.133.443: syn 2733109361 
          1.880411 port1 in 209.40.117.133.443 -> 192.168.173.133.1136: syn 2892191223 ack 2733109362 
          1.880449 port1 out 192.168.173.133.1136 -> 209.40.117.133.443: ack 2892191224 
          1.880718 port1 out 192.168.173.133.1136 -> 209.40.117.133.443: psh 2733109362 ack 2892191224 
          1.881024 port1 in 209.40.117.133.443 -> 192.168.173.133.1136: ack 2733109535 
          2.085704 port1 in 209.40.117.133.443 -> 192.168.173.133.1136: psh fin 2892191224 ack 2733109535 
          2.085840 port1 out 192.168.173.133.1136 -> 209.40.117.133.443: fin 2733109535 ack 2892191232 
          2.086031 port1 in 209.40.117.133.443 -> 192.168.173.133.1136: ack 2733109536 
          2.086180 port1 out 192.168.173.133.3727 -> 96.45.45.45.53: udp 41
          2.110740 port1 in 96.45.45.45.53 -> 192.168.173.133.3727: udp 85
          2.116451 port1 out 192.168.173.133.80 -> 192.168.173.1.49306: psh 1817821189 ack 4033490252 
          2.116558 port1 in 192.168.173.1.49306 -> 192.168.173.133.80: ack 1817821480 
          2.244726 port1 out 192.168.173.133.12544 -> 12.34.97.16.443: syn 1363485738 
          2.361141 port1 in 192.168.173.1.50308 -> 192.168.173.133.15443: syn 2247067013 
          2.392393 port1 in 12.34.97.16.443 -> 192.168.173.133.12544: syn 883140551 ack 1363485739 
          2.392438 port1 out 192.168.173.133.12544 -> 12.34.97.16.443: ack 883140552 
          2.392652 port1 out 192.168.173.133.12544 -> 12.34.97.16.443: psh 1363485739 ack 883140552 
          2.392832 port1 in 12.34.97.16.443 -> 192.168.173.133.12544: ack 1363485912 
          2.597681 port1 in 12.34.97.16.443 -> 192.168.173.133.12544: psh fin 883140552 ack 1363485912 
          2.597805 port1 out 192.168.173.133.12544 -> 12.34.97.16.443: fin 1363485912 ack 883140560 
          2.597931 port1 in 12.34.97.16.443 -> 192.168.173.133.12544: ack 1363485913 
          2.598138 port1 out 192.168.173.133.3727 -> 96.45.46.46.53: udp 41
          2.665905 port1 in 96.45.46.46.53 -> 192.168.173.133.3727: udp 118
          3.128426 port1 in 192.168.173.1.56898 -> 192.168.173.133.80: psh 3228552236 ack 3704462863 
          3.128481 port1 out 192.168.173.133.80 -> 192.168.173.1.56898: ack 3228553114 
          3.130699 port1 out 192.168.173.133.80 -> 192.168.173.1.56898: psh 3704462863 ack 3228553114 
          3.130772 port1 in 192.168.173.1.56898 -> 192.168.173.133.80: ack 3704463401 
          3.156210 port1 out 192.168.173.133.80 -> 192.168.173.1.49306: psh 1817821480 ack 4033490252 
          3.156358 port1 in 192.168.173.1.49306 -> 192.168.173.133.80: ack 1817821721 
          3.406183 port1 in 192.168.173.1.56898 -> 192.168.173.133.80: psh 3228553114 ack 3704463401 
          3.408678 port1 out 192.168.173.133.80 -> 192.168.173.1.56898: psh 3704463401 ack 3228553982 
          3.408760 port1 in 192.168.173.1.56898 -> 192.168.173.133.80: ack 3704463977 
          3.413483 port1 in 192.168.173.1.50308 -> 192.168.173.133.15443: syn 2247067013 
          4.197179 port1 out 192.168.173.133.80 -> 192.168.173.1.49306: psh 1817821721 ack 4033490252 
          4.197258 port1 in 192.168.173.1.49306 -> 192.168.173.133.80: ack 1817821805 
          4.438805 port1 in 192.168.173.1.50308 -> 192.168.173.133.15443: syn 2247067013 
          5.236092 port1 out 192.168.173.133.80 -> 192.168.173.1.49306: psh 1817821805 ack 4033490252 
          5.236213 port1 in 192.168.173.1.49306 -> 192.168.173.133.80: ack 1817821846 
          5.461599 port1 in 192.168.173.1.50308 -> 192.168.173.133.15443: syn 2247067013 
          6.276123 port1 out 192.168.173.133.80 -> 192.168.173.1.49306: psh 1817821846 ack 4033490252 
          6.276206 port1 in 192.168.173.1.49306 -> 192.168.173.133.80: ack 1817821886 
          6.486851 port1 in 192.168.173.1.50308 -> 192.168.173.133.15443: syn 2247067013 
          ^C
          69 packets received by filter
          0 packets dropped by kernel

          funkylicious
          SuperUser
          funkylicious
          SuperUser
          May 8, 2026

          have you tried following the guide from here, exactly the same settings expect the hostname/ip w/ the correct ones?

          https://docs.fortinet.com/document/fortiproxy/7.6.4/administration-guide/545125/ztna-agentless-web-based-application-access

          "jack of all trades, master of none"
            S
            steven4Author
            Explorer
            May 8, 2026

            yes, I tried those confs. what do you mean by /ip and w/?

             

            funkylicious
            SuperUser
            funkylicious
            SuperUser
            May 8, 2026

            to set the fqdn, ip addresses by replacing those in the example given with (w/) the correct ones.

            "jack of all trades, master of none"
              RBA
              Staff
              RBA
              Staff
              May 10, 2026

              Hi Steven4,

              Screenshots shows error “ssl no matching CipherSuite, abort”

              [I][p:2721][s:5719] wad_vs_ssl_port_caps_c2p_on_client_hello:11221 15859:ZTNA-web-proxy: wsp(0x7f113fcbc048) handshake recv ClientHello record 3.1 client 3.3 supported 3.3
              [V][p:2721][s:5719] wad_vs_ssl_c2p_check_alpn :24833 wsp=0x7f113fcbc048, alpn=h2
              [V][p:2721][s:5719] wad_vs_ssl_c2p_check_alpn :24842 wsp=0x7f113fcbc048, vs server set alpn http2
              [V][p:2721][s:5719] wad_vs_proxy_match_vhost :466215859:ZTNA-web-proxy: matching vhost by: portal.ztna.com
              [V][p:2721][s:5719] wad_pattern_matcher_search :1226 pattern-match succ:portal.ztna.com
              [I][p:2721][s:5719] wad_vs_proxy_match_vhost :467015859:ZTNA-web-proxy: matched vhost(ztna-portal-vh 0x7f113f930e98)
              [E][p:2721][s:5719] wad_vs_find_cipher :10301 wsp 0x7f113fcbc048 ssl no matching CipherSuite, abort

              As per ClientHello record 3.1 client 3.3 supported 3.3 TLS, version is TLS1.2. Just for testing can you set the max-version to tls1.2 and test.

              config firewall vip
                  edit ZTNA-web-proxy
                      set ssl-max-version tls-1.2
                  next
              end

              or set the TLS version to 1.3 on the PC and check. 

                S
                steven4Author
                Explorer
                May 11, 2026

                 

                 

                S
                steven4Author
                Explorer
                May 11, 2026

                i wrote this command (set ssl-max-version tls-1.2), but it is not appearing in the cli. 

                and i am getting this error

                [V][p:4984][s:150184]     wad_vs_ssl_c2p_check_alpn         :24833 wsp=0x7f723bbe7048, alpn=h2
                [V][p:4984][s:150184]     wad_vs_ssl_c2p_check_alpn         :24842 wsp=0x7f723bbe7048, vs server set alpn http2
                [V][p:4984][s:150184]     wad_vs_proxy_match_vhost          :4662  15859:ZTNA-web-proxy: matching vhost by: portal.ztna.com
                [V][p:4984][s:150184]     wad_pattern_matcher_search        :1226  pattern-match succ:portal.ztna.com
                [I][p:4984][s:150184]     wad_vs_proxy_match_vhost          :4670  15859:ZTNA-web-proxy: matched vhost(ztna-portal-vh 0x7f723b85b338)
                [E][p:4984][s:150184]     wad_vs_find_cipher                :10301 wsp 0x7f723bbe7048 ssl no matching CipherSuite, abort
                [I][p:4984][s:150184]     wad_ssl_app_port_fts_in_close     :20146 sp=0x7f723bbe7048/10 recv close request from fts close-type=0 closed=0
                [I][p:4984][s:150184]     wad_ssl_port_task_end             :18268 sp=0x7f723bbe7048/10 state=1 good=0
                [I][p:4984][s:150184]     wad_tcp_port_proc_end             :829   tcp=0x7f723bbef048 socket=122 good=0 both ends closed.
                [I][p:4984][s:150184]     wad_ssl_app_port_out_ops_close    :20661 sp=0x7f723bbe7048/10 closed=1 out_shutdown=0 graceful=0
                [I][p:4984][s:150184]     wad_ssl_port_close                :23359 sp=0x7f723bbe7048/10 state=5, half=0
                [I][p:4984][s:150184]     wad_ssl_sock_port_out_ops_close   :19890 sp=0x7f723bbe7048/10 closed=0
                [I][p:4984][s:150184]     wad_ssl_negotiate_close           :2781  nego=0x7f72369b16f8
                [I][p:4984][s:150184]     wad_tcp_port_proc_end             :874   tcp 0x7f723bbef048 closed on sock 122 
                [I][p:4984][s:150184]     wad_tcp_port_end_event            :782   sock 122 close
                [I][p:4984][s:150184]     __wad_log_etl                     :447   size:331 buf:0x55e1dec171bb
                [I][p:4984]               wad_tcp_port_put                  :630   free tcp_port=0x7f723bbef048
                [I][p:4984]               wad_tcp_port_alloc                :1482  alloc tcp_port=0x7f723bbef048
                [I][p:4984]               wad_accept                        :2420  redirect 92 accepted 192.168.173.1:54954 -> 192.168.173.133:15443 on 122
                [I][p:4984]               wad_session_context_learn_v4_session:145   Redir session state=0x304 state2=0x1000000 state_ext=0x0.
                [I][p:4984][s:150187]     wad_session_context_learn_session_config:495   vf_id=0 ses_ctx=0x7f7236a08e00 policy-id=0, sec_profile=(nil) app_type=http
                     wan_opt_mode=0 av_idx=0 dd_method=0 wan_opt_tcp=0
                     tp-mode=0 web_cache=0 webcache_ssl=0
                     check_policy: http=0 ssh=0 ssh_tun=0 fw_ztna=0 ap=1
                     ipsapp_redirect=0
                     ssl_enabled=0 ssl_full=0 wanopt_ssl=0 ssl_proc=
                     ses_ctx:t|Pv|M|H|C|A7|O fwdsvr=''

                 

                S
                steven4Author
                Explorer
                May 11, 2026

                i tried it, and i am getting this error again. 
                sl no matching CipherSuite, abort

                sjoshi
                Staff
                sjoshi
                Staff
                May 12, 2026

                Please try
                config firewall vip
                    edit ZTNA-web-proxy
                        set ssl-min-version tls-1.2
                        set ssl-max-version tls-1.2
                        set ssl-server-min-version tls-1.2
                        set ssl-server-max-version tls-1.2

                Also share below output
                get sys status 

                 

                Thanks, Salon
                  S
                  steven4Author
                  Explorer
                  May 12, 2026

                  set ssl-server-min/max-version is unavailable there
                   

                  FGVMEVYLSWRHYA98 # get system status 
                  Version: FortiGate-VM64 v7.6.4,build3596,250820 (GA.F)
                  First GA patch build date: 240724
                  Current Security Level: High
                  Firmware Signature: certified
                  Virus-DB: 1.00000(2018-04-09 18:07)
                  Extended DB: 1.00000(2018-04-09 18:07)
                  Extreme DB: 1.00000(2018-04-09 18:07)
                  AV AI/ML Model: 0.00000(2001-01-01 00:00)
                  IPS-DB: 6.00741(2015-12-01 02:30)
                  IPS-ETDB: 6.00741(2015-12-01 02:30)
                  IPS-MLDB: 0.00000(2001-01-01 00:00)
                  APP-DB: 6.00741(2015-12-01 02:30)
                  AIAP-DB: 0.00000(2001-01-01 00:00)
                  Proxy-IPS-DB: 6.00741(2015-12-01 02:30)
                  Proxy-IPS-ETDB: 6.00741(2015-12-01 02:30)
                  Proxy-APP-DB: 6.00741(2015-12-01 02:30)
                  FMWP-DB: 0.00000(2001-01-01 00:00)
                  IPS Malicious URL Database: 1.00001(2015-01-01 01:01)
                  IoT-Detect: 0.00000(2022-08-17 17:31)
                  OT-Detect-DB: 0.00000(2001-01-01 00:00)
                  OT-Patch-DB: 0.00000(2001-01-01 00:00)
                  OT-Threat-DB: 6.00741(2015-12-01 02:30)
                  IPS-Engine: 7.01154(2025-08-13 22:24)
                  Timezone DB Version: 1.003
                  Timezone DB IANA Version: 2024a
                  Serial-Number: FGVMEVYLSWRHYA98
                  License Status: Valid
                  VM Resources: 1 CPU/1 allowed, 1994 MB RAM/2048 MB allowed
                  Log hard disk: Available
                  Hostname: FGVMEVYLSWRHYA98
                  Operation Mode: NAT
                  Current virtual domain: root
                  Max number of virtual domains: 2
                  Virtual domains status: 1 in NAT mode, 0 in TP mode
                  Virtual domain configuration: disable
                  FIPS-CC mode: disable
                  Current HA mode: standalone
                  Branch point: 3596
                  Release Version Information: GA
                  FortiOS x86-64: Yes
                  System time: Mon May 11 18:05:21 2026
                  Last reboot reason: power cycle

                  Yurisk
                  SuperUser
                  Yurisk
                  SuperUser
                  May 13, 2026

                  Kevin does a good walkthrough here, even though for FortiOS 8, but still helpful even if you are not on 8.0:

                  https://blog.guenay.at/2026/05/05/fortigate-8-0-ztna-configuration-all-methods-entra-saml-sso/ 

                  yurisk.info - all things Fortinet blog, no ads
                    S
                    steven4Author
                    Explorer
                    May 13, 2026

                    thank you very much. I will check it out

                    Show more replies
                    Terms & ConditionsAccessibility statement
                    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
                    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
                    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!