Forticlient - gpupdate via ZTNA

Forum|Forum|1 year ago
February 13, 2025
3 replies
1746 views

I have about 150 computers that are very rarely directly connected to the internal network and connect to the central office via VPN.

I am implementing ZTNA connections instead of VPN. Is there a way for a client computer to retrieve GPO policies from AD through ZTNA? When I was using VPN, this problem did not exist.

I managed to solve SMB login by installing KDCPROXY, but I don't know how to handle GPO refresh?

I use Forticlient EMS 7.2.x

MZBZ

Staff

Upgrade to FortiOS 7.6.2 and EMS 7.4.1 with FCT 7.4.2 which allow UDP/TCP over ZTNA and redesigned ZTNA destination.

The new ZTNA destination in EMS/FCT can carry traffic destined to a specific IP/range/subnet/fqdn from port 0 to 65535 with a single config line (instead of 65535 lines in version 7.2) It can be practically a split tunnel VPN for that specific IP/range/subnet/fqdn (TCP or UDP)

ZTNA Destinations | FortiClient 7.4.1 | Fortinet Document Library

ZTNA application catalog 7.2.5 | FortiClient 7.2.0 | Fortinet Document Library

Support ZTNA destinations over UDP 7.4.1 | FortiClient 7.4.0 | Fortinet Document Library

*This is not a supported use case and TAC cannot provide support for it. Test and try it!

tomeksAuthor

New Member

Now we have to wait until the Fortios 7.6.x and FortiClient 7.4.x branches mature. Probably another year to go.

dslauter

Visitor III

Did you ever get this working? I'm on 7.4.8 and tried just about everything I could think of, but couldn't get it to work. From what I understand it's due to FortiClient not being able to handle SRV DNS records over ZTNA.

tomeksAuthor

New Member

I haven’t done a software upgrade to the new branches yet.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded