FORTISASE ZTNA AGNET BASED & AGENT LESS ISSUE

To troubleshoot the issue with Fortinet SASE ZTNA agentless access, let's go through a few steps and considerations:

1. Verify Prerequisites and Configuration:

• Licensing: Ensure that the FortiSASE has the appropriate license (Advanced, Professional, or Comprehensive remote users license) applied.
• Proxy and SSO Configuration: Confirm that the proxy and proxy SSO are correctly configured. This includes ensuring that the SAML IdP is set up properly for user authentication.
• SPA Configuration: Ensure that Secure Private Access (SPA) is configured for the FortiGate device acting as the SPA hub.
• Private Application Configuration: Verify that the private web-based application is correctly configured to reside on the local network behind a FortiGate device and supports HTTPS.

2. Check Agentless ZTNA Limitations:

• Proxy and Agent Users: Note that proxy and agent users cannot access private application bookmarks configured for agentless ZTNA.
• SPA Hubs and FQDN: Agentless ZTNA does not work with SPA hubs configured with BGP on loopback and private web-based applications configured with the Server Type set to FQDN.

3. Debugging Steps:

• WAD CLI Debug Commands: Use the following WAD CLI debug commands to gather more information. Replace 'x.x.x.x' with the remote client's public IP address:

  diagnose debug reset diagnose wad filter src x.x.x.x diagnose wad debug category 

4. Known Issues:

• Version-Specific Issues: If you are using FortiGate devices running version 7.6.x, there are known issues with ZTNA agentless access on certain devices like the 90G. Ensure that your device and version are not affected by these known issues.

5. Additional Considerations:

• Browser Cache: Ensure that the browser cache is cleared, as deauthenticating a proxy SSO user does not direct the user to reauthenticate without clearing the cache first.
• Deep Inspection: For proxy SSO users, ensure that at least one proxy policy using SSO authentication has deep inspection enabled in the configured security profile group.

Final Thoughts:

If the above steps do not resolve the issue, it may be beneficial to check for any updates or patches that address known bugs in the version you are using. Additionally, consider reaching out to Fortinet support for further assistance, as they may have more specific insights into potential bugs affecting agentless access in your portal.