Is it possible to include a ZTNA tag inside a local-in policy?

Forum|Forum|1 year ago
February 17, 2025
5 replies
1358 views

hello everybody, I defined a ZTNA Group that includes two ZTNA Tags:

Screenshot 2025-02-17 alle 18.10.14.png

I know that a firewall policy can work with ZTNA Tags. But is it the same for a local-in-policy?

Looking at the documentation:

config firewall {local-in-policy | local-in-policy6}     edit <policy_number>         set intf <interface>         set srcaddr <source_address> [source_address] ...         set dstaddr <destination_address> [destination_address] ...        set action {accept | deny}         set service <service_name> [service_name] ...         set schedule <schedule_name>         set comments <string>     next end

It generally talks about a destination address. But is the local-in-policy capable of understanding a ZTNA group?

I didn't find anything indicative about this. I'm working on a Fortigate 60F v7.2.11.

Thank you

Best answer by AEK

Hi Raffael

As per my knowledge you can't.

But depending on what you want to achieve you may transform your local-in policy to a firewall policy using a loopback address.

AEKAnswer

SuperUser

Hi Raffael

As per my knowledge you can't.

But depending on what you want to achieve you may transform your local-in policy to a firewall policy using a loopback address.

AEK

SuperUser

You can take this very nice example provided by @Yurisk

https://yurisk.info/2023/03/21/fortigate-vpn-ssl-hardening-guide/#_move_vpn_ssl_listening_interface_to_a_loopback_interface

Hope it helps.

AEK

Yurisk

SuperUser

ZTNA in Local-in policy ? Nope, not possible yet, but give Fortinet folks a break - they just (7.2) introduced Geo address object and ISDB (7.4.4) in Local-in policy, and already asking for ZTNA :) ...

Some day probably ...

Thanks @AEK for the mentioning.

yurisk.info - all things Fortinet blog, no ads

AEK

SuperUser

@raffaeledp

I just want to clarify that by the example above I mean you can see how you can transform your local-in policy to a firewall policy using a loopback address, and you can then use ZTNA tag to access the FGT resource (admin UI, ssh, VPN and so).

AEK