ZTNA Georredendancy

Hello Abdelkrim,

I hope you are doing well :)!!!

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

As usual, it is a pleasure if we can help you.

I found this answer with our documentations:

To achieve a redundant deployment for ZTNA Application Gateway with minimal user disruption, you can consider the following approach:

1. DNS Configuration:

   • Use a DNS service that supports failover. Configure the DNS to point ztna.domain.com to the primary site's public IP.
   • Set a low TTL (Time to Live) for the DNS record to ensure quick propagation of changes.

2. FortiADC GSLB:

   • While FortiADC's GSLB might seem excessive, it provides a robust solution for automatic failover and load balancing.
   • GSLB can dynamically direct traffic to the available ZTNA gateway based on health checks and proximity, ensuring users are routed to the best available site.

3. FortiGate Configuration:

   • Ensure both FortiGates are configured to handle ZTNA traffic and have the necessary policies in place.
   • Use FortiGate's built-in capabilities to monitor the health of the ZTNA gateway and switch traffic if the primary site becomes unavailable.

4. Monitoring and Alerts:

   • Implement monitoring to detect failures or performance issues with the primary ZTNA gateway.
   • Set up alerts to notify administrators of any issues, allowing for quick manual intervention if needed.

5. Testing and Validation:

   • Regularly test the failover process to ensure that it works as expected and that users experience minimal disruption.

By using a combination of DNS failover and FortiGate's capabilities, you can achieve a redundant deployment that is both cost-effective and efficient for a smaller setup.

Is that helping?

Regards,