SuperUser

Question

ZTNA HTTP Proxy - virtual host

Forum|Forum|9 months ago
August 13, 2025
5 replies
2424 views

Hi,

I am struggling to make a configuration in my LAB to work, which involves setting up a ZTNA HTTP Proxy which should redirect the traffic based on virtual-host/hostname.

I am running FortiOS 7.2.11 , EMS 7.4.3 and FortiClient 7.4.3 in my environment.

In EMS I have a ZTNA Destination with the FortiGate Public IP/Proxy ( Proxy Gateway:80 > Destination Host on ports 80,81 and DNS entries locally in hosts for test1.lab.local and test2.lab.local with the PUB IP/Proxy GW and if i switch the entries to the private IP I get:

ZTNA Access Denied The page you requested has been blocked by a ZTNA restriction. Details:	API Gateway Denied.

Tried switching from Service HTTP to TCP Forwarding, no luck

The firewall rule is in place and works for HTTPS/SMB , our focus in the matter at hand is for LAB-WIN

config firewall policy     edit 17         set srcintf "wan1"         set dstintf "any"         set action accept         set srcaddr "all"         set dstaddr "LAB-WIN" "LAB-WIN-SMB" "LAB-WIN-HTTPS"         set ztna-ems-tag "EMS1_ZTNA_not-AD-joined-PC" "EMS1_ZTNA_compliant-device"         set schedule "always"         set service "ALL"         set logtraffic all         set nat enable     next end

Below the config for VIP/access-proxy/virtual-host

config firewall vip     edit "LAB-WIN"         set type access-proxy         set extip PUB-IP         set extintf "wan1"         set server-type https         set extport 80         set ssl-certificate "Fortinet_SSL"         set ssl-algorithm medium         set ssl-pfs allow     next end  config firewall access-proxy     edit "LAB-WIN"         set vip "LAB-WIN"         config api-gateway             edit 1                 set service http                 set virtual-host "auto-LAB-WIN-0"                 config realservers                     edit 1                         set ip 192.168.200.200                         set port 80                     next                 end             next             edit 2                 set service http                 set virtual-host "auto-LAB-WIN-1"                 config realservers                     edit 1                         set ip 192.168.200.200                         set port 81                     next                 end             next         end     next end   config firewall access-proxy-virtual-host     edit "auto-LAB-WIN-0"         set ssl-certificate "Fortinet_SSL"         set host "test1.lab.local"     next     edit "auto-LAB-WIN-1"         set ssl-certificate "Fortinet_SSL"         set host "test2.lab.local"     next end

It doesnt seem that the traffic is reaching my backend server while running a wireshark, somehow it stops on the firewall, based on some debug commands I found for wad process, but to be honest it gives out a lot of information and cant wrap my head around it and filter out what's the information I need from it.

Any input/help will be much appreciated

AEK

SuperUser

Hi Funkylicious

I see your firewall policy is not ZTNA (set ztna-status enabled). You need to enable it.

Furthermore as per my experience for ZTNA proxy access (ext to int) I prefer using proxy rules (type ZTNA) instead of firewall rules, since it worked with no issue.

AEK

funkyliciousAuthor

SuperUser

hi @AEK ,

it appears that the command in question is available only when the policy is Standard but in my case it's already defined as ZTNA.

as for proxy-rules, if i recall correctly reading that in version 7.4+ the ZTNA rules are now configured there instead of normal firewall policies, but I think i gave that also a try and didnt worked.

"jack of all trades, master of none"

AEK

SuperUser

Hi Funkylicious

Then does your FortiClient show status connected? And do you see the active tags on it?

And does FortiGate see it as active client and having the required tags?

AEK

funkyliciousAuthor

SuperUser

yes, its connected, has tags and the FGT sees it.

traffic for ZTNA destinations like SMB or HTTPS are working just fine only for this setup for some reason it doesnt seem to work

"jack of all trades, master of none"

funkyliciousAuthor

SuperUser

anyone that managed to have this working, maybe give me a hint of what im doing wrong ?

"jack of all trades, master of none"

AEK

SuperUser

Hi Funkylicious

Yes it worked for me very well but only with the following:

TCP Forwarding instead of HTTP
Proxy policy instead of firewall policy

Here with FOS 7.2.11 if I remember well the ZTNA apps info are not pushed automatically to EMS, if I remember well the feature is introduced in 7.4.x.

So one of possible causes (other than the two above) is that you probably made some error when configuring ZTNA apps on EMS. Try double check the ZTNA apps and ZTNA profile for the problematic app.

You can also share the related screenshots (ZTNA profile and apps on EMS, ZTNA apps on FGT) maybe we can detect the error.

AEK

funkyliciousAuthor

SuperUser

hi AEK,

i just gave up trying to use a HTTP ZTNA Server, also upgrade the FGT to the latest 7.4.X version.

i've reconfigured my ZTNA server on port 443 ( LAB-WIN-HTTPS ) using service HTTP and virtual hosts for both IP/ports ( 192.168.200.200 port 80 and 81 ) and appears to be working just fine.

"jack of all trades, master of none"

AEK

SuperUser

Happy to hear that it worked fine.

Indeed with FOS 7.4 is much better since all ZTNA apps info is pushed automatically from FGT to EMS, so there is no chance to make mistake.

AEK

vokeldu3

New Member

If they're external/public facing, then the lack of a DNS entry is not going to give you much additional privacy compared to having one. DNS information while useful is used tangentially in attacks - IP addresses and their contents are the primary target.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded