ZTNA tag for internal traffic filtering
Hello,
We have an issue with configuring and using ZTNA tag for filtering internal traffic.
We would like to base our config on following example:
https://docs.fortinet.com/document/fortigate/7.0.0/new-features/477578/ztna-ip-mac-filtering-example
but we would like to use it with many Fabric firewalls not just one (as it is shown in the example).
Here is our setup:
1) EMS server (7.2.6) assigns ZTNA tag - it works OK
2) Forti manager (7.2.8) synchronizes ZTNA config to all our firewalls (7.2.9) - it works OK
3) We configure internal traffic rules using ZTNA tag as source criteria.
Unfortunately, we discovered that above config works properly only within one firewall. That is because ZTNA tag is mapped ONLY to local IP addresses on the firewall.
Thus if we want to use ZTNA tag globally as a source criteria, it doesn't work (because particular firewall maps ZTNA tag to only local IPs and doesn't know anything about remote source IPs for that tag).
Question:
Is there a way to make ZTNA tag to be globally significant?
I.e., can every and each firewall have all ZTNA tag mappings for all IP addresses in global network (not only for its own local subnets) ?
Regards,
Krzysztof
