Technical Tip: How to implement ZTNA Destination in FortiClient EMS for ZTNA TCP forwarding

[kyoneda1]

Description	This article describes how to implement ZTNA Destination in FortiClient EMS for ZTNA TCP forwarding.
Scope	FortiOS, FortiClient, FortiClient EMS.
Solution	Starting with v7.0.4 and FortiClient v7.0.3, it is possible to leverage ZTNA TCP Forwarding Access Proxy rules to connect to internal resources without needing a VPN connection. This article can be configured with FortiClient EMS instead of FortiClient settings in the administration guide below. The display format of ZTNA Destination in the FortiClient EMS GUI differs between 7.0 and 7.2. This article provides example configurations for each version: ZTNA TCP forwarding access proxy example The topology is as below: To create a ZTNA Destination in FortiClient EMS v7.0: Go to Endpoint Profiles -> ZTNA Destinations tab, select Add, or select the profile. On the Destinations Grouped by Gateway, select Add. Set the Destination Name to SSH-FAZ. This is the name as it is listed in ZTNA DESTINATION in the FortiClient console. Set Destination Host to 10.88.0.2:22. This is the real IP address and port of the server. Set Proxy Gateway to 10.0.3.11:8443. This is the access proxy address and port that are configured on the FortiGate. Select Save, and Save again on the ZTNA Destinations Profile. Apply the created profiles to policies as needed. To create a ZTNA Destination in FortiClient EMS v7.2: Go to Endpoint Profiles -> ZTNA Destinations tab, select Add, or select the profile. On the Destinations Grouped by Gateway, select Add. Set Enter gateway proxy address to 10.0.3.11:8443. Set Alias to SSH-FAZ. This is the name as it is listed in this profile. Select Next.    6. Select Add.    7. Set the Private Application Name to SSH-FAZ. This is the name as it is listed in ZTNA DESTINATION in the FortiClient console.    8. Set Destination to 10.88.0.2:22. This is the real IP address and port of the server.    9. Select Next and the SaaS Application displayed, and select Finish.    10. Select Save on the ZTNA Destinations Profile. Apply the created profiles to policies as needed. To confirm that ZTNA Destination configurations in FortiClient:    1. Go to the ZTNA Destination tab in the FortiClient console.    2. Confirm that the configurations are as shown below.