Technical Tip: ZTNA Access Proxy with Java dependencies

[Anil_Solakoglu]

Description	This article provides a comprehensive guide to resolving conflicts between IPV4 and IPV6 usage when connecting to a Zero Trust Network Access (ZTNA) access proxy destination, particularly for PostgreSQL environments with Java dependencies. Users encountering the '[fortitcs error] CopyNetBuffer error' in the FortiClient diagnostic logs may be experiencing connectivity issues stemming from the software's reliance on IPV6 addresses instead of IPV4.
Scope	EMS, FortiClient, ZTNA Access proxy, Fortigate, Java.
Solution	This article walks through the process of configuring a Zero Trust Network Access (ZTNA) Access Proxy for connecting to PostgreSQL on a FortiGate device. Specifically, it explores a sample configuration where the PostgreSQL connection utilizes port 5432 by default, but the Access Proxy rule is set for a different port, 5435. Whether using DBeaver or SQuirreL SQL Client applications, this guide ensures a smooth and secure PostgreSQL connection through the Access Proxy. Access Proxy Configuration: Access Proxy Definition: Start by configuring the ZTNA Access Proxy. In the FortiGate interface, navigate to the Access Proxy configuration section and create a new entry, such as 'ZTNA-PostgreSQL'. config firewall access-proxy     edit "ZTNA-PostgreSQL"         set vip "ZTNA-VIP"             config api-gateway                 edit 3                     set url-map "/tcp"                     set service tcp-forwarding                         config realservers                             edit 1                                 set address "postgresql.contoso.com"                                 set mappedport 5435 This configuration ensures that the Access Proxy is set up to handle PostgreSQL connections on the specified port (5435). Firewall Rule Configuration: Next, create a firewall rule that associates the Access Proxy configuration with the desired network settings. config firewall policy     edit 18         set uuid c60c9a74-466a-51ee-b694-46e9803b1032         set name "postgresql"         set proxy access-proxy         set access-proxy "ZTNA-PostgreSQL"         set srcintf "port1"         set srcaddr "all"         set dstaddr "postgresql.contoso.com"         set action accept         set schedule "always"         set logtraffic all     next This rule ensures that traffic directed towards 'postgresql.contoso.com' from the specified source interface ('port1' in this example) is processed through the Access Proxy configuration. Conclusion: By following these steps, it is possible to configure a ZTNA Access Proxy on the FortiGate device for PostgreSQL connections, even when using non-default ports. This configuration ensures secure and efficient communication between the PostgreSQL client applications like DBeaver or SQuirreL SQL Client and the PostgreSQL server through the specified Access Proxy rules. Regularly review and adapt these configurations to meet the evolving needs of the network environment. Forticlient EMS Configuration: Those two applications are based on Java programming language and in the background they need Java dependencies to connect to PostgreSQL. To collect ZTNA-related logs from the endpoint side. Diagnostic Tool As a regular troubleshooting step when checking fortitcs.log under diagnostic logs FCDiagData\general\logs\trace, probably the following error messages will appear: [fortitcs error] CopyNetBuffer error: That is because the software still uses IPV6 addresses instead of IPV4. In the Windows OS java environmental variables should force to use ipv4 instead of ipv6 to establish the connection. In order to check existing configurations for Java environmental variables. echo %_JAVA_OPTIONS% To adjust environmental variables to connect via IPV4. setx _JAVA_OPTIONS -Djava.net.preferIPv4Stack=true