Technical Tip: Disabling Cookie Session Authentication for ZTNA HTTPS Access proxy with RADIUS

[dwickramasinghe1]

Description	This article describes how ZTNA web authentication can be continuously forced for HTTPS access proxy access.
Scope	FortiGate, FortiClient, ZTNA.
Solution	FortiGate and FortiClient can use ZTNA device verification to allow access to internal web server resources through a ZTNA HTTPS access proxy. This article assumes that the ZTNA HTTPS access proxy feature has already been configured alongside an extra layer of authentication such as RADIUS, Local, or LDAP authentication. When authenticating to the HTTPS access proxy via an authentication scheme/rule, the login will get sent to the FortiGate and will create a WAD user session. Go under FortiGate GUI -> Dashboard -> Firewall User Monitor. If the user closes the endpoint browser HTTPS session and attempts to access HTTPS access-proxy resource again on a different browser, the FortiGate will not ask for credential authentication again because the WAD user session has already been created in the session table by default. In some cases, it is required to force the HTTP authentication every single time a user tries to access the HTTPS resource. To do this, change the authentication rule so that the client will be forced to authenticate again using the rule. Go under FortiGate GUI -> Policy & Objects -> Authentication Rules -> *Select the desired rule* -> Disable the 'IP-based Authentication' option and save the changes. Enter the CLI configuration for the Authentication rule and disable the following: config authentication rule     edit <desired rule>         set cert-auth-cookie disable     end Once the changes have been saved, attempt to access the ZTNA HTTPS Resource and confirm that authentication is prompted every single time access is requested on a new TCP session or new browser application.