Technical Tip: How to implement ZTNA TCP forwardin...

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 294712

Description

This article describes how to implement ZTNA TCP forwarding for public-facing servers.

Scope

FortiOS , FortiClient, Forticlient EMS

Solution

First, create a ZTNA destination on the EMS and apply the ZTNA destination profile to the correct Endpoint policy.

In this example, ZTNA TCP-forwarding will be applied to www.youtube.com.

Confirm if the new ZTNA destination is appearing for the user on the FortiClient:

The IP 10.235.0.1 is what will be provided by the FortiClient. This ensures that TCP forwarding is applied as expected on the endpoint.

Now, create a ZTNA server and Proxy policy on the FortiGate to authenticate traffic.

Create a FQDN address object on the FortiGate with www.youtube.com and use it in the Server field as above:

ZTNA tags can be applied to the policy as necessary as well:

Traffic will now be allowed by the proxy policy, and ZTNA will be applied when the user accesses YouTube on the endpoint.

1394

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Technical Tip: How to implement ZTNA TCP forwarding for public-facing servers