Technical Tip: Sample configuration Proxy ZTNA

[acvaldez]

Description	This article describes how to show some samples of Proxy ZTNA configuration and sample traffic.
Scope	FortiGate.
Solution	Diagram:  Configuration: Windows machine where the Forticlient is connected to EMS. On EMS, it is now possible to see the FortiClient registered to it. Zero Trust Tagging Rule set on EMS. Zero Trust Tag Monitor. FortiGate where the Security Fabric EMS is configured: Status is connected. Under Policy & Objects -> ZTNA -> ZTNA Tags in FortiGate, all tags are in synced from EMS to the FortiGate. ZTNA server is configured. The 10.115.1.42 is the internal IP of the FortiGate. A web server will be used for this testing. ZTNA Rules in the FortiGate, Firewall Policy, and Proxy Policy.  Note: Starting from FortiOS 7.2.5, ZTNA rules tap under Policy & Objects -> ZTNA is removed. Instead, it can be configured under Policy & Objects -> Proxy Policy. It can also be configured under Policy & Objects -> Firewall Policy and select ZTNA. However, this method will not allow control access based on destination interface or real server’s destination address. For more information, refer to this admin guide.  Sample traffic:  The FortiGate is on Firmware version 7.0.6 and the EMS version is 7.0.7. IIS server is accessed behind the FortiGate from ZTNA client 10.47.1.80. and the server IP address behind the FortiGate IP is 10.115.2.86. Logs showing that the right policy are used. IIS Server access result. WAD debug output: [I][p:226][s:13871][r:6] wad_http_vs_check_dst_ovrd        :1044  1:FirewallInternalIPAccess:1: Found server: 10.115.2.86:80 [V][p:226][s:13871][r:6] wad_http_req_exec_act             :11851 dst_addr_type=3 wc_nontp=0 sec_web=1 web_cache=0 req_bypass=0 [V][p:226][s:13871][r:6] wad_get_dst_intf_idx2             :214   rc = 0, new rt entry oif=5 [V][p:226][s:13871][r:6] wad_http_req_get_dst_intf         :10680 @@@ vd=0 dst=10.115.2.86 ifidx=5 [V][p:226][s:13871][r:6] wad_http_req_vs_check_policy      :10826 HTTP req=0x7fdd4787d710 out_intf=5, vwl=0 [V][p:226][s:13871][r:6] wad_http_req_check_policy         :10547 starting policy matching(vs_pol= 1):10.47.1.80:49193->10.115.2.86:80 [V][p:226][s:13871][r:6] wad_fw_addr_match_ap              :1041  matching ap:FirewallInternalIPAccess(24) with vip addr:FirewallInternalIPAccess(24) [V][p:226][s:13871][r:6] wad_fw_policy_set_check_id        :4856  pol_id=1 dev_cked=0 [V][p:226][s:13871][r:6] wad_dev_get_key                   :3756  try get cert key, cert_info=0x7fdd48d3ede8, issued_by=ems [V][p:226][s:13871][r:6] wad_dev_get_key                   :3763  ci->sn=0x7fdd47c250d8, ci->issuer=0x7fdd47c25f80, ci->cn=0x7fdd47c24ce8, ci->cn->len=32 [V][p:226][s:13871][r:6] wad_dev_make_key                  :3743  uid 8C1B97971D574DC086377A33C951E81A, sn FCTEMS8822008166, len 50 [V][p:226][s:13871][r:6] wad_inform_msg_hdr_get            :578   msg=DevQuery code=OK seq=6 [I][p:226][s:13871][r:6] wad_http_req_check_policy         :10620 match policy vd=0 out_if=5 10.47.1.80:49193 -> 10.115.2.86:80 [V][p:226][s:13871][r:6] wad_http_msg_strm_pause           :955   strm paused, flag=0x2 is_clt=1 [V][p:226][s:13871][r:6] wad_http_clt_read_sync            :1837  hs=0x7fdd475322b0 pause=(1/0x2) ret=1 execute=wad_http_clt_read_req_line [V][p:226][s:13871][r:6] wad_tcp_port_out_read_block       :995   tcp_port 0x7fdd47664048 fd=72 on=1 n_out_block=0~>1 in(/out)_shutdown=0/0 closed=0 stat Related articles:  Technical Tip: ZTNA TCP Forwarding Access Proxy (ZTAP) for File Shares (SMB) Technical Tip: ZTNA - Zero Trust Network Access Resource List Technical Tip: How to access Webproxy via the ZTNA access proxy Technical Tip: How to implement ZTNA TCP forwarding for public-facing servers Technical Tip: ZTNA rules options after 7.2.5 upgrade