Best practice ZTNA for RDP sessions

[doncacciatoconsuting]

I have 40 windows servers that perform unique functions and want ZTNA access to all of them.

I guess there are a couple of different ways:

1) Unique public IPs for ZTNA TCP Forwarding Server with the same external port being 3389, and internally mapped to the single server on 3389.. Easy, but takes up a lot of addresses.

2) Same public IP for ZTNA TCP Forwarding Server, with unique external ports,  and internally mapped to the single server on 3389. Seems like a hassle for the end user to append a new port to and RDP session. Unless done using a SRV record in DNS with the unique port…..

Does this sound correct ?
Tom

[Shashwati · Accepted solution]

Hello

Please refer to the document to configure ZTNA as per your Network topology

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Connect-to-Remote-Desktop-Server-RDS-farm-...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-TCP-Forwarding-for-RDP-via-ZTNA-Access-Beh...