What's the difference between this two ZTNA users?

[raffaeledp]

Hello everybody,

Some time ago I created a ZTNA environment on my Forticlient EMS, assigning some tags to some users.

For example, look at these two users (this first one uses a macOS device, the second one a Windows device):

the first one was Off-Fabric too when the attempts occured.

As you can see, both users have the same tags.

The ZTNA Firewall policy is unique:

So,  both user should access or not the ZTNA.

The strange fact is that the Windows user can access the ZTNA:

date=2024-10-10 time=13:23:01 id=7424106010597392384 itime="2024-10-10 13:23:01" euid=1040 epid=1070 dsteuid=3 dstepid=1051 logflag=1 logver=702101706 type="traffic" subtype="ztna" level="notice" action="accept" policyid=15 sessionid=11466583 srcip=….. dstip=10.1.0.207 srcport=7854 dstport=3389 duration=13850 proto=6 sentbyte=1112395 rcvdbyte=6568260 logid=0005000024 service="RDP" app="RDP" appcat="unscanned" fctuid="6C40ACFAC7B043A4851701EB5FDD3B3D" srcintfrole="wan" dstintfrole="lan" policytype="proxy-policy" eventtime=1728559380018282594 wanin=6568260 wanout=783813 lanin=1112395 lanout=6912787 poluuid="7f1a8a84-dfd7-51ee-4200-2edb944b93d3" srccountry="Italy" dstcountry="Reserved" srcintf="wan1" dstintf="internal" policyname="ZTNA to RDP" tz="+0200" vip="ZTNA RDP" accessproxy="ZTNA RDP" gatewayid=1 clientdeviceid="6C40ACFAC7B043A4851701EB5FDD3B3D" clientdevicetags="MAC_EMS1_ZTNA_all_registered_clients/EMS1_ZTNA_all_registered_clients/MAC_EMS1_ZTNA_Kira TAG/EMS1_ZTNA_Kira TAG" proxyapptype="http" clientdevicemanageable="manageable" emsconnection="online" devid="FGT60FTK23099PH2" vd="root" dtime="2024-10-10 13:23:01" itime_t=1728559381 devname="ntd-fg"

The second one can't access due to an error (msg="Traffic denied because of failed to match a proxy-policy"):

date=2024-10-09 time=16:14:43 id=7423779172176101376 itime="2024-10-09 16:14:43" euid=3 epid=101 dsteuid=3 dstepid=1053 logflag=3 logver=702101706 type="traffic" subtype="ztna" level="notice" action="deny" policyid=15 sessionid=10994158 srcip=… dstip=10.1.0.214 srcport=52177 dstport=3389 duration=19603 proto=6 sentbyte=10454368 rcvdbyte=31622617 logid=0005000024 service="RDP" app="RDP" appcat="unscanned" srcintfrole="wan" dstintfrole="lan" policytype="proxy-policy" eventtime=1728483282890140384 wanin=31622617 wanout=7184424 lanin=10454368 lanout=32300828 crscore=30 craction=131072 crlevel="high" poluuid="7f1a8a84-dfd7-51ee-4200-2edb944b93d3" srccountry="Italy" dstcountry="Reserved" srcintf="wan1" dstintf="internal" policyname="ZTNA to RDP" msg="Traffic denied because of failed to match a proxy-policy" threatwgts=30 threatcnts=1 threatlvls=3 threats=blocked-connection threattyps=blocked-connection tz="+0200" vip="ZTNA RDP" accessproxy="ZTNA RDP" gatewayid=1 proxyapptype="http" clientdevicemanageable="manageable" devid="FGT60FTK23099PH2" vd="root" dtime="2024-10-09 16:14:43" itime_t=1728483283 devname="ntd-fg"

How is that possible?

Thank you for the support!

 

 

[AEK]

Hi Raffael

I see destination IP is not the same.

Can you try connect to the same IP?

[raffaeledp]

Hello, thanks for your replay.

Yes, destination IP is not the same, but both destination are behind the same ZTNA server:

 

  

[AEK]

Hi Raffael

Can try the following:

• Go to EMS menu: Administration > Fabric devices, edit the FortiGate device, "FortiClient Endpoint Sharing" and enable "Share all FortiClients"
• On your FortiGate, disable the ZTNA firewall rule and create a ZTNA proxy rule instead

Also, which FortiOS and FortiClient versions are you using?

[raffaeledp · Accepted solution]

I solved the problem. The solution was to create manually the XML ZTNA configuration. I had to shift down the "gateways" tag, in order to be correctly recognized by the Forticlient on macOS.