ZTNA HTTP Proxy - virtual host

[funkylicious]

Hi,

I am struggling to make a configuration in my LAB to work, which involves setting up a ZTNA HTTP Proxy which should redirect the traffic based on virtual-host/hostname.

I am running FortiOS 7.2.11 , EMS 7.4.3 and FortiClient 7.4.3 in my environment.

In EMS I have a ZTNA Destination with the FortiGate Public IP/Proxy ( Proxy Gateway:80 > Destination Host on ports 80,81 and DNS entries locally in hosts for test1.lab.local and test2.lab.local with the PUB IP/Proxy GW and if i switch the entries to the private IP I get:

ZTNA Access Denied
The page you requested has been blocked by a ZTNA restriction.
Details:	API Gateway Denied.

Tried switching from Service HTTP to TCP Forwarding, no luck

The firewall rule is in place and works for HTTPS/SMB , our focus in the matter at hand is for LAB-WIN 

config firewall policy
    edit 17
        set srcintf "wan1"
        set dstintf "any"
        set action accept
        set srcaddr "all"
        set dstaddr "LAB-WIN" "LAB-WIN-SMB" "LAB-WIN-HTTPS"
        set ztna-ems-tag "EMS1_ZTNA_not-AD-joined-PC" "EMS1_ZTNA_compliant-device"
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set nat enable
    next
end

Below the config for VIP/access-proxy/virtual-host

config firewall vip
    edit "LAB-WIN"
        set type access-proxy
        set extip PUB-IP
        set extintf "wan1"
        set server-type https
        set extport 80
        set ssl-certificate "Fortinet_SSL"
        set ssl-algorithm medium
        set ssl-pfs allow
    next
end

config firewall access-proxy
    edit "LAB-WIN"
        set vip "LAB-WIN"
        config api-gateway
            edit 1
                set service http
                set virtual-host "auto-LAB-WIN-0"
                config realservers
                    edit 1
                        set ip 192.168.200.200
                        set port 80
                    next
                end
            next
            edit 2
                set service http
                set virtual-host "auto-LAB-WIN-1"
                config realservers
                    edit 1
                        set ip 192.168.200.200
                        set port 81
                    next
                end
            next
        end
    next
end


config firewall access-proxy-virtual-host
    edit "auto-LAB-WIN-0"
        set ssl-certificate "Fortinet_SSL"
        set host "test1.lab.local"
    next
    edit "auto-LAB-WIN-1"
        set ssl-certificate "Fortinet_SSL"
        set host "test2.lab.local"
    next
end

 It doesnt seem that the traffic is reaching my backend server while running a wireshark, somehow it stops on the firewall, based on some debug commands I found for wad process, but to be honest it gives out a lot of information and cant wrap my head around it and filter out what's the information I need from it.

Any input/help will be much appreciated

[AEK]

Hi Funkylicious

I see your firewall policy is not ZTNA (set ztna-status enabled). You need to enable it.

Furthermore as per my experience for ZTNA proxy access (ext to int) I prefer using proxy rules (type ZTNA) instead of firewall rules, since it worked with no issue.

[funkylicious]

hi @AEK ,

it appears that the command in question is available only when the policy is Standard but in my case it's already defined as ZTNA.

as for proxy-rules, if i recall correctly reading that in version 7.4+ the ZTNA rules are now configured there instead of normal firewall policies, but I think i gave that also a try and didnt worked.

[AEK]

Hi Funkylicious

Then does your FortiClient show status connected? And do you see the active tags on it?

And does FortiGate see it as active client and having the required tags?

[funkylicious]

yes, its connected, has tags and the FGT sees it.

traffic for ZTNA destinations like SMB or HTTPS are working just fine only for this setup for some reason it doesnt seem to work

[funkylicious]

anyone that managed to have this working, maybe give me a hint of what im doing wrong ?

[AEK]

Hi Funkylicious

Yes it worked for me very well but only with the following:

• TCP Forwarding instead of HTTP
• Proxy policy instead of firewall policy

Here with FOS 7.2.11 if I remember well the ZTNA apps info are not pushed automatically to EMS, if I remember well the feature is introduced in 7.4.x.

So one of possible causes (other than the two above) is that you probably made some error when configuring ZTNA apps on EMS. Try double check the ZTNA apps and ZTNA profile for the problematic app.

You can also share the related screenshots (ZTNA profile and apps on EMS, ZTNA apps on FGT) maybe we can detect the error.

[funkylicious]

hi AEK,

i just gave up trying to use a HTTP ZTNA Server, also upgrade the FGT to the latest 7.4.X version.

i've reconfigured my ZTNA server on port 443 ( LAB-WIN-HTTPS ) using service HTTP and virtual hosts for both IP/ports ( 192.168.200.200 port 80 and 81 ) and appears to be working just fine.

[AEK]

Happy to hear that it worked fine.

Indeed with FOS 7.4 is much better since all ZTNA apps info is pushed automatically from FGT to EMS, so there is no chance to make mistake.

[funkylicious]

yea, still debating if i would use the auto-add / ztna-server-info capabilities for it.

the ZTNA Server i configure on the FGT appears as web applications with all entries, which is kinda weird and in ZTNA Destination on EMS as web proxy rules