ZTNA HTTP Proxy - virtual host

[funkylicious]

Hi,

I am struggling to make a configuration in my LAB to work, which involves setting up a ZTNA HTTP Proxy which should redirect the traffic based on virtual-host/hostname.

I am running FortiOS 7.2.11 , EMS 7.4.3 and FortiClient 7.4.3 in my environment.

In EMS I have a ZTNA Destination with the FortiGate Public IP/Proxy ( Proxy Gateway:80 > Destination Host on ports 80,81 and DNS entries locally in hosts for test1.lab.local and test2.lab.local with the PUB IP/Proxy GW and if i switch the entries to the private IP I get:

ZTNA Access Denied
The page you requested has been blocked by a ZTNA restriction.
Details:	API Gateway Denied.

Tried switching from Service HTTP to TCP Forwarding, no luck

The firewall rule is in place and works for HTTPS/SMB , our focus in the matter at hand is for LAB-WIN 

config firewall policy
    edit 17
        set srcintf "wan1"
        set dstintf "any"
        set action accept
        set srcaddr "all"
        set dstaddr "LAB-WIN" "LAB-WIN-SMB" "LAB-WIN-HTTPS"
        set ztna-ems-tag "EMS1_ZTNA_not-AD-joined-PC" "EMS1_ZTNA_compliant-device"
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set nat enable
    next
end

Below the config for VIP/access-proxy/virtual-host

config firewall vip
    edit "LAB-WIN"
        set type access-proxy
        set extip PUB-IP
        set extintf "wan1"
        set server-type https
        set extport 80
        set ssl-certificate "Fortinet_SSL"
        set ssl-algorithm medium
        set ssl-pfs allow
    next
end

config firewall access-proxy
    edit "LAB-WIN"
        set vip "LAB-WIN"
        config api-gateway
            edit 1
                set service http
                set virtual-host "auto-LAB-WIN-0"
                config realservers
                    edit 1
                        set ip 192.168.200.200
                        set port 80
                    next
                end
            next
            edit 2
                set service http
                set virtual-host "auto-LAB-WIN-1"
                config realservers
                    edit 1
                        set ip 192.168.200.200
                        set port 81
                    next
                end
            next
        end
    next
end


config firewall access-proxy-virtual-host
    edit "auto-LAB-WIN-0"
        set ssl-certificate "Fortinet_SSL"
        set host "test1.lab.local"
    next
    edit "auto-LAB-WIN-1"
        set ssl-certificate "Fortinet_SSL"
        set host "test2.lab.local"
    next
end

 It doesnt seem that the traffic is reaching my backend server while running a wireshark, somehow it stops on the firewall, based on some debug commands I found for wad process, but to be honest it gives out a lot of information and cant wrap my head around it and filter out what's the information I need from it.

Any input/help will be much appreciated

[vokeldu3]

If they're external/public facing, then the lack of a DNS entry is not going to give you much additional privacy compared to having one. DNS information while useful is used tangentially in attacks - IP addresses and their contents are the primary target.