ZTNA Rules interfere while on VPN

[abrkich]

I've been exploring ZTNA and for the most part I have it working as expected when off site with some test cases, accessing some web sites and RDP to a box or two. This is great but since we still use a VPN (And most likely always will use/have it for a while), I've noticed that when ZTNA routes are active on the client, pushed from EMS, I am unable to get to those resources when connected to the VPN. For example, I can ping the server but the RDP port in the ZTNA rule seems to prevent me from accessing it.

I'm not sure if this is normal but since I know ZTNA is kind of a solution that should work both in and out of the network, I wasn't sure if anything is actually wrong and I just need to open firewall policies to allow the communication to work. My thought was to add rules to make the VPN connection treat the device on premise but that felt more like a trick than a solution, unless it is. Seeing what other people think about it and trying to get some thoughts on what would be some good next steps. Ideally, I want to bypass ZTNA for now on the VPN (Onprem profile disables ZTNA routes, for now).

[AEK]

ZTNA uses FortiClient as a proxy, so when you try access RDP then FCT catches the request before it is routed and tunnels it directly to the remote FGT. That's why it has priority over VPN and even over your system's routing table.

On the other hand ZTNA is much more secure than SSL-VPN (certificate, tag, posture, ...), so if you have ZTNA you should access your resources (at least the critical ones) through ZTNA, not SSL-VPN (which is not recommended anymore).