ZTNA Solution

[cctv]

Hi, I wanted to ask about ZTNA. Is it mandatory to use a ZTNA server? If we don't use it, who handles user authentication and authorization? Will EMS itself or Fortigate do this?

[mpeddalla]

Hello  @cctv ,

Thank you for contacting the Fortinet Forum portal.

-In general, even if you configure the ZTNA server on Fortigate with the public of Fortigate initial authentication based on rules and tags the client certificate is used to authenticate which is supposed to be sent from Forticlient EMS to all clients. If the certificates are not presented during checks, the connection will be rejected by Fortigate.

refer below article 

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/25915/establish-device-ident...

Best regards,

Manasa.

If you feel the above steps helped resolve the issue, mark the reply as solved so that other customers can get it easily while searching for similar scenarios.

[cctv]

No, I don't think I understand you correctly. Is this ZTNA server an appliance? Is it a software? Or a virtual machine?
If this is a software like FortiClient, what should it be installed on? For example, Windows Server 2022 or CentOS with a specific resource, and we introduce the IP of that server to FortiGate as the ZTNA server?

And In this scenario, the authentication task is the responsibility of the Auth server like LDAP or Active Directory. So, what is the role of EMS?

[sfurey]

Hi cctv,

I had the same exact question when first setting this up a few years ago.  For all of the documentation on ZTNA nobody ever really explains the basics.  The "ZTNA server" is nothing more than your firewall.  You will use the IP address of your outside interface as your ZTNA server. Assuming you have an EMS server, make sure to connect the inside address within Security Fabric / Fabric Connectors. Now you can go to Policies & Objects / ZTNA and create a ZTNA server (again, this is simply the outside interface of your Fortigate). Declare an external port (we use 65000 and above), and create a server mapping (bottom of ZTNA server config). This last part is kind of like a NAT or network translation.  You will create a TCP Forward here and specify either a host or entire subnet. If you specify the subnet, you will likely want to specify 'All Ports'. This allows you to connect via both RDP and SMB (SMB = Windows file share). When this is complete you will have to create your ZTNA rule to allow ZTNA traffic thru the outside interface to the ZTNA server you created above. If you're using version 7.2.6 or above you will now find the ZTNA rules under "Policies and Objects / Proxy Policy" (you may have to add this via Feature Visibility - see https://community.fortinet.com/t5/FortiGate/Technical-Tip-ZTNA-rules-options-after-7-2-5-upgrade/ta-...). 

I hope this is helpful (I wish someone told me this)!!!

[sfurey]

Incidentally, you will need the latest version of FortiClient installed for this to work, and you will need to either manually create ZTNA Destinations within FortiClient or you can automate this by purchasing EMS and creating on-net/off-net policies (on-net when you're connected to office or VPN and off-net when you're not).  While at home for example, you will get the off-net policy. All of the ZTNA Destinations you create in EMS will automatically be populated within FortiClient, and you will be able to connect to them (via RDP or Windows file share) without having to connect to VPN.