ZTNA - TCP Forwarding access - server locate at branch office

[Phung_Ong]

Hi Everyone,

I am going to replace VPN method by ZTNA. the offnet subnet will need to access the HRM server which locate at branch office, I am not sure with my case, our HRM server should be public via IP public at branch office or HQ Office? does anyone have same case? can you share with me the solution?

Thanks.

[hbac]

Hi @Phung_Ong,

It depends, does you Branch FortiGate talk to EMS? Because if you use the public IP of the Branch, you will need to configure ZTNA on the Branch FortiGate and it needs to talk to EMS. 

If you use the public IP of the HQ, I believe it already communicate with the EMS so the traffic to HRM server will go through the IPsec tunnel. 

Regards, 

[Phung_Ong]

Hi Hbac,

yes, our FG at Branch can talk to EMS. so, I should be public Our HRM via Public IP at HQ right?

Do you have any documentation talk about that?

Thanks

[hbac]

@Phung_Ong,

If the Branch FortiGate can talk to EMS, you can use the public IP address of the Branch FortiGate. Please refer to https://docs.fortinet.com/document/fortigate/7.2.0/administration-guide/166918/ztna-tcp-forwarding-a...

Regards, 

[Phung_Ong]

Thanks.

so I will need to integrate FortiClient EMS with FortiGate at Brach and configure the ZTNA server at Brach office as well.