Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Phung_Ong
New Contributor II

ZTNA - TCP Forwarding access - server locate at branch office

 

Hi Everyone,

I am going to replace VPN method by ZTNA. the offnet subnet will need to access the HRM server which locate at branch office, I am not sure with my case, our HRM server should be public via IP public at branch office or HQ Office? does anyone have same case? can you share with me the solution?

Thanks.

ZTNA.drawio.png

 

4 REPLIES 4
hbac
Staff
Staff

Hi @Phung_Ong,

 

It depends, does you Branch FortiGate talk to EMS? Because if you use the public IP of the Branch, you will need to configure ZTNA on the Branch FortiGate and it needs to talk to EMS. 

 

If you use the public IP of the HQ, I believe it already communicate with the EMS so the traffic to HRM server will go through the IPsec tunnel. 

 

Regards, 

Phung_Ong
New Contributor II

Hi Hbac,

yes, our FG at Branch can talk to EMS. so, I should be public Our HRM via Public IP at HQ right?

Do you have any documentation talk about that?

Thanks

hbac

@Phung_Ong,

 

If the Branch FortiGate can talk to EMS, you can use the public IP address of the Branch FortiGate. Please refer to https://docs.fortinet.com/document/fortigate/7.2.0/administration-guide/166918/ztna-tcp-forwarding-a...

 

Regards, 

Phung_Ong
New Contributor II

Thanks.

so I will need to integrate FortiClient EMS with FortiGate at Brach and configure the ZTNA server at Brach office as well.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors