looking for solution for ZTNA w/ 2FA to AWS apps

[kitkat09811]

Hi all,

looking for suggestions on getting ZTNA with 2FA so users can access private applications in AWS. I would think that I would need FortiAuthenticator (as a cloud instance?) and a Fortigate in AWS to act as a proxy right?

Would the authenticator and Fortigate in the cloud be foregone with just FortiSASE?

Is there other options or architecture im not thinking of?

The other required item is when a user first login to his laptop whether they are local on-net or off-net, to have 2FA functionality prior to the network drives to be attached.

lasty, we have FortiClient EMS Cloud and not using it, so if this can be used in the solution?

I'm open to any suggestions.

thanks for responding.

[saleha]

Hi,

Thank you for reaching out. When using ZTNA you are using fortigate as the ztna proxy correct. As far as 2FA there are multiple options and different topologies. I will leave links for the use of ZTNA where you have forticlient EMS server since you mentioned you already have an EMS cloud server as well as using a saml authenticator. Please note that the below document is from fortios 7.0 guide. If your fortigate have a different fortios I strongly recommend changing the release number from the top of the page the one matching your firewalls as ZTNA features did change between 7.0 and 7.2 FOS:

https://docs.fortinet.com/document/fortigate/7.0.0/new-features/461532/ztna-proxy-access-with-saml-a...

There are different ways for the MFA and you can user different identity provider vendors as well. I recommend if you already have licensed products to contact your fortinet account manager or SE for a more tailored solution based on how the actual site is deployed and what would work best to migrate to ZTNA deployment.

Thank you,

saleha