EMS - ZTNA Destinations

[Stephan_s]

Dear Colleagues,

I'm currently trying to migrate our Company from VPN to ZTNA and so we are looking into the Solution from Fortinet which looks very promising. But I struggle with some details and wanted to ask you for advice.
What exactly is the ZTNA Destinations thing for? I can setup the AccessProxy stuff on Fortigate side and it seems to be working (sometimes :D). But where comes the ZTNA Destinations into the game and why? First I thought its that the users have a thing where they can click on to quickly open a service/resource but its not working like that. 

best

stephan

[Anthony_E]

Hello Stephan,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Debbie_FTNT]

Hey Stephan,

do you mean the ZTNA destinations listed in FortiClient?

If yes:

- ZTNA comes in two different flavours, HTTP proxy and TCP proxy
-> for HTTP proxy, FortiGate essentially hosts a URL/IP that it translates to the actual server behind FortiGate, and you need to ensure the URL is resolvable from outside (a bit similar to load-balancing VIP setup)
-> for TCP proxy, FortiGate essentially has a public IP it just translates to the internal one (more like a regular port-forwarding VIP)
-> With TCP proxy, the idea is that users can access the internal IP (even when they are outside the company environment), FortiClient detects this, and automatically proxies the connection via the external configuration on FortiGate

-> the FortiClient-side component of a TCP-ZTNA setup is the ZTNA destination entry