How to setup Fortinet ZTNA Access Proxy (ZTNA Setup) 

Always happy to help!

Yes, FortiClient is needed to make this seamless. Thank you for learning with me!

You would want to use dns to map your public IP to your external IP, if you can. Otherwise users would have to know that IP to type it in. There is a way through policy to extend that info to forticlient so when a user tries to access a remote resource it know what public IP to use. I didn’t show that in the video but that is possible and can be setup via ems. This is known as TCP forwarding rules. You can find documentation on fortinets support page for ZTNA. Your second question is correct. You would ideally setup a vip for the ems server to register to remotely so users can sync tags on demand. I hope this was helpful!

That’s why I tried the upgrade first to fix my issues but even that didn’t do it. I do want to add for others to see. Make sure your FortiClient has the ZTNA certificate permission if you deploy a custom install package. Otherwise the client will never ask to agent to authenticate.

Is there any labs provided by Forti? Paid or free

Your 2nd question is correct and pretty much answers the first. The Fortigate acts as a proxy to handle the connections to the LAN and the remote end user. The Fortigate will respond to requests on behalf of the local resources like a normal proxy server would. You could setup a DNS record with the public IP to make things easier for end users. As far as the last question I had a ton of issues getting it to work so the second proxy server was just for testing. You could setup just one and through policy achieve the desired results. I hope this was helpful and thank you for watching and subscribing!

@@ChadEmery Thanks Chad. I was able to resolve many issues thanks to you. Also do we have to have multiple external IP addresses to configure ZTNA servers or is there a way to distinguish them if we have one external IP. And the URL you used "firewall1", any specific reason to use that ?

@@usamasafdar6053 You can setup one access server and use policy to differentiate between internal services. The example was supposed to show that via the url /firewall I could reach a certain firewall and then map others that way but unfortunately that didn’t work and isn’t the suggested way of doing it so I apologize for the confusion there. A better way to map multiple resources is through the use of external ports or setup TCP rules via fortiems. If you look through the documentation on their site there is good information on achieving this.