About Zero Trust Application Gateway
Zero Trust Network Access (ZTNA) is an access control method that uses client device identification, authentication, and Zero Trust tags to provide role-based application access. It gives administrators the flexibility to manage network access for On-net local users and Off-net remote users. Access to applications is granted only after device verification, authenticating the user’s identity, authorizing the user, and then performing context based posture checks using Zero Trust tags.
Traditionally, a user and a device have different sets of rules for on-net access and off-net VPN access to company resources. With a distributed workforce and access that spans company networks, data centers, and cloud, managing the rules can become complex. User experience is also affected when multiple VPNs are needed to get to various resources. ZTNA can improve this experience.
A FortiGate ZTNA application gateway allows users to securely access resources through SSL encrypted connections. Based on device identification, authentication and security posture checks, the application gateway makes the policy decisions to allow or deny the connections. This happens transparently in real-time, allowing for improved security and a better user experience.
Zero Trust Application Gateway for SaaS applications
The Zero Trust application gateway for SaaS applications delivers Zero Trust Network Access to companies that deploy SaaS applications and services in the cloud. A Zero Trust application gateway is deployed in the cloud, protecting resources on the private subnets by enforcing security and access control.
When remote FortiClient endpoints register to FortiClient EMS, device information, log on user information, and security posture are all shared over ZTNA telemetry with the EMS server. Clients also make a certificate signing request to obtain a client certificate from the EMS that is acting as the ZTNA Certificate Authority (CA).
Based on the client information, EMS applies matching Zero Trust tagging rules to tag the clients. These tags, and the client certificate information, are synchronized with the FortiGate in real-time. This allows the FortiGate to verify the client's identity using the client certificate, and grant access based on the ZTNA tags applied in the ZTNA rule.
For more information, see What is ZTNA? in the ZTNA Concept Guide.
For further understanding of how ZTNA is configured on FortiGate and FortiClient EMS, see the following chapters in the corresponding administration guides: