ZTNA HTTPS access proxy example

In this example, an HTTPS access proxy is configured to demonstrate its function as a reverse proxy on behalf of the web server it is protecting. It verifies user identity, device identity, and trust context, before granting access to the protected source.

This example shows access control that allows or denies traffic based on ZTNA tags. Traffic is allowed when the FortiClient endpoint is tagged as Low risk, and denied when the endpoint is tagged with Malicious-File-Detected.

This example assumes that the FortiGate EMS fabric connector is already successfully connected.

Note

To configure ZTNA in the GUI, go to System > Feature Visibility and enable Zero Trust Network Access.

To configure a Zero Trust tagging rule on the FortiClient EMS:
  1. Log in to the FortiClient EMS.

  2. Go to Zero Trust Tags > Zero Trust Tagging Rules, and click Add.

  3. In the Name field, enter Malicious-File-Detected.

  4. In the Tag Endpoint As dropdown list, select Malicious-File-Detected.

    EMS uses this tag to dynamically group together endpoints that satisfy the rule, as well as any other rules that are configured to use this tag.

  5. Click Add Rule then configure the rule:

    1. For OS, select Windows.

    2. From the Rule Type dropdown list, select File and click the + button.

    3. Enter a file name, such as C:\virus.txt.

    4. Click Save.

  6. Click Save.

To configure a ZTNA server for HTTPS access proxy in the GUI:
  1. Go to Policy & Objects > ZTNA and select the ZTNA Servers tab.

  2. Click Create New.

  3. Set Name to WIN2K16-P1.

  4. Configure the network settings:

    1. Set External interface to port1.

    2. Set External IP to 192.168.2.86.

    3. Set External port to 8443.

  5. Select the Default certificate. Clients will be presented with this certificate when they connect to the access proxy VIP.

  6. Add server mapping:

    1. In the Service/server mapping table, click Create New.

    2. Set Service to HTTPS.

    3. Set Virtual Host to Any Host.

    4. Configure the path as needed. For example, to map to winserver.fgdocs.com/fortigate, enter /fortigate.

    5. Add a server:

      1. In the Servers table, click Create New.

      2. Set IP to 192.168.20.6.

      3. Set Port to 443.

      4. Click OK.

    6. Click OK.

  7. Click OK.

To configure ZTNA rules to allow and deny traffic based on ZTNA tags in the GUI:
  1. Go to Policy & Objects > ZTNA and select the ZTNA Rules tab.

  2. Create a rule to deny traffic:

    1. Click Create New.

    2. Set Name to ZTNA-Deny-malicious.

    3. Set Incoming Interface to port1.

    4. Set Source to all.

    5. Add the ZTNA tag Malicious-File-Detected.

      This tag is dynamically retrieved from EMS when you first created the Zero Trust Tagging Rule.

    6. Select the ZTNA server WIN2K16-P1.

    7. Set Action to DENY.

    8. Enable Log Violation Traffic.

    9. Click OK.

  3. Create a rule to allow traffic:

    1. Click Create New.

    2. Set Name to proxy-WIN2K16-P1.

    3. Set Incoming Interface to port1.

    4. Set Source to all. This can also be set to specific IP addresses to only allow those addresses to connect to this HTTPS access proxy.

    5. Add the ZTNA tag Low.

    6. Select the ZTNA server WIN2K16-P1.

    7. Configure the remaining options as needed.

    8. Click OK.

  4. On the ZTNA rules list, make sure that the deny rule (ZTNA-Deny-malicious) is above the allow rule (proxy-WIN2K16-P1).

To configure HTTPS access in the CLI:
  1. Configure the access proxy VIP:

    config firewall vip
        edit "WIN2K16-P1"
            set type access-proxy
            set extip 192.168.2.86
            set extintf "port1"
            set server-type https
            set extport 8443
            set ssl-certificate "Fortinet_SSL"
        next
    end
  2. Configure the server and path mapping:

    config firewall access-proxy
        edit "WIN2K16-P1"
            set vip "WIN2K16-P1"
            set client-cert enable
            set log-blocked-traffic enable
            config api-gateway
                edit 1
                    config realservers
                        edit 1
                            set ip 192.168.20.6
                        next
                    end
                next
            end
        next
    end
  3. Configure ZTNA rules:

    config firewall proxy-policy
        edit 3
            set name "ZTNA-Deny-malicious"
            set proxy access-proxy
            set access-proxy "WIN2K16-P1"
            set srcintf "port1"
            set srcaddr "all"
            set dstaddr "all"
            set ztna-ems-tag "FCTEMS0000109188_Malicious-File-Detected"
            set schedule "always"
            set logtraffic all
        next
        edit 2
            set name "proxy-WIN2K16-P1"
            set proxy access-proxy
            set access-proxy "WIN2K16-P1"
            set srcintf "port1"
            set srcaddr "all"
            set dstaddr "all"
            set ztna-ems-tag "FCTEMS0000109188_Low"
            set action accept
            set schedule "always"
            set logtraffic all
        next
    end

Testing the remote access to the HTTPS access proxy

After FortiClient EMS and FortiGate are configured, the HTTPS access proxy remote connection can be tested.

Access allowed:
  1. On the remote Windows PC, open FortiClient.

  2. On the Zero Trust Telemetry tab, make sure that you are connected to the EMS server.

  3. Open a browser and enter the address of the server and the access port. When entering the FQDN, make sure that the DNS can resolve the address to the IP address of the FortiGate. In this example, winserver.fgdocs.com resolves to 192.168.2.86.

  4. The browser prompts for the client ce