ZTNA connector - reverse gateway and forwarder

Continuing on from the ZTNA service connector example, a FortiGate can be used as the ZTNA edge device in place of the FortiPAM. When acting as the edge device, the FortiGate may act as a reverse gateway just as the FortiPAM did, or it may function as a ZTNA query forwarder, directly forward client’s ZTNA query to next hop.

FortiGate as a reverse gateway

To configure the ZTNA Edge FortiGate as a reverse gateway:

config ztna connector-edge
    set status enable
    set interface "port2"
    set port 8443
    set server-cert "mTLS_rev_conn"
    set trusted-client-ca "CSF_CA_Cert_7edfcd73755d4c909d8057433329ef2b_1"
end

config ztna service-connector
    edit "svc-conn"
        set connection-mode reverse
        set forward-address "10.1.100.2"
        set forward-port 4443
        set certificate "Fortinet_Factory"
        set trusted-ca "Fortinet_Sub_CA"
        set relay-dev-info enable
        set relay-user-info enable
        set health-check-interval 300
        set forward-destination-cn "mtls_gw"
    next
end

config ztna traffic-forward-proxy
    edit "ztfp"
        set vip "ztna2"
        set host "qa.ftnttest.com"
        config url-route
            edit "route"
                set service-connector "svc-conn"
            next
        end
    next
end

config firewall vip
    edit "ztna2"
        set vip-id 1
        set type access-proxy
        set server-type https
        set extip 172.18.62.86
        set extintf "port3"
        set extport 4443
        set ssl-certificate "Fortinet_SSL"
    next
end

FortiGate as a forwarder

To configure the ZTNA Edge FortiGate as a ZTNA forwarder:

config ztna service-connector
    edit "fwd-svc"
        set forward-address "10.1.100.2"
        set forward-port 4443
        set certificate "Fortinet_Factory"
        set trusted-ca "Fortinet_Sub_CA"
        set relay-dev-info enable
    next
end

config ztna traffic-forward-proxy
    edit "ztfp"
        set vip "ztna2"
        set host "qa.ftnttest.com"
        config url-route
            edit "route"
                set service-connector "fwd-svc"
            next
        end
    next
end

config firewall vip
    edit "ztna2"
        set vip-id 1
        set type access-proxy
        set server-type https
        set extip 172.18.62.86
        set extintf "port3"
        set extport 4443
        set ssl-certificate "Fortinet_SSL"
    next
end