Configuring a ZTNA server on FortiPAM

To configure a ZTNA server on FortiPAM:

ZTNA servers can only be configured via the CLI (config firewall access-proxy).

1. In the CLI console enter the following commands to configure a ZTNA server:

   config firewall access-proxy

   edit "fortipam_access_proxy"

   set vip "fortipam_vip"

   set client-cert enable #Must be enabled

   config api-gateway

   edit 1

   set url-map "/pam"

   set service pam-service

   next

   edit 2

   set url-map "/tcp"

   set service tcp-forwarding

   config realservers

   edit 1

   set address "all"

   next

   end

   next

   edit 3

   set service gui

   config realservers

   edit 1

   set ip 127.0.0.1

   set port 80

   next

   end

   next

   end

   next

   end

   From now on, you must select the browser certificate to access FortiPAM GUI. In this example, you must click OK to select the certificate issued by the EMS server.