Our organization is embarking on a comprehensive zero-trust network access (ZTNA) initiative, and I have been tasked with evaluating the suitability of our existing FortiGate firewalls (running 7.4) as the primary enforcement point. After a preliminary architecture review, I have significant reservations about using FortiGate as the core ZTNA component, primarily due to its inherent network-centric posture and the complexity of its identity-driven policies at scale. While Fortinet's ZTNA offering is integrated, it often feels like a feature extension of a VPN rather than a ground-up zero-trust model.
The common alternative proposed in our industry circles is Zscaler Private Access. However, due to specific data sovereignty requirements and a strategic preference for a non-proxy, non-SASE-bundle solution, Zscaler is not a viable candidate for this project. We require an alternative that is architecturally distinct from both traditional firewalls and global cloud proxies.
I am seeking community reviews and comparisons for dedicated ZTNA platforms that can serve as a strategic alternative. My primary evaluation criteria are as follows:
* **Architectural Model:** A true service-centric model (not network-centric) where access is granted to specific applications, not IP segments.
* **Identity Integration:** Granular, context-aware policies based on user/group identity, device posture, and application context, with strong integration with Azure AD.
* **Deployment Flexibility:** Ability to deploy connectors (gatemays) within our on-premises and cloud (AWS) environments, without routing all traffic through a vendor's cloud.
* **Performance & Visibility:** Detailed logging and analytics on user-access patterns, session health, and policy denials for continuous verification.
Based on initial research, I have shortlisted several potential candidates but lack real-world workflow insights. I am particularly interested in comparative experiences with:
* **Tailscale** / **Headscale** (self-hosted)
* **Cloudflare Access**
* **Palo Alto Networks Prisma Access** (specifically its ZTNA components, distinct from their NGFW)
* **Citrix Secure Private Access**
Could anyone with production deployment experience, particularly those who have migrated from a FortiGate-heavy environment, provide detailed feedback on the following?
1. The administrative overhead of maintaining identity-to-policy mappings compared to FortiGate's user groups.
2. The granularity of application-level logging and the ability to export this data for external analysis (e.g., to a SIEM or data warehouse).
3. Any significant pitfalls encountered during the transition, especially concerning legacy applications or non-HTTP/S protocols.
For context, a simplified example of our current FortiGate policy logic (which we find cumbersome) is below. We aim for a more declarative policy model.
```
config firewall policy
edit 100
set name "ZTNA-Candidate-App"
set srcintf "port1"
set dstintf "port2"
set srcaddr "user-group-azure-sync"
set dstaddr "app-server-ip"
set action accept
set schedule "always"
set service "HTTP HTTPS SSH"
set groups "SSO-Users"
set fsso enable
set nat enable
next
end
```
Your detailed comparisons, workflow reports, and pricing feedback would be invaluable to our evaluation.
Data > opinions