Hey everyone! Been deep in the weeds on cloud security lately and decided to build a full ZTNA lab setup using FortiGate-VM in AWS, paired with FortiClient EMS. The goal was to mimic a real-world scenario where only authenticated users and devices get access to specific apps, nothing more. No open VPN tunnels to the whole VPC!
I started with a FortiGate-VM (byol) in a public subnet, with the backend servers (a test web app and an RDP host) in a private subnet. The key was ditching the idea of network-level access and going pure application-level with TCP tunnels.
The core of the config is the firewall policy that uses ZTNA tags. Here's the meat of the rule that grants access:
```
config firewall policy
edit 0
set name "ztna-webapp-access"
set srcint "port1"
set dstint "port2"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set groups "ZTNA_WebApp_Group"
set fsso disable
set nat enable
set ztna-status enable
set ztna-tags "ZTNA_Tag_WebApp"
next
end
```
The magic really happens in the ZTNA proxy access rules and the FortiClient EMS setup. I have EMS configured to push the tags to enrolled and compliant devices. So a user with FortiClient only gets the TCP tunnel to the web app's private IP on port 443 if their device tag matches. No tag, no traffic. Even if someone got on the VPN, they can't reach anything without the specific ZTNA tag.
I'm pretty happy with it, but I'm curious about a few things from others who've done this:
* I'm using the FCPM for certificate management, but I wonder if there's a cleaner way to handle device certificate rotation at scale.
* Any gotchas with TCP tunneling performance for latency-sensitive apps? My quick tests were fine, but I'd love real-world data.
* How are you all handling logging and observability for these ZTNA sessions? I'm pulling logs into a Grafana dashboard, but correlating user -> tag -> session was a bit tricky.
This feels like a solid step beyond just a VPN, especially for a hybrid workforce. The cost of running the FortiGate-VM and EMS isn't trivial, but compared to a full-blown commercial ZTNA service, it's a win for our use case.
cost first, then scale