Technical Tip: How to implement ZTNA TCP forwarding for public-facing servers

[pmeet]

Description	This article describes how to implement ZTNA TCP forwarding for public-facing servers.
Scope	FortiOS , FortiClient, Forticlient EMS
Solution	First, create a ZTNA destination on the EMS and apply the ZTNA destination profile to the correct End point policy. In this example, ZTNA TCP-forwarding will be applied to www.youtube.com. Confirm the following on the endpoint and FortiClient: The IP 10.235.0.1 is what will be provided by the FortiClient. This ensures that TCP forwarding is applied as expected on the endpoint. Now, create a ZTNA server and Proxy policy on the FortiGate to authenticate traffic. Create a FQDN address object on the FortiGate with www.youtube.com and use it in the Server field as above: ZTNA tags can be applied to the policy as necessary as well: Traffic will now be allowed by the proxy policy, and ZTNA will be applied when the user accesses YouTube on the endpoint.