ZTNA Reference Guide
FortiOS 7.4
FORTINET DOCUMENT LIBRARY
https://docs.fortinet.com
FORTINET VIDEO GUIDE
https://video.fortinet.com
FORTINET BLOG
https://blog.fortinet.com
CUSTOMER SERVICE & SUPPORT
https://support.fortinet.com
FORTINET TRAINING & CERTIFICATION PROGRAM
https://www.fortinet.com/training-certification
FORTINET TRAINING INSTITUTE
https://training.fortinet.com
FORTIGUARD CENTER
https://www.fortiguard.com
END USER LICENSE AGREEMENT
https://www.fortinet.com/doc/legal/EULA.pdf
FEEDBACK
Email: techdoc@fortinet.com
September 01, 2023
FortiOS 7.4 ZTNA Reference Guide
01-740-910488-20230901
TABLE OF CONTENTS
Introduction 4
Endpoint posture check 5
Recommended posture checks 5
Other posture checks 6
CASB SaaS application support 9
Error codes and replacement messages 12
Change log 14
FortiOS 7.4 ZTNA Reference Guide 3
Fortinet Inc.
Introduction
Zero trust network access (ZTNA) is an access control method that uses client device identification, authentication, and
zero trust tags to provide role-based application access. It gives administrators the flexibility to manage network access
for on-net local users and off-net remote users. Access to applications is granted only after device verification,
authenticating the user’s identity, authorizing the user, and then performing context based posture checks using zero
trust tags.
This document provides reference information for ZTNA.
FortiOS 7.4 ZTNA Reference Guide 4
Fortinet Inc.
Endpoint posture check
The following are different context-based posture checks that FortiClient EMS 7.2 supports as part of the Zero Trust
solution:
Recommended posture checks
For vulnerable devices, checking for devices with high-risk vulnerabilities and above is recommended.
Supported operating
Rule type Posture check
systems
Critical Windows, macOS, Linux
High or higher Windows, macOS, Linux
Vulnerable devices
Medium or higher Windows, macOS, Linux
Low or higher Windows, macOS, Linux
AV software is installed and running. For
Windows, this feature supports third party AV
applications. For macOS and Linux, this feature
Windows, macOS, Linux
Antivirus software can only check if FortiClient AV protection is
enabled and does not recognize third party AV
applications.
AV signature is up-to-date Windows, macOS, Linux
Windows Defender is enabled Windows
Bitlocker Disk Encryption is enabled Windows
Exploit Guard is enabled Windows
Windows security
Application Guard is enabled Windows
Windows Firewall is enabled Windows
Automatic Updates are enabled Windows
Security FileVault Disk Encryption is enabled macOS
FortiClient installed and Telemetry is connected to Windows, macOS, Linux, iOS,
EMS management
EMS Android
Common vulnerabilities and Windows, macOS, Linux, iOS,
Presence of [CVE]
exposures (CVE) Android
FortiOS 7.4 ZTNA Reference Guide 5
Fortinet Inc.
Endpoint posture check
Supported operating
Rule type Posture check
systems
Windows, macOS, iOS,
Firewall threat Presence of [firewall threat ID]
Android
Other posture checks
Rule type Posture check Supported operating systems
User in Active Directory (AD) group Member of [AD Group] Windows, macOS, Linux
Certificate contains [Subject CN] and
Certificate Windows, macOS, Linux
[Issuer CN]
File Presence of [File] Windows, macOS, Linux
Windows, macOS, Linux, IOS,
IP range Device in the [IP Range]
Android
Logged in domain Member of [Domain] Windows, macOS, Linux
Windows, macOS, Linux, IOS,
On-Fabric status On-Fabric
Android
Windows Server 2022 Windows
Windows Server 2019 Windows
Windows Server 2016 Windows
Windows Server 2012 R2 Windows
Windows Server 2012 Windows
OS version Windows Server 2008 R2 Windows
Windows 11 Windows
Windows 10 Windows
Windows 8.1 Windows
Windows 8 Windows
Windows 7 Windows
FortiOS 7.4 ZTNA Reference Guide 6
Fortinet Inc.
Endpoint posture check
Rule type Posture check Supported operating systems
Mojave macOS
High Sierra macOS
Sierra macOS
OS version Catalina macOS
Big Sur macOS
Monterey macOS
Ventura macOS
CentOS Stream 9 Linux
CentOS Stream 8 Linux
OS version CentOS 8 Linux
CentOS 7.5 Linux
CentOS 7.4 Linux
Red Hat 8.1 Linux
Red Hat 8 Linux
OS version Red Hat 7.6 Linux
Red Hat 7.5 Linux
Red Hat 7.4 Linux
Ubuntu 22.04 Linux
Ubuntu 21.10 Linux
Ubuntu 21.04 Linux
OS version
Ubuntu 20 Linux
Ubuntu 18.04 Linux
Ubuntu 16.04 Linux
FortiOS 7.4 ZTNA Reference Guide 7
Fortinet Inc.
Endpoint posture check
Rule type Posture check Supported operating systems
Fedora 34 Linux
Fedora 33 Linux
Fedora 32 Linux
OS version Fedora 31 Linux
Fedora Linux 37 Linux
Fedora Linux 36 Linux
Fedora Linux 35 Linux
iOS 9, 10, 11, 12, 13, 14, 15, 16 iOS
OS version
Android 5, 6, 7, 8, 9, 10, 11, 12, 13 Android
Registry key [Registry Key] Windows
Running process Presence of [Running Process] Windows, macOS, Linux
Sandbox detected malware in last 7
Sandbox detection Windows, macOS
days
Windows, macOS, Linux, iOS,
User-specified
Android
Windows, macOS, Linux, iOS,
User identity Social network login
Android
Windows, macOS, Linux, iOS,
Verified user
Android
FortiEDR FortiEDR is installed and running Windows, macOS, Linux,
FortiOS 7.4 ZTNA Reference Guide 8
Fortinet Inc.
CASB SaaS application support
You can configure the FortiGate zero trust network access (ZTNA) access proxy to act as an inline cloud access security
broker (CASB) by providing access control to software-as-a-service (SaaS) traffic using ZTNA access control rules. A
CASB sits between users and their cloud service to enforce security policies as they access cloud-based resources.
FortiOS 7.2.1 and later versions support ZTNA inline CASB for SaaS application access. This topic provides information
on the supported applications.
The inline CASB database, as of version 1.00031, supports the following SaaS applications:
ZTNA access proxy application name SaaS application
adobe Adobe services domains
adp ADP
atlassian Atlassian
aws-s3 AWS S3
azure Azure
box Box
citrix Citrix
confluence Confluence
docusign DocuSign
dropbox Dropbox
egnyte Egnyte
github GitHub
gmail Gmail
google-cloud Google Cloud
google-drive Google Drive
google-office Google Office
google-web Google Web Search domains
jira Jira
ms-excel Microsoft Excel
ms-exchange Microsoft Exchange
ms-onedrive Microsoft OneDrive
ms-outlook Microsoft Outlook
ms-powerpoint Microsoft PowerPoint
FortiOS 7.4 ZTNA Reference Guide 9
Fortinet Inc.
CASB SaaS application support
ZTNA access proxy application name SaaS application
ms-teams Microsoft Teams
ms-word Microsoft Word
oracle-cloud Oracle Cloud
salesforce Salesforce
sap SAP
Servicenow ServiceNow
sharepoint SharePoint
twilio-video-cloud Twilio video cloud
webex Webex
workplace Workplace
youtube YouTube
zendesk Zendesk
zoom Zoom
The inline CASB database, as of version 1.00031, supports the following SaaS access control:
ZTNA access proxy access control name SaaS access control
box-download Box download
box-upload Box upload
dropbox-download Dropbox download
dropbox-upload Dropbox upload
gmail-getAttach Gmail download attachment
azure Azure
ms-onedrive-download MS OneDrive download
ms-outlook-getAttach MS Outlook download attachment
The inline CASB database, as of version 1.00031, supports the following SaaS application groups:
ZTNA access proxy application name SaaS application group
MS Microsoft SaaS
For a complete list, use the following CLI commands to retrieve the corresponding lists.
Display the list of applications:
# diagnose saas show apps
FortiOS 7.4 ZTNA Reference Guide 10
Fortinet Inc.
CASB SaaS application support
Display details of each application:
# diagnose saas show details
FortiOS 7.4 ZTNA Reference Guide 11
Fortinet Inc.
Error codes and replacement messages
The following table summarizes the replacement message errors based on error code and category available in FortiOS
7.4.1 and later.
Error Error Error message Description
code category
001 Invalid ZTNA Certificate The page you requested has The client endpoint has an invalid
been blocked because the ZTNA certificate that the FortiGate
certificate is invalid. cannot recognize.
002 Invalid ZTNA Certificate The page you requested has The client endpoint did not
been blocked because the ZTNA provide a client certificate for the
certificate is empty. FortiGate to verify.
003 Invalid ZTNA Certificate The page you requested has The client endpoint has
been blocked because the device FortiClient installed (hence
is manageable but with an empty manageable), but did not provide
ZTNA certificate. a client certificate for the
FortiGate to verify.
021 ZTNA Application Not Found The page you requested has The client endpoint is looking for
been blocked because no API a page or service that is not
gateway was matched. configured in the FortiGate's
ZTNA settings.
022 ZTNA Application Not Found The page you requested has The FortiGate is unable to serve
been blocked because the real the requested page or service
server in the API gateway cannot because it cannot find the real
be found. server.
023 ZTNA Application Not Found The page you requested has The FortiGate cannot resolve the
been blocked because ZTNA FQDN in the client endpoint's
FQDN DNS failed. request.
041 ZTNA Portal Error The page you requested has The FortiGate is unable to match
been blocked because SSL VPN a bookmark in the SSL VPN web
bookmark address failed. portal used by the ZTNA
application gateway.
061 ZTNA Policy Deny The page you requested has There is no ZTNA policy that
been blocked because no policy matches the destination page
was matched. that the client endpoint is
requesting.
062 ZTNA Policy Deny The page you requested has The traffic matched a ZTNA deny
been blocked because a policy policy.
with action deny was matched.
FortiOS 7.4 ZTNA Reference Guide 12
Fortinet Inc.
Error codes and replacement messages
Error Error Error message Description
code category
063 ZTNA Policy Deny The page you requested has The endpoint client is using a
been blocked because the client client certificate issued by
cert has been revoked. FortiClient EMS that has been
revoked.
064 ZTNA Policy Deny The page you requested has The endpoint client has a ZTNA
been blocked because the tags tag that matches a ZTNA deny
matched a deny policy. policy.
065 ZTNA Policy Deny The page you requested has The endpoint client's ZTNA tags
been blocked because the tags did not match any ZTNA policies,
didn’t match any policy. and its traffic is implicitly denied.
066 ZTNA Policy Deny The page you requested has The FortiGate cannot find any
been blocked because no device device information for the client
info was found. endpoint, resulting in a failed
verification of the client.
067 ZTNA Policy Deny The page you requested has The client endpoint is not
been blocked because the device connected to FortiClient EMS,
is offline. hence is considered offline and
blocked by the FortiGate.
FortiOS 7.4 ZTNA Reference Guide 13
Fortinet Inc.
Change log
Date Change Description
2023-07-19 Initial release.
2023-09-01 Added Error codes and replacement messages on page 12.
FortiOS 7.4 ZTNA Reference Guide 14
Fortinet Inc.
www.fortinet.com
Copyright© 2022 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein
may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were
attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance
results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract,
signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only
the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal
conditions as in Fortinet’s internal lab tests. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change,
modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.
