Fortinet Universal ZTNA

Fortinet Universal ZTNA gives users zero trust access to applications, wherever the apps run and wherever the users work. The same ZTNA policies apply to remote workers and to users in the office. Before it grants access, it checks the user's identity, the device's identity and the device's security posture. Each grant covers a single application for that session. A FortiGate running FortiOS 7.0 or later acts as the ZTNA application gateway and enforcement point. FortiClient runs on the endpoint and shares device, user and posture data with FortiClient EMS. EMS turns that data into security posture tags and syncs them with the FortiGate in real time. The gateway offers an HTTPS access proxy for web apps, a TCP forwarding access proxy for other TCP apps, and an SSH access proxy. FortiClient sets up TLS encryption to the access proxy automatically. For devices on the local network, IP/MAC based access control pairs addresses with posture tags. Users can sign in with SAML, LDAPS, or MFA through FortiAuthenticator. Windows users signed in with Microsoft Entra ID can reach ZTNA apps without signing in again. Fortinet says the ZTNA features are built into FortiOS, so FortiGate customers can move from VPN to ZTNA at no added cost. The FortiClient agent also bundles VPN, vulnerability scanning, URL filtering and endpoint protection. Fortinet describes the design as fit for cloud-delivered or on-premises use, with apps in data centers, clouds or SaaS.