A contractor needs only the HR web app. Best first design?

Correct: b. Per-app is ZTNA, not a LAN tunnel.

Zscaler ZPA is best described as…

Correct: b. Do not call ZPA a VPN.

Proof you built remote-access, not ZTNA?

Correct: a. A pool IP means a tunnel into a prefix.

FortiClient is installed. That proves…

Correct: b. The agent is not the feature.

T Techclick ← All lessons

Multi-vendor · IPsec / SSL-VPN · Lesson 1 of 8

Choose the job: tunnel the LAN, tunnel the user, or grant the app

Chat says “give them VPN.” That sentence is already three designs. Site-to-site joins two LANs. Remote-access puts a laptop on a prefix. ZTNA is a per-app grant after identity and device posture. Zscaler ZPA is not “just a VPN.”

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Pick S2S, remote-access, or ZTNA from the ticket, not from habit.
Say why a full tunnel is not Zero Trust.
Name what Zscaler ZPA / FortiOS ZTNA never do that IPsec does.
Give a strong interview answer for “is ZTNA a VPN?”

The ticket

Contractor needs the HR portal only. Junior stood up SSL-VPN full tunnel to fgt-hq. Priya’s YouTube now hairpins HQ WAN, and the contractor can ping 10.20.30.0/24. You solved the wrong job.

Quick interview answer

A VPN is a tunnel: site-to-site IPsec joins two encryption domains; remote-access (SSL-VPN or IPsec RA) puts a client in a pool. ZTNA is a per-app grant after identity + device posture. FortiOS 7.4 treats ZTNA (access proxy / ZTNA rules) as a different object than VPN → IPsec / SSL-VPN. Zscaler ZPA brokers an inside-out connector to one app. Do not call ZTNA or ZPA “just a VPN.”

Site-to-site tunnel vs remote-access client vs per-app ZTNA — Same word in chat. Three objects on the box.

Lab data · dummy only

FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.

Mental model

Job	What it tunnels	This lab	If you pick wrong
Site-to-site	LAN to LAN (gateways)	10.20.30.0/24 ↔ 10.30.0.0/24 via 198.51.100.10	Home laptops get a branch PSK
Remote-access	A user into a prefix	SSL-VPN pool 10.20.40.0/24 to LAN	Contractor can sweep the whole LAN
ZTNA	One app, after identity + posture	HR portal only, no 10.20.30.0/24 route	You built a tunnel and called it Zero Trust

Three paths, not one product

ZPA/ZTNA never give the contractor a 10.20.40.0/24 address and a route to the printer.

How to choose

Ask	Pick	Do not
Two offices, always-on LAN prefixes	IPsec S2S (route-based, later lessons)	SSL-VPN for a branch firewall
Managed laptop needs several internal prefixes	IPsec RA or SSL-VPN tunnel + split + MFA	Call it ZTNA because FortiClient is installed
One browser app, posture required, least privilege	ZTNA (FortiOS ZTNA / Zscaler ZPA)	“Just give them VPN”

https://fgt-hq.techclick-lab.in

Training mock · not live

FortiOS

DashboardNetworkVPNPolicy

Policy & Objects → ZTNA

ZTNA server hr-portal

Name

hr-portal

External interface

port1 (WAN)

Real server

10.20.30.40:443 (HR only)

ZTNA tag

EMS: corp-compliant

Not a VPN

No IPsec SA, no 10.20.40.0/24 pool

FortiOS 7.4 Policy & Objects → ZTNA (access proxy / ZTNA server + rule). Training mock.

Runbook

Side A - name the job
Who is the peer: another gateway (198.51.100.10 / Azure 203.0.113.50 / AWS 203.0.113.60), a laptop, or a single app? Write that in the ticket before you open VPN → IPsec Tunnels.
Side B - pick the object
S2S: VPN → IPsec Tunnels. RA: VPN → SSL-VPN Settings or IPsec dialup. Per-app: Policy & Objects → ZTNA, or a ZPA app segment. Different menus on purpose.
Side C - prove the blast radius
After connect: can they ping 10.20.30.80, or only the one URL? If they have a 10.20.40.x address, you built RA, not ZTNA.

fgt-hq · what object exists

get vpn ipsec tunnel summary
# S2S / RA IPsec names only - ZTNA will not appear here

get vpn ssl monitor
# RA users in 10.20.40.0/24 - empty if this ticket is ZTNA

diagnose firewall auth list
# identity on a proxy/ZTNA grant is not an IKE SA

Four failures

1 · “Zscaler is just a VPN”

ZIA inspects web. ZPA connects one app via an inside-out connector. Neither is an IPsec encryption domain to 10.20.30.0/24.

2 · Contractor on full-tunnel SSL-VPN

They can reach printers, scanners, and Priya. That is a LAN grant, not least privilege.

3 · Branch built as SSL-VPN

A firewall at 198.51.100.10 needs IPsec S2S, not a user portal.

4 · FortiClient installed, therefore ZTNA

FortiClient can do IPsec RA, SSL-VPN, or ZTNA tags. Name the feature, not the agent.

How to prove it

Close the ticket only when

1) You named S2S, RA, or ZTNA from the job. 2) The peer type matches the menu. 3) Blast radius is the app or the prefix you intended. 4) You did not call ZPA “VPN.”

Traps

Chat said	Object you actually built	Wrong next step
Give them VPN	Unknown until you name S2S / RA / ZTNA	Open the IPsec wizard
Zero Trust	Still a full tunnel if they have 10.20.40.10	Rename the portal “ZTNA”
Cloud access	S2S to Azure/AWS, not SSL-VPN	Issue a FortiClient profile

VPN scenario class series: S2S vs RA vs ZTNA · Phase-1 down · Phase-2 / proxy ID · Route vs policy · SSL split tunnel · FGT → Azure · FGT → AWS · VPN interview

Sources

Related: FortiGate IPsec · Azure hub-spoke · AWS TGW.