# Choose the job: tunnel the LAN, tunnel the user, or grant the app Source: https://ai.techclick.in/blog_vpn_s2s_vs_ra_vs_ztna Markdown: https://ai.techclick.in/blog_vpn_s2s_vs_ra_vs_ztna.md Publisher: Techclick Infosec Pvt Ltd S2S tunnels LANs. Remote-access tunnels a user. ZTNA is per-app, not a VPN. Dummy fgt-hq 203.0.113.10. ## The ticket Contractor needs the HR portal only. Junior stood up SSL-VPN full tunnel to fgt-hq . Priya’s YouTube now hairpins HQ WAN, and the contractor can ping 10.20.30.0/24. You solved the wrong job. Quick interview answer A VPN is a tunnel : site-to-site IPsec joins two encryption domains; remote-access (SSL-VPN or IPsec RA) puts a client in a pool. ZTNA is a per-app grant after identity + device posture. FortiOS 7.4 treats ZTNA (access proxy / ZTNA rules) as a different object than VPN → IPsec / SSL-VPN. Zscaler ZPA brokers an inside-out connector to one app. Do not call ZTNA or ZPA “just a VPN.” Hero · three jobs Same word in chat. Three objects on the box. Lab data · dummy only FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60 . RFC 5737. Not a customer. ## Mental model Job What it tunnels This lab If you pick wrong Site-to-site LAN to LAN (gateways) 10.20.30.0/24 ↔ 10.30.0.0/24 via 198.51.100.10 Home laptops get a branch PSK Remote-access A user into a prefix SSL-VPN pool 10.20.40.0/24 to LAN Contractor can sweep the whole LAN ZTNA One app, after identity + posture HR portal only, no 10.20.30.0/24 route You built a tunnel and called it Zero Trust Three paths, not one product S2S joins LANs, RA joins a user, ZTNA grants one app HQ LAN 10.20.30.0/24 fgt-hq 203.0.113.10 - S2S IPsec to 198.51.100.10 RA / SSL-VPN ZTNA / ZPA Branch LAN 10.30.0.0/24 Priya pool .40.x one app, no LAN ZPA/ZTNA never give the contractor a 10.20.40.0/24 address and a route to the printer. ## How to choose Ask Pick Do not Two offices, always-on LAN prefixes IPsec S2S (route-based, later lessons) SSL-VPN for a branch firewall Managed laptop needs several internal prefixes IPsec RA or SSL-VPN tunnel + split + MFA Call it ZTNA because FortiClient is installed One browser app, posture required, least privilege ZTNA (FortiOS ZTNA / Zscaler ZPA) “Just give them VPN” https://fgt-hq.techclick-lab.in Training mock · not live FortiOS Dashboard Network VPN Policy Policy & Objects → ZTNA ### ZTNA server hr-portal Name hr-portal External interface port1 (WAN) Real server 10.20.30.40:443 (HR only) ZTNA tag EMS: corp-compliant Not a VPN No IPsec SA, no 10.20.40.0/24 pool Cancel Save FortiOS 7.4 Policy & Objects → ZTNA (access proxy / ZTNA server + rule). Training mock. ## Runbook #### Side A - name the job Who is the peer: another gateway (198.51.100.10 / Azure 203.0.113.50 / AWS 203.0.113.60), a laptop, or a single app? Write that in the ticket before you open VPN → IPsec Tunnels. - #### Side B - pick the object S2S: VPN → IPsec Tunnels. RA: VPN → SSL-VPN Settings or IPsec dialup. Per-app: Policy & Objects → ZTNA, or a ZPA app segment. Different menus on purpose. - #### Side C - prove the blast radius After connect: can they ping 10.20.30.80, or only the one URL? If they have a 10.20.40.x address, you built RA, not ZTNA. fgt-hq · what object exists get vpn ipsec tunnel summary # S2S / RA IPsec names only - ZTNA will not appear here get vpn ssl monitor # RA users in 10.20.40.0/24 - empty if this ticket is ZTNA diagnose firewall auth list # identity on a proxy/ZTNA grant is not an IKE SA ## Four failures ### 1 · “Zscaler is just a VPN” ZIA inspects web. ZPA connects one app via an inside-out connector. Neither is an IPsec encryption domain to 10.20.30.0/24. ### 2 · Contractor on full-tunnel SSL-VPN They can reach printers, scanners, and Priya. That is a LAN grant, not least privilege. ### 3 · Branch built as SSL-VPN A firewall at 198.51.100.10 needs IPsec S2S, not a user portal. ### 4 · FortiClient installed, therefore ZTNA FortiClient can do IPsec RA, SSL-VPN, or ZTNA tags. Name the feature, not the agent. ## How to prove it Close the ticket only when 1) You named S2S, RA, or ZTNA from the job. 2) The peer type matches the menu. 3) Blast radius is the app or the prefix you intended. 4) You did not call ZPA “VPN.” ## Traps Chat said Object you actually built Wrong next step Give them VPN Unknown until you name S2S / RA / ZTNA Open the IPsec wizard Zero Trust Still a full tunnel if they have 10.20.40.10 Rename the portal “ZTNA” Cloud access S2S to Azure/AWS, not SSL-VPN Issue a FortiClient profile ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 A contractor needs only the HR web app. Best first design? Site-to-site IPsec to their house ZTNA / ZPA per-app grant SSL-VPN full tunnel to 0.0.0.0/0 Policy-based IPsec with 0.0.0.0/0 selectors Correct: b . Per-app is ZTNA, not a LAN tunnel. Q2 Zscaler ZPA is best described as… Just a VPN with a new logo Per-app inside-out access, not an encryption-domain tunnel The same as FortiOS Phase-1 A replacement for UDP 500 only Correct: b . Do not call ZPA a VPN. Q3 Branch LAN 10.30.0.0/24 must reach HQ 10.20.30.0/24. Object? SSL-VPN portal IPsec site-to-site ZTNA server only Local Network Gateway without a tunnel Correct: b . Two LANs = S2S. Q4 Proof you built remote-access, not ZTNA? get vpn ssl monitor shows a 10.20.40.x address No IKE SA exists EMS tag only Azure LNG is empty Correct: a . A pool IP means a tunnel into a prefix. Q5 FortiClient is installed. That proves… ZTNA is in use Nothing until you name IPsec RA, SSL-VPN, or ZTNA Phase-1 is up Split tunnel is on Correct: b . The agent is not the feature. Q6 Strong interview line? VPN and ZTNA are synonyms VPN tunnels a network; ZTNA grants an app after identity and posture Always start with full tunnel Zscaler replaces IKE Phase-2 Correct: b . This lesson. Check answers Reset VPN scenario class series: S2S vs RA vs ZTNA · Phase-1 down · Phase-2 / proxy ID · Route vs policy · SSL split tunnel · FGT → Azure · FGT → AWS · VPN interview ## Sources - FortiOS 7.4 Administration Guide - IPsec VPN . - FortiOS 7.4 Administration Guide - SSL-VPN . - FortiOS 7.4 Administration Guide - ZTNA . - Zscaler ZPA - Zero Trust private access (not an IPsec VPN) . Related: FortiGate IPsec · Azure hub-spoke · AWS TGW . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt