Ferrite Guidance Hub Interactive Field Runbook #15
← All Runbooks Main Platform
Zero-Trust & Identity · Access Proxy

ZTNA Access Proxy with SAML MFA & EMS Device Posture Triage

End-to-end diagnostic workflow for FortiOS Zero Trust Network Access (ZTNA) HTTPS access proxies, Azure AD / Okta SAML 2.0 authentication assertions, FortiClient EMS zero-trust tag synchronization and WAD proxy access rules across 11 consolidated Fortinet TAC knowledge base articles.

RUNBOOK POSITION 15 OF 17 Zero-Trust & Identity ZTNA Proxy ⚡ 11 KBs Consolidated
EMS Fabric Connector Sync Verify active TLS connection between FortiGate and FortiClient EMS server and confirm endpoint telemetry heartbeat intervals.
SAML IdP Certificates Confirm valid X.509 token-signing certificates, Entity ID URLs and Assertion Consumer Service (ACS) endpoints on Microsoft Entra ID / Okta.
Access Proxy VIP DNS Verify public FQDN resolution and wildcard SSL certificates on the ZTNA Server Virtual IP (VIP) interface.

Troubleshooting & Verification Workflow

STEP 01

Verify EMS Cloud / On-Prem Fabric Connector status

Check the synchronization state and active zero-trust posture tags pushed from FortiClient EMS to the FortiGate kernel cache.

diagnose endpoint record list
diagnose test application fdsconnector 1
STEP 02

Test SAML 2.0 authentication exchange & token assertions

Execute targeted real-time SAML daemon debugging to verify SP/IdP message handshakes, clock skew timestamps and returned user claim attributes.

diagnose debug reset
diagnose debug application samld -1
diagnose debug enable
STEP 03

Inspect ZTNA client certificate validation & posture tags

Verify that incoming client requests present a valid FortiClient root-signed client certificate and match required zero-trust tags (e.g. `Compliant_Workstation`).

diagnose endpoint ztna-posture list
diagnose firewall ztna-tags list
STEP 04

Audit WAD proxy access policy rule matching

Inspect the WAD proxy forwarding engine to determine if user requests are blocked due to missing tags, path mismatch, or VIP session timeouts.

diagnose wad filter clear
diagnose wad filter dport 443
diagnose debug application wad 255
diagnose debug enable
STEP 05

Trace live end-to-end ZTNA session proxy flow

Trace the full TCP handshake, client cert mutual TLS verification, SAML cookie issuance and backend server reverse-proxy forwarding.

diagnose sys session filter dport 8443
diagnose sys session list
diagnose sys session filter clear
Operational Caution: Ensure `client-cert-request` on the ZTNA server VIP matches the EMS Certificate Authority (CA). If an intermediate CA is missing in FortiOS, client browsers will fail mutual TLS handshakes with a silent `ERR_SSL_PROTOCOL_ERROR`.

Consolidated Fortinet Knowledge Base & Technical References