How AppGate ZTNA Works

Look under the hood of direct-routed AppGate ZTNA, the most flexible and adaptable Universal Zero Trust Network Access solution available today.

Watch How It Works

What makes AppGate ZTNA tick?

We know that you value flexibility. That's why AppGate ZTNA is the most versatile, feature-rich Universal ZTNA solution ... so you can pick the right deployment model for you, your team and your organization.

Any User / Device / Access Point

On Site & Remote Users

Any IoT/BYOD Device

Suppliers / Third Party

Single Packet
Auth (spa)

API
Integration

Least Privilege
Access

Identity Centric

Any Resource / Location

Cloud (IaaS/Containers)

On Premises & Datacenter (Private/Legacy)

SaaS

Any User, Any Device

Unify policies for all remote, in-office and third-party providers
Concurrent access to any workload for enhanced user experience
Secure and contain any user or device with posture checking
Simplify and speed up user access management

Policy Decision Engine

Verify and evaluate identity, context and risk as criteria for surgical access policies
Enforce principle of least privilege with microsegmentation
Make all resources invisible with single packet authorization
Robust API integrations put data to work and automate processes

Any Resource, Any Workload

Unify access for IaaS, SaaS, microservices, private cloud and legacy resources
Dynamically secure access to your ever-changing cloud resource footprint
Apply the same Zero Trust access to service-to-services interaction
Protect legacy, cloud native and hybrid infrastructures from the same unified policy engine

Choose Your Preferred Deployment Model

Your network security architecture requirements are unique to your organization. AppGate ZTNA lets you choose your preferred deployment model, whether it's cloud-hosted, self-hosted or isolated.

Cloud Hosted

Not to be confused with cloud-routed, your controller is hosted in the Zero Trust platform cloud environment, but other appliances remain hosted in your controlled environment.

Self Hosted

All AppGate ZTNA appliances are deployed in your controlled environment and connected to the Zero Trust platform for value-add services.

Isolated

All AppGate ZTNA appliances are deployed in your controlled environment with no connection to the Zero Trust platform.

Live learning series and Q&A: ZTNA Table Talks

Get first-hand insights from our network security experts on the advantages of direct-routed Universal Zero Trust Network Access built for intricate hybrid IT environments. Each month features a different topic and live demo on how to strengthen security, control how data traverses your network, cut costs and boost operational efficiencies.

We’re Just Scratching the Surface

If you want to learn how the AppGate ZTNA architecture weaves into the fabric of your IT and security ecosystem, explore our Zero Trust platform and integration library.

Request a Demo Integration and Technology Partners

Getting Started Step-By-Step

No matter which deployment model works best for your organization, you can put AppGate ZTNA to work with these four primary steps.

1 Start Where Your Are

The AppGate ZTNA architecture is infrastructure agnostic and can be deployed anywhere resources need secure access. Deploy, monitor and maintain the ZTNA architecture via as a service or self-hosted models

2 Develop ZTNA Policies

Create the rules that control any device or user’s access from any location and to any enterprise resource in a unified policy engine that simplifies configuration and management.

3 Onboard Users

Easy onboarding and seamless user experience are key to user adoption and reducing help desk requests. Select from client- or browser-based access options for complete user population coverage.

4 Launch automation

Weave AppGate ZTNA into the fabric of your business and IT operations with bi-directional APIs that automate access. Extensive scripting capabilities give you the freedom to deploy security-as-code and mature DevOp practices.

Frequently Asked Questions

Don't see your question? Contact us anytime and one of ZTNA experts will get you the answer you need.

We call this the AppGate ZTNA collective. The AppGate ZTNA architecture is infrastructure agnostic and can be deployed anywhere resources need secure access. The core component of AppGate ZTNA is the appliance. Appliances can be virtual or physical. Each appliance is configured to serve a role in the AppGate collective. The primary roles are Controller (the policy engine and decision point) and Gateway (the policy enforcement point).

Additional optional roles are:

- Connector (alternate enforcement point that enables branch office and IoT/OT security)
- Portal (to enable clientless, browser-based access)
- Log Server (built in ELK stack for log aggregation and reporting)
- Log Forwarder (aggregates logs and forwards to an enterprise SIEM or syslog server)

The AppGate ZTNA collective is designed for high availability, performance and linear scale for small to very large enterprise deployments. All appliances are delivered as a virtual machine at no cost and alternatively available as a physical device for an additional charge

The AppGate ZTNA Controller role is the brains of the collective and acts as the policy engine and policy decision point (PDP). It manages the authentication, policies, conditions and entitlements granting access for all users, devices and workloads from a single dashboard or via API.

The AppGate ZTNA Gateway role acts as the policy enforcement point (PEP). Gateways control the flow of access to protected resources. It dynamically builds session-based microfirewalls or microperimeters based on granted entitlements that limit lateral movement and attack surface.

We call this cloaking the infrastructure. Single packet authorization (SPA) uses proven cryptographic techniques to make internet-facing resources invisible to unauthorized users. SPA makes enterprise resources invisible and enables the AppGate ZTNA collective to distinguish authorized and unauthorized connection attempts, while only needing to evaluate a single network packet. Only devices that have been seeded with the cryptographic secret will be able to generate a valid SPA packet, and subsequently be able to establish a network connection. This in essence is how SPA reduces the attack surface and makes the infrastructure invisible to adversarial reconnaissance. For more information, read the AppGate SPA blog.

Once an entitlement has been granted, all traffic from the client to the gateway travels across a secure, encrypted network tunnel. All access is logged through the LogServer, ensuring that there’s a permanent, auditable record of the user access details. AppGate ZTNA leverages mTLS FIPS 140-2 compliant and third-party validated encryption on every connection to an authorized gateway - regardless of the user’s location.

AppGate ZTNA builds individual just-in-time session-based “micro” firewalls or 1-1 connections between users and the resources they are authorized to access behind a gateway. This small set of individualized rules can be processed near-instantaneously to deliver ultra-high performance connections and throughput. These microperimeters provide least privilege access and reduces the attack surface.

Yes. As an open platform, AppGate ZTNA is based on REST APIs allowing for seamless integration with other security tools, including IAM, Directory Services, EDR and SIEM, as well as business and workflow systems like an ITSM. This allows security professionals to create a cohesive security ecosystem and to build security into business processes.

Yes. AppGate ZTNA supports both up and down rules. Many solutions work well in use cases that require user/device policies to connect to resources, also known as “up rules.” However, most sophisticated security teams must support “down rules” that deal with interactions between a server, service, or resource “down” to the user device. Remote desktop support, centralized endpoint products (EPP/EDR/AV) and VoIP are good examples, where access control needs to flow in both directions.

Yes. AppGate ZTNA is architected to protect private access across a complex hybrid IT environment including on-premises, in data centers, in one or more clouds (multi-cloud) or a combination of all three (i.e., a hybrid architecture) with a unified policy engine.

No. Software-defined perimeter architectures are very different from VPNs. VPN has been traditionally used to provide remote workers with access to corporate resources, its only real security features are user authentication to the network. In comparison, AppGate ZTNA is fundamentally an identity-centric and security-driven solution, offering enhanced authentication and encryption while also adding other modern features that will increase security and reduce operational complexity. For more information read our VPN Replacement blog.