Retiring the VPN: Contractors, a Legacy Billing App and a 150-User SASE Pilot
A software company has 900 hybrid workers. Five hundred employees use FortiClient SSL VPN to a FortiGate 600F at headquarters, and 200 contractors use the same VPN with full internal network access. Another 200 call-centre agents work from home on shift patterns. At shift start the 600F shows CPU spikes and slow tunnel establishment. The internal estate includes an HR web portal, a billing application accessed over RDP that has no single sign-on, and a legacy SMB file share. FortiClient EMS runs on-premises. The company is evaluating FortiSASE for internet security and ZTNA for private applications, and is moving two workloads into an AWS region with a FortiGate VM planned for egress. Constraints: contractors must never see the flat internal network, latency to the AWS region must stay low, and budget is approved only for a 12-month pilot covering 150 users.
1. Compare SSL VPN and ZTNA for the contractor population, and list what would actually be required to run ZTNA here.
Read the worked answer
The difference is the unit of access. An SSL VPN places the device on the network, so the contractor laptop gets an address and can reach whatever the firewall policy permits. With 200 contractor devices on a flat internal network, one compromised laptop becomes an internal foothold, and the SMB share and billing application are reachable by scanning. ZTNA grants per-application access through an access proxy: the user authenticates, the device posture is evaluated, and a session is brokered to one specific application. No internal address is assigned and nothing else is reachable, which is exactly the least-privilege requirement stated.
What is needed:
- FortiClient on each endpoint, enrolled in the existing on-premises FortiClient EMS, which supplies device identity and posture tags such as antivirus running, disk encryption and patch level.
- A ZTNA configuration on the FortiGate: an access proxy publishing an external FQDN with a valid certificate, and ZTNA rules mapping user groups plus EMS tags to specific real servers.
- An identity source: LDAP or SAML for employees, with multifactor authentication for contractors, and a clean group model so contractor identities never land in an employee rule.
- Logging and reporting so access decisions are auditable.
Practical advice: pilot with the HR portal and the billing application for the 150 users, keep SSL VPN for the remaining staff during the pilot, and do not expose the SMB share through ZTNA until its access model is understood.
2. Advise on FortiSASE versus the on-premises FortiGate for internet security, and state where AWS egress should be inspected given the latency constraint.
Read the worked answer
Split the traffic by where the user sits, because that is what drives both latency and appliance load.
Remote and roaming users currently backhaul all traffic to headquarters, which loads the 600F at shift start and adds latency to every SaaS session. FortiSASE is cloud-delivered, so those users are steered to a nearby point of presence for secure web gateway, firewall-as-a-service, CASB and ZTNA functions, and policy follows the user rather than the office. That is a strong fit for the 200 call-centre agents and the 200 contractors, and it removes load from the 600F. The on-premises FortiGate remains the right choice for fixed offices where the hardware exists and traffic is local. A hybrid outcome is normal and not a failure of strategy.
For AWS, the latency constraint answers the question. Hairpinning workload egress back to headquarters adds distance and a single point of failure, so inspect in-region: a FortiGate VM in the VPC or in a dedicated inspection VPC reachable through a transit gateway, sized for the egress volume, deployed across two availability zones, and managed from the same FortiManager so policy stays consistent. If the workloads are small and the pilot budget is tight, cloud-native controls plus the FortiGate VM for east-west and egress filtering is a defensible starting point.
With a 150-user pilot budget, sequence it: FortiSASE for remote users first because that is where the pain is, then AWS egress inspection when the workloads move. Note that FortiFlex-style consumption models can fund a pilot without capex.
3. Explain how posture checks and application segmentation deliver least privilege in this design, and what to do about the billing application that has no single sign-on.
Read the worked answer
Least privilege has two dimensions here: which application, and which device.
The ZTNA rule answers the first: a contractor identity maps to the HR portal only, so the billing application and file share are invisible. Posture answers the second: FortiClient EMS continuously reports attributes such as antivirus state, disk encryption, OS patch level and whether the device is managed, and those attributes become tags. The ZTNA rule requires both the right group and the right tag, so an unmanaged or out-of-date contractor laptop is denied or sent to a remediation path instead of being admitted. Because the check is repeated, a device that falls out of compliance mid-relationship loses access without anyone filing a ticket. The server side also improves, since only the access proxy talks to the application and the application no longer needs to be reachable from a flat network.
The billing application is the hard case. It has no SSO, and ZTNA does not fix that: the proxy authenticates the user to the access layer, then the RDP session prompts again, and the application's own credentials remain the weak point. What you can do now is require multifactor authentication at the ZTNA layer, restrict the rule to managed devices and named users, use TCP forwarding for RDP with session logging, and put the application behind a controlled jump path rather than exposing RDP broadly. What you should plan is replacing or front-ending the legacy authentication. Do not present ZTNA as a fix for application-level credential weakness; it narrows who can reach the prompt, which is valuable but not the same thing.