Zero Trust Network Access (ZTNA)
Learn what Zero Trust Network Access (ZTNA) is, how it works on the Digibee Integration Platform, and what you need before implementing it.
What is ZTNA?
Zero Trust Network Access (ZTNA) is a security architecture based on the principle "never trust, always verify." Unlike traditional models that trust users or devices already inside the network, ZTNA requires continuous authentication and authorization to access any resource, regardless of the user's location.
Traditional VPNs create risk once a user connects: any authenticated session can move laterally across the network, exposing more than it should. VPNs also centralize traffic, which adds latency, and they struggle to scale across hybrid, multi-cloud environments. ZTNA addresses these gaps by authenticating every request individually instead of trusting a whole session.
How ZTNA works
ZTNA combines five components to create a secure, scalable network.
Access policies
Access policies are rules that define who can access what, based on identity. For example, an access policy can require a user to be authenticated and authorized before reaching a financial system.
Fabric
The fabric is the network infrastructure that connects every device and resource. It routes traffic dynamically and securely, choosing the best path based on current network conditions.
Edge Routers
Edge Routers are the connection points between network resources. They enforce access policies so that only authorized sources reach a resource, and they optimize traffic and minimize latency along the way.
Network Mappings
Network Mappings are the protected resources inside the network, such as APIs, servers, or applications. ZTNA creates a private network for these resources, so only authenticated users and devices can reach them.
Mutual TLS (mTLS)
Mutual TLS (mTLS) authenticates both sides of a connection before they communicate, so only verified users or devices reach the network. This reduces the chance of attacks and simplifies operations, since neither side needs a separate verification step.
Inverse Flow
Inverse Flow lets you call internal Digibee pipelines from your own infrastructure through ZTNA, reversing the usual direction of a Network Mapping. See ZTNA Inverse Flow to set one up.
When to use ZTNA
ZTNA fits organizations that:
Operate in hybrid or multi-cloud environments.
Need rigorous security for regulated data, such as banking or healthcare.
Want to improve remote access for employees without expanding their attack surface.
Aim to reduce the risk of ransomware and credential hijacking.
Compared to a VPN, ZTNA offers:
Stronger security: access is segmented and identity-based, which removes lateral movement.
Lower latency: a distributed architecture avoids unnecessary network jumps.
Simpler management: you administer ZTNA autonomously through the Digibee Integration Platform, with no complex entry rules to maintain.
Higher availability: ZTNA on Digibee runs with a 99.99% SLA.
Requirements
Firewall requirements
TLS secures all communication between Edge Routers, and between Edge Routers and the network controller.
Your proxies and web application firewalls need to allow exceptions for Edge Router traffic.
Deep packet inspection can cause connectivity problems with Edge Routers.
Edge Routers only make outbound connections, so no inbound traffic needs to reach them.
Edge Routers need the following outbound ports open:
443/TCP/UDP: connects to the network controller for sessions and initial authentication.6262/TCP/UDP: connects to the network controller for software maintenance on the fabric and data layer.
Edge Router requirements
The Edge Router links the Digibee side of your network to the customer side, so it must be able to resolve the DNS of every resource it exposes. For example, if you expose a database at prod-db.customerdomain.me, the Edge Router must resolve that hostname.
For redundancy, configure your Edge Routers across two separate infrastructures. If one fails, the other handles all the traffic and keeps smart routing working correctly.
You're responsible for installing the Edge Router. Follow the deployment guide for your environment:
Edge Router VM sizing
Size your Edge Router virtual machines correctly to get the performance you need. Refer to the NetFoundry VM sizing guide for CPU, RAM, and disk storage guidelines.
Next steps
Now that you understand what ZTNA is and what it requires, read ZTNA implementation guide to plan and roll out ZTNA in your organization.
Last updated
Was this helpful?