> For the complete documentation index, see [llms.txt](https://docs.digibee.com/documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.digibee.com/documentation/connectivity-management/ztna.md). # Zero Trust Network Access (ZTNA) Learn what Zero Trust Network Access (ZTNA) is, how it works on the Digibee Integration Platform, and what you need before implementing it. ## **What is ZTNA?** Zero Trust Network Access (ZTNA) is a security architecture based on the principle "never trust, always verify." Unlike traditional models that trust users or devices already inside the network, ZTNA requires continuous authentication and authorization to access any resource, regardless of the user's location. Traditional VPNs create risk once a user connects: any authenticated session can move laterally across the network, exposing more than it should. VPNs also centralize traffic, which adds latency, and they struggle to scale across hybrid, multi-cloud environments. ZTNA addresses these gaps by authenticating every request individually instead of trusting a whole session. ## **How ZTNA works** ZTNA combines five components to create a secure, scalable network. ### **Access policies** Access policies are rules that define who can access what, based on identity. For example, an access policy can require a user to be authenticated and authorized before reaching a financial system. ### **Fabric** The fabric is the network infrastructure that connects every device and resource. It routes traffic dynamically and securely, choosing the best path based on current network conditions. ### **Edge Routers** Edge Routers are the connection points between network resources. They enforce access policies so that only authorized sources reach a resource, and they optimize traffic and minimize latency along the way. ### **Network Mappings** Network Mappings are the protected resources inside the network, such as APIs, servers, or applications. ZTNA creates a private network for these resources, so only authenticated users and devices can reach them. ### **Mutual TLS (mTLS)** Mutual TLS (mTLS) authenticates both sides of a connection before they communicate, so only verified users or devices reach the network. This reduces the chance of attacks and simplifies operations, since neither side needs a separate verification step. ### **Inverse Flow** Inverse Flow lets you call internal Digibee pipelines from your own infrastructure through ZTNA, reversing the usual direction of a Network Mapping. See [ZTNA Inverse Flow](/documentation/connectivity-management/ztna/network-mapping-routes.md#inverse-flow) to set one up. ## **When to use ZTNA** ZTNA fits organizations that: * Operate in hybrid or multi-cloud environments. * Need rigorous security for regulated data, such as banking or healthcare. * Want to improve remote access for employees without expanding their attack surface. * Aim to reduce the risk of ransomware and credential hijacking. Compared to a VPN, ZTNA offers: * **Stronger security**: access is segmented and identity-based, which removes lateral movement. * **Lower latency**: a distributed architecture avoids unnecessary network jumps. * **Simpler management**: you administer ZTNA autonomously through the Digibee Integration Platform, with no complex entry rules to maintain. * **Higher availability**: ZTNA on Digibee runs with a 99.99% SLA. ## **Requirements** {% hint style="info" %} If you have questions about these requirements, contact our [Support team](/documentation/troubleshooting/help-and-faq/support.md). {% endhint %} ### **Firewall requirements** * TLS secures all communication between Edge Routers, and between Edge Routers and the network controller. * Your proxies and web application firewalls need to allow exceptions for Edge Router traffic. * Deep packet inspection can cause connectivity problems with Edge Routers. * Edge Routers only make outbound connections, so no inbound traffic needs to reach them. Edge Routers need the following outbound ports open: * `443/TCP/UDP`: connects to the network controller for sessions and initial authentication. * `6262/TCP/UDP`: connects to the network controller for software maintenance on the fabric and data layer. ### **Edge Router requirements** The Edge Router links the Digibee side of your network to the customer side, so it must be able to resolve the DNS of every resource it exposes. For example, if you expose a database at `prod-db.customerdomain.me`, the Edge Router must resolve that hostname. For redundancy, configure your Edge Routers across two separate infrastructures. If one fails, the other handles all the traffic and keeps smart routing working correctly. You're responsible for installing the Edge Router. Follow the deployment guide for your environment: * [Amazon Web Services (AWS)](https://support.netfoundry.io/hc/en-us/articles/360016342971-Deployment-Guide-for-AWS-Edge-Routers) * [Microsoft Azure](https://support.netfoundry.io/hc/en-us/articles/360016343171-Deployment-Guide-for-Azure-Cloud-Edge-Routers) * [Google Cloud Platform (GCP)](https://support.netfoundry.io/hc/en-us/articles/360058708912-Deployment-Guide-for-GCP-Edge-Routers) * [On-Premise](https://support.netfoundry.io/hc/en-us/articles/360016129312-Run-the-Edge-Router-VM-on-Your-Own-Equipment) {% hint style="info" %} Digibee provides a registration key for each Edge Router you configure. See [how to generate new keys](/documentation/connectivity-management/ztna/edge-routers.md#generating-and-registering-keys). {% endhint %} ### **Edge Router VM sizing** Size your Edge Router virtual machines correctly to get the performance you need. Refer to the [NetFoundry VM sizing guide](https://support.netfoundry.io/hc/en-us/articles/360025875331-Edge-Router-VM-Sizing-Guide) for CPU, RAM, and disk storage guidelines. ## **Next steps** Now that you understand what ZTNA is and what it requires, read [ZTNA implementation guide](/documentation/connectivity-management/ztna/ztna-implementation-guide.md) to plan and roll out ZTNA in your organization. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.digibee.com/documentation/connectivity-management/ztna.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.