ZTNA implementation guide

A step-by-step guide to migrating to ZTNA on the Digibee Integration Platform.

This guide walks you through the practical steps to plan and roll out ZTNA in your organization. If you're looking for a conceptual overview of ZTNA instead, see Introduction to ZTNA.

Step 1: Map the resources that need protection

Before setting up ZTNA, identify and categorize the resources that need to be protected. This ensures the scope is clear and security measures are adequate.

List critical resources

• Externally exposed APIs, such as api.mycompany.com/v1/login.

• Internal applications, such as an ERP system or a financial database.

• Cloud services, such as CRM or project management platforms.

Sort resources by sensitivity

• High sensitivity: Financial data, authentication APIs.

• Medium sensitivity: Non-public internal documents.

• Low sensitivity: Training resources or public materials.

Identify users and systems that need access

• Internal teams, such as developers or financial analysts.

• Automated applications, such as bots that consume APIs.

• External partners who need access to specific systems.

Map the location of resources

• On-Premises: Local servers or data centers.

• Cloud: Amazon AWS, Microsoft Azure, Google Cloud.

• Hybrid: Resources distributed between cloud and on-premises.

Understand communication flows

• Which users access which resources?

• How do applications interact with each other?

Step 2: Configure Edge Routers in strategic locations

The Edge Router is the central component for establishing secure communication in ZTNA. Its configuration and positioning are crucial to optimize traffic.

Choose the infrastructure

• On-Premises: Position the Edge Router inside the data center, close to the resource being protected. Example: protecting a local database server.

• Cloud: Use the AWS Marketplace to deploy the Edge Router directly in the API region. Example: APIs hosted on AWS.

Plan for redundancy

Always configure at least two Edge Routers to ensure high availability. Example: one in US East (AWS US-East) and another in US West (AWS US-West).

Register the Edge Router

1. Access the Connectivity section for ZTNA in the Digibee Integration Platform.

2. Generate a key and register the Edge Router. Example of a name: EdgeRouter-US-East.

See Edge Routers for step-by-step instructions on generating keys.

Configure outbound rules

• No inbound firewall rules are required.

• Make sure required outbound ports are open, such as:

  • Port 443 (HTTPS) — secure communication.

  • Specific ports for the ZTNA controller.

Step 3: Grant access

One of the most important premises of ZTNA is granting access only to what's necessary, limiting excessive privileges.

Restrict ports and endpoints

• Limit access to specific ports and endpoints. Example:

  • Internal users: only port 22 (SSH) and 443 (HTTPS).

  • External partners: only api.partner.myorganization.com.

Enable microsegmentation

Example: an Edge Router can allow only one application to interact with the financial database, such as a financial dashboard.

Migration can be done gradually, allowing existing infrastructure (such as VPNs) to coexist while ZTNA is implemented.

Integrated example

Scenario: A company operates a financial application that allows customer queries. The application is distributed between a local data center and an AWS cloud.

Solution with ZTNA:

1. Map the api.financial.com API and the local database as critical resources.

2. Configure an Edge Router in AWS (for the API) and another in the local data center (for the database).

3. Create access policies to allow:

   • Only authenticated users to query the API.

   • Only the API to access the database.

4. Test communication with a simulated user and validate latency.