> For the complete documentation index, see [llms.txt](https://docs.digibee.com/documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.digibee.com/documentation/connectivity-management/ztna/ztna-implementation-guide.md). # ZTNA implementation guide A step-by-step guide to migrating to ZTNA on the Digibee Integration Platform. This guide walks you through the practical steps to plan and roll out ZTNA in your organization. If you're looking for a conceptual overview of ZTNA instead, see [Introduction to ZTNA](/documentation/connectivity-management/ztna.md). ## **Step 1: Map the resources that need protection** Before setting up ZTNA, identify and categorize the resources that need to be protected. This ensures the scope is clear and security measures are adequate. ### **List critical resources** * Externally exposed APIs, such as `api.mycompany.com/v1/login`. * Internal applications, such as an ERP system or a financial database. * Cloud services, such as CRM or project management platforms. ### **Sort resources by sensitivity** * **High sensitivity:** Financial data, authentication APIs. * **Medium sensitivity:** Non-public internal documents. * **Low sensitivity:** Training resources or public materials. ### **Identify users and systems that need access** * Internal teams, such as developers or financial analysts. * Automated applications, such as bots that consume APIs. * External partners who need access to specific systems. ### **Map the location of resources** * **On-Premises:** Local servers or data centers. * **Cloud:** Amazon AWS, Microsoft Azure, Google Cloud. * **Hybrid:** Resources distributed between cloud and on-premises. ### **Understand communication flows** * Which users access which resources? * How do applications interact with each other? ## **Step 2: Configure Edge Routers in strategic locations** The Edge Router is the central component for establishing secure communication in ZTNA. Its configuration and positioning are crucial to optimize traffic. ### **Choose the infrastructure** * **On-Premises:** Position the Edge Router inside the data center, close to the resource being protected. Example: protecting a local database server. * **Cloud:** Use the AWS Marketplace to deploy the Edge Router directly in the API region. Example: APIs hosted on AWS. ### **Plan for redundancy** Always configure at least two Edge Routers to ensure high availability. Example: one in US East (AWS US-East) and another in US West (AWS US-West). ### **Register the Edge Router** 1. Access the Connectivity section for ZTNA in the Digibee Integration Platform. 2. Generate a key and register the Edge Router. Example of a name: `EdgeRouter-US-East`. See [Edge Routers](/documentation/connectivity-management/ztna/edge-routers.md) for step-by-step instructions on generating keys. ### **Configure outbound rules** * No inbound firewall rules are required. * Make sure required outbound ports are open, such as: * Port `443` (HTTPS) — secure communication. * Specific ports for the ZTNA controller. ## **Step 3: Grant access** One of the most important premises of ZTNA is granting access only to what's necessary, limiting excessive privileges. ### **Restrict ports and endpoints** * Limit access to specific ports and endpoints. Example: * Internal users: only port `22` (SSH) and `443` (HTTPS). * External partners: only `api.partner.myorganization.com`. ### **Enable microsegmentation** Example: an Edge Router can allow only one application to interact with the financial database, such as a financial dashboard. {% hint style="info" %} Migration can be done gradually, allowing existing infrastructure (such as VPNs) to coexist while ZTNA is implemented. {% endhint %} ## **Integrated example** **Scenario:** A company operates a financial application that allows customer queries. The application is distributed between a local data center and an AWS cloud. **Solution with ZTNA:** 1. Map the `api.financial.com` API and the local database as critical resources. 2. Configure an Edge Router in AWS (for the API) and another in the local data center (for the database). 3. Create access policies to allow: * Only authenticated users to query the API. * Only the API to access the database. 4. Test communication with a simulated user and validate latency. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.digibee.com/documentation/connectivity-management/ztna/ztna-implementation-guide.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.