Zero Trust Network Access · ZTNA Implementation
SSL VPN is the older dial-in remote access; its firewall policies decide how much of the network a connected user can reach, and FortiOS 7.6.3 removed its tunnel mode from every FortiGate. Zero Trust Network Access (ZTNA) checks who the person is and what device they are on for every application, so a stolen password reaches only what that person is allowed to use, not the whole network. We design and deploy it on your FortiGate, tied to the sign-in system you already use (Microsoft Entra ID, Okta or Google Workspace), and we stay until the old VPN is switched off. We price it after a short review of your current setup; inside a firewall migration it is part of the scope.
Track Record
We only do networks. That is not a limitation — it is why the outcomes are different.
Years of network-only practice. Architecture, security, and operations — not IT generalism.
Sites delivered. Healthcare clinics, law offices, financial branches, multi-site operations.
Design target for fully redundant builds with HA firewalls, diverse ISPs, and backed-up power.
The same senior engineer, from design through operations. No junior handoffs. No ticket queue. No escalation chain.
Career aggregate. The 20+ years and 300+ sites span the operator’s full network-only practice, including prior-employer engagements. 99.99% availability, about 53 minutes of downtime per year, is an architecture design target for engagements that fund full redundancy. It is not a service guarantee or uptime SLA. Contracted response times and service levels are defined in each customer agreement.
Why ZTNA Replaces VPN
Legacy VPN gives a connected user broad network access — once they’re on, they can probe far more than they need. ZTNA flips that: each application has its own rule, the rule checks the person and the device, and every decision is logged. A stolen password reaches only the applications that person is allowed to use, not the whole network. Users sign in once; browser-based applications need no VPN client. The architectural shift is significant; the implementation needs to match.
ZTNA only works when access decisions are tied to your identity provider, the system your staff already sign in to (Entra ID, Okta, Google Workspace, or others). We integrate properly with whatever you have, including conditional access policies, MFA enforcement (a second check beyond the password), and session-binding so a stolen token doesn’t open the network.
Legacy VPN gives a connected user broad network reachability — once on, they can probe the rest of the network. ZTNA flips that: each application gets its own access policy, evaluated per-session against identity + posture + context. A compromised credential opens far less than it does on legacy VPN.
Every access decision logged: who, when, what application, whether the device passed its health check, and whether access was allowed or refused. SOC 2 and HIPAA auditors get the evidence they ask for. Compare to SSL VPN logs that just show "user X connected" with no application-level detail.
We’re a Fortinet Engage Advocate Partner with depth on Fortinet ZTNA — the unified ZTNA / SASE / SD-WAN / firewall platform. If you already run FortiGate, ZTNA is a license + configuration layer rather than a new vendor relationship. For non-Fortinet shops, we work with Cloudflare Access, Zscaler ZPA, and others where the existing stack favors them.
Identity-aware access, segmented from day one. Tailscale and Twingate deployments and operations.
ZTNA Implementation Phases
ZTNA done right has clear phases. Skipping any of them is how teams end up with a "ZTNA deployment" that users bypass back to the legacy VPN. On FortiGate the pieces are FortiClient EMS for the device health check, SAML to your identity provider, and a per-application ZTNA rule on the firewall itself; the phases below put them in the right order. For timelines, see the FAQ below; our VPN to ZTNA migration guide walks through the same work step by step.
List every internal application currently reachable over VPN. Map each to: who needs access, from what devices, with what authentication strength. Expect to be surprised by what you find — ZTNA forces a clarifying conversation about what people actually use.
Integrate ZTNA with your identity provider (Entra ID, Okta, Google Workspace, others). Define MFA enforcement, conditional access policies, session lifetime, device-posture requirements. Without this layer, ZTNA is just a fancier VPN.
Pilot ZTNA on FortiGate with a defined user group on 1–3 applications. Run alongside legacy VPN for 2–4 weeks. Validate user experience, application performance, and access logging. Migrate other applications and user groups in waves once the architecture is proven.
The often-skipped final phase. Once ZTNA covers all required access, decommission the legacy VPN. Remove the SSL VPN client from devices. Remove the firewall’s VPN listener. Leave the legacy VPN running "just in case" and you never realize the security benefit. We close the loop. On FortiGate, SSL VPN tunnel mode is gone as of FortiOS 7.6.3 — see FortiGate SSL VPN migration.
ZTNA needs ongoing tuning — new applications added, new user groups onboarded, policy refinement based on usage logs, conditional-access policy updates as your organization changes. After cutover, monitoring can move onto a managed plan from $695 per site per month after the assessment: automated monitoring, human response Mon–Fri, 8 AM–5 PM Pacific. Policy changes bill hourly or come from a plan’s included hours.
If you are not sure what is reachable over your VPN today, start here: a senior engineer reviews your remote access (VPN setup, sign-in integration, which applications people actually use) and delivers a written report with prioritized recommendations and a phased ZTNA migration path. Yours to keep regardless. Network Risk Assessment from $3,500, one to two weeks, one site; see a sample report (PDF).
Common ZTNA Use Cases
Start with one or two of these use cases, then expand once the architecture is proven.
National scope — ZTNA implementations are remote engineering work. Identity-provider integration, application onboarding, and policy authoring all happen remotely. On-site visits are scoped only if you ask for them.
Our Approach
No mystery. No black box. Every step is documented, explained, and approved before execution.
A complete Network Risk Assessment of your current network. Configurations reviewed, segmentation validated and gaps documented, in writing.
Address critical risks first, then build toward a standardized architecture. Every change documented, tested, and scheduled with a rollback plan.
Ongoing monitoring, documented changes and, from Edge Secure up, scheduled reviews. The network does not just work today — it evolves with your operations.
Your Engineer
Not a team of rotating technicians. Not a ticket queue. One named senior engineer is your point of contact from the first access review through cutover and ongoing operations, and knows your users, applications, compliance requirements and business context. You are never passed between people.
Background: Founder, ex-Meta. Past engagements include Cisco, Wells Fargo, Fannie Mae, and other Fortune 500 networks — the same caliber of engineering, now applied to mid-market organizations.
We are a Fortinet Engage Advocate partner and supply FortiGate, FortiSwitch and FortiAP. We also monitor and manage the Cisco, Aruba, Arista and other enterprise gear you already run. You don’t have to rip anything out to work with us.
Best-Fit Buyer Profiles
ZTNA fits any organization with remote access — but the ROI is sharpest in these buyer profiles.
Companies preparing for SOC 2 audit cycles or facing customer security questionnaires that ask about remote-access controls. ZTNA produces audit evidence (per-application access logs, identity-bound authentication, conditional-access enforcement) that legacy VPN simply cannot.
HIPAA Security Rule technical safeguards (access controls, audit controls) are direct fits for ZTNA capabilities. Replacing legacy SSL VPN with ZTNA (see HIPAA network engineering) improves the documentation auditors expect and reduces the blast radius if a clinician’s credentials get phished.
Companies post-acquisition with multiple legacy VPN systems from different vendors. ZTNA provides a single consolidated remote-access plane that works across the merged environment without forcing immediate IT consolidation.
Organizations that grant network access to external vendors, contractors, freelancers, or auditors. ZTNA constrains each party’s access to the specific applications they need, with full logging — rather than putting third parties on the corporate VPN with unconstrained reachability.
If your security team is uncomfortable with full corporate VPN access from personal devices but business needs require remote access, ZTNA solves it. Per-application policies + device-posture checks let you grant access to specific applications without giving the personal device broad network reach.
Multi-site organizations using site-to-site VPN tunnels to reach centralized applications. ZTNA can replace site-to-site VPN with per-application policies that perform better and produce far better security telemetry — particularly relevant for SD-WAN migration projects.
FAQ
"Next-gen VPN" is mostly marketing — an SSL VPN with MFA bolted on. Real ZTNA is architecturally different: each application connection gets its own policy evaluation; the user never reaches the network broadly; access is per-session and identity-bound; logging happens at the application layer. If a vendor calls their SSL VPN "ZTNA-ready" without restructuring how access is granted, they’re selling the marketing, not the architecture.
No. If you already run FortiGate, Fortinet ZTNA is a license + configuration extension rather than a new vendor relationship, so that is where we start. For non-Fortinet shops, we work with Cloudflare Access, Zscaler ZPA, Palo Alto Prisma Access, and others. The right ZTNA platform depends on what identity provider, edge stack, and user volume you have.
The major ones: Microsoft Entra ID (formerly Azure AD), Okta, Google Workspace, Ping Identity, JumpCloud, OneLogin. SAML or OIDC integration depending on the IDP and ZTNA platform. We’ve also done custom RADIUS-based integrations where required.
Legacy thick-client applications that require specific TCP/IP behaviors are sometimes difficult to put behind ZTNA. We assess this during Phase 1 (application inventory) and either: route those apps through a ZTNA-aware proxy, retain a constrained-VPN path just for them, or recommend a remote-desktop intermediary. There’s rarely an application we can’t handle — just trade-offs to choose between.
ZTNA on FortiGate is quoted after scoping: the fee depends on how many users, rules and applications move, so we price it after a short review of your current setup. The project covers policy design, an agent or agentless rollout plan, a pilot group and cutover of an existing SSL-VPN population; inside a firewall migration it is part of the migration scope. Moves off another platform such as Zscaler, Netskope or Prisma Access are quoted the same way, and larger programs (multiple identity providers, more than 500 users) start with the assessment. ZTNA platform licenses pass through, typically $5–$15 per user per month depending on vendor and feature tier.
It depends on how many users and applications move and what is already in place. For an office of 20 to 200 users, plan on four to six weeks, most of it the pilot and the group-by-group moves; the step-by-step plan is in our VPN to ZTNA migration guide. Programs with several identity providers or more than 500 users start with the assessment, and the schedule is confirmed after scoping.
Related
Step-by-step method: how to migrate from VPN to ZTNA on FortiGate, with a VPN to ZTNA readiness checklist. Already on a FortiOS release with SSL VPN removed? Read the FortiGate SSL VPN migration page. After the cutover, the network can be run by our Sacramento Fortinet MSP service or as a Fortinet MSP in San Francisco.
Start the ZTNA Implementation
Know you want ZTNA on FortiGate? Request a quote for policy design, rollout plan, pilot group and cutover; we scope it on a short call, or fold it into a firewall migration. Not sure what your VPN exposes? Start with a Network Risk Assessment: $3,500 for a single small site; larger networks are priced on the assessment pricing page. The assessment is billed separately. Either way the report and migration path are yours to keep. See a sample report (PDF).
Response from a senior engineer within 1 business day.
A direct conversation — no sales team, no runaround.
An honest assessment of whether we are the right fit.
Clear next steps if we are — no pressure if we are not.
