This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Agent and Agentless

When it could be possible to access the same external resource via ZTNA both with agent and agentless? Some users wish to access the resource with mobile phone and because ip restriction applies with ztna, they can't.

This thread was automatically locked due to age.

Top Replies

LuCar Toni 10 months ago +3 verified

Agentless is HTTP/S only. Agentbased is every Port. So if you want to publish something for HTTPS, use Agentless, will work both, for an Agentbased client, and a mobile client.

Parents

+1 LuCar Toni 10 months ago

Agentless is HTTP/S only.

Agentbased is every Port.

So if you want to publish something for HTTPS, use Agentless, will work both, for an Agentbased client, and a mobile client.

__________________________________________________________________________________________________________________
Cancel
Vote Up +3 Vote Down

Cancel

Reply

+1 LuCar Toni 10 months ago

Agentless is HTTP/S only.

Agentbased is every Port.

So if you want to publish something for HTTPS, use Agentless, will work both, for an Agentbased client, and a mobile client.

__________________________________________________________________________________________________________________
Cancel
Vote Up +3 Vote Down

Cancel

Children

0 Administrator User241 10 months ago in reply to LuCar Toni

Ok but if I want to access an external resource, like SaaS (Salesforce etc.). The external fqdn in the resource settings require our ztna domain prefix...?
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni 10 months ago in reply to Administrator User241

So essentially you need an Agent to run this, because ZTNA is not a Proxy.

I talked about this in lenght here: https://www.reddit.com/r/sophos/comments/126zv61/sophos_ztna_with_cloud_apps_eg_itglue/

Essentially, as you are not the owner of Salesforce.com for example, you cannot redirect any client to your solution. And you cannot simply say "customer.com --> SFDC" as SFDC will smash your redirect because of the lack of rewriting of those requests.

This kind of technology is not implemented in ZTNA and is more likely a SWG /CASB technology than a ZTNA technology.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Administrator User241 10 months ago in reply to LuCar Toni

How about a scenario when I am trying to access a private resource in Azure which as our domain prefix but an external ip?
Cancel
Vote Up 0 Vote Down

Cancel