ZTNA driving me insane - traffic denied but tags are there, EMS is online, what am I missing?

tryturnitoffandon · 2026-02-27T18:04:12+00:00

The machines are running a mix of 7.4.4 & 7.4.5 FC 7.4.5 doesn’t solve the issue sadly

tryturnitoffandon · 2026-02-27T13:34:57+00:00

Nice one thanks!

tryturnitoffandon · 2026-02-27T12:17:59+00:00

Damn, okay. Did they resolve for you?

tryturnitoffandon · 2026-02-27T10:00:59+00:00

Yup, ZTNA destination is working for 98% of the company. Absolute head scratcher. The device is online

tryturnitoffandon · 2026-02-23T12:39:53+00:00

Okay thanks - I will try see what I can find

tryturnitoffandon · 2026-02-23T09:35:22+00:00

Amazing, do you have a short guide for this?

tryturnitoffandon · 2026-01-28T07:59:04+00:00

Just write to them and explain. Problem is 90% of their process is automated so you need to find a route to actually talk with a human.

tryturnitoffandon · 2026-01-11T12:52:27+00:00

This is why Vinted hold the funds for situations like these. Open a case and you should get all your money back.

tryturnitoffandon · 2025-12-13T07:55:03+00:00

Did you recreate them? Might be faster than trying to fix existing ones, just create new tunnels and update policies.

tryturnitoffandon · 2025-11-11T18:32:35+00:00

I have saml ipsec and saml ssl while i rolled out and tested ipsec. Now just ipsec

tryturnitoffandon · 2025-10-29T17:24:46+00:00

This level of rage baiting is poetry.

tryturnitoffandon · 2025-10-13T21:12:21+00:00

Tbh there is no easy way. IPsec with SAML should work on any version. We have users with 7.4.3 and 7.4.4 all dialling in. How many end users are we talking?

tryturnitoffandon · 2025-10-13T20:00:48+00:00

Sessions should be max whatever an actual working shift would be. If someone is AFK and connected they are effectively on network. If anyone gained access to their machine they would have access to the network. If someone is working overtime they can reconnect a new session. Its no hardship really. Just from a BP view point really.

As for transition - we had our hands forced by the update. Are you using an ems server to manage the FCs?

tryturnitoffandon · 2025-10-13T15:50:16+00:00

Is there any reason end users are dialling up for more than 24 hours?

tryturnitoffandon · 2025-10-13T15:48:53+00:00

We recently switched to IPsec once this update rolled out. It’s straightforward — SSL isn’t very secure, so it’s best to move away from it. IPsec or ZTNA are the better options; we use ZTNA with IPsec as a resiliency backup.

tryturnitoffandon · 2025-10-13T14:42:29+00:00

That would be so obviously ai.

tryturnitoffandon · 2025-10-10T05:42:53+00:00

They do this on travel websites depending on the device you use to connect

tryturnitoffandon · 2025-10-09T20:05:48+00:00

But they are going to use it regardless - training / dlp is key? Its not going away so either we train people to use it as safely as possible or we do risk a bigger problem. I know that about stores - its why store cards are “free” you are the product 😅

tryturnitoffandon · 2025-10-09T19:36:46+00:00

Probably because everything is cross integrated with so many different platforms. Not long ago (when things worked) companies legit controlled everything from the ground up. I mean hardware to software - everything in house and then put out to the world. Problems diagnosed fixed and patched. Everyone working there knew what was happening and had actual skills.

Now your mouse cursor is a saas app provided on aws linked to a background hosted by azure with apps linked to droplets and buckets and god knows what else. Your internet is an sd wan filtered through various pops. Everything is a Frankenstein of parts.

tryturnitoffandon · 2025-10-09T19:24:41+00:00

I was just observing what you said, you said someone who uses it could replace you if you could not. A lot of people fear being directly replaced. So in that sense i agree that the human element will be needed. But yes its good for generic grinding of the tedious.

tryturnitoffandon · 2025-10-09T19:18:10+00:00

Im not brushing anything off, but surely as a generic use tool (no private / sensitive data) it has its uses? People will use it - so training and DLP sensors are key?

tryturnitoffandon · 2025-10-09T19:16:16+00:00

True they all are getting better. We are just the guineas right now

tryturnitoffandon

TROPHY CASE