Zero › Module 6 › Lesson 1
ZTNA Named
Zero Trust Network Access (ZTNA) literacy — app-specific access without flat VPN — ZTNA architecture card on YOUR $ZT_LAB network folder.
Visual · t40_ztna_named
ZTNA named. $ZT_LAB. Original Cyberlium.
Opening
VPN is a tunnel — ZTNA is a door per app — name broker, connector, and policy path on LAB-ZT-001 before vendor PoC slides.
ZTNA (Zscaler Private Access, Prisma Access, Cloudflare Access, Entra global secure access literacy) publishes apps via cloud broker; user+device verified per session; no full network layer access by default. Document ZTNA card: broker, app catalog, connector/agent, IdP integration, logging — fictional LAB-ZT-001. Next: SASE Named.
1. ZTNA components (named)
Client/agent or browser access. Policy broker/edge. App connector in private network. IdP for auth. PDP decision per app session.
Logs: user, device, app, allow/deny — feeds SIEM literacy.
Command guide
Try these commands — ZTNA components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ZTMM Networks — https://www.cisa.gov/zero-trust-maturity-model NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
export ZT_NETWORK=${ZT_NETWORK:-$ZT_LAB/LAB-ZT-001/network}
curl -sS https://www.cisa.gov/zero-trust-maturity-model | head -8
cat > "$ZT_NETWORK/ztna-architecture-card.md" <<'EOF'
# ZTNA Architecture Card — LAB-ZT-001
- **Broker (fictional):** LabZTNA Cloud Edge
- **Connectors:** app-connector-01 in private subnet stub
- **IdP:** LabIdP.example.zt (SSO per session)
- **Published apps (fictional):** finance.internal.zt, git.internal.zt, hr.internal.zt
- **Logging:** user, device, app, allow/deny per session
```
User → IdP → ZTNA Broker → Connector → Internal App
```
LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS
EOFCommand — copy this
grep -E 'ZTNA|Broker|Published apps|LAB SAMPLE' "$ZT_NETWORK/ztna-architecture-card.md"
Primary tools to practice this lesson: curl, grep. Reference sites: CISA ZTMM Networks (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. ZTNA vs VPN literacy preview
VPN: network layer trust often too broad. ZTNA: app layer, default deny other resources.
Full comparison in M6 L3 — this card names ZTNA parts only.
3. Architecture stub
User → IdP → ZTNA broker → connector → internal app. Label on markdown diagram.
Ship: ZTNA component card + diagram. Next: SASE Named.
4. What you ship: ZTNA architecture card
Broker, connector, IdP, app catalog rows + diagram stub. $ZT_LAB fictional. chmod 600.
5. What you record before the next lesson
Date. ZTNA card. $ZT_LAB named. File t40-m06-l01-ztna-named.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Draw ZTNA as full subnet VPN replacement without app catalog row. Scan stranger ZTNA portal.
Right
Write ZTNA card with per-app access diagram. Next: SASE Named.
Mission: ZTNA architecture card
1) Name four ZTNA components. 2) List three fictional published apps. 3) Draw broker path diagram. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
App catalog is scope control — not every internal IP published.
Knowledge Check
APPLY: ZTNA primarily grants:
Multiple choice
Knowledge Check
APPLY: True or False: ZTNA integrates with IdP for authentication.
True or False
Knowledge Check
APPLY: ZTNA card belongs on:
Multiple choice