Skip to main content

ZTXGate

ZTXGate is a Zero Trust Network Access gateway designed to give users access to defined resources instead of broad access to the surrounding private network.

A standard deployment is a lightweight, single-node installation on Ubuntu. The ZTXGate software is delivered as a single Debian package and combines the core gateway, administration portal, and clientless HTTP/HTTPS proxy in one deployment.

Access paths​

ZTXGate supports two primary access paths:

  • Managed endpoint access. Enrolled endpoints use WireGuard-based connectivity to reach resources authorized by ZTXGate policy. Tunnel connectivity does not by itself grant access; identity, device, resource, and policy determine what the endpoint can reach.
  • Clientless HTTP/HTTPS access. When licensed, users can reach authorized web applications through the ZTXGate clientless proxy without installing WireGuard on the endpoint. The proxy terminates the incoming browser connection and establishes the authorized connection to the protected application.

Both paths use the same overall identity- and policy-driven access model.

Deployment and configuration model​

ZTXGate setup is intentionally split into three stages:

  1. Install the package. Install the single ZTXGate .deb package on a supported Ubuntu host.
  2. Run the initial setup script. Configure low-level deployment settings such as FQDNs or IP addresses, listener ports, and certificates. The setup stage also creates the WireGuard configuration and bootstrap administrator credentials.
  3. Complete high-level configuration in the Admin Portal. Configure authentication, identity and lifecycle integrations, endpoint-security integrations, SMTP, Shared Signals Framework (SSF), licensing, and other operational settings.

This separation keeps host- and network-level bootstrap configuration distinct from the security and operational configuration that administrators manage day to day.

Identity, device, resource, and policy​

ZTXGate access is built around four core objects:

  • Identity — the user requesting access.
  • Device — the enrolled endpoint associated with that user for managed access.
  • Resource — the application, host, or service being protected.
  • Policy — the conditions under which that identity and device may reach that resource.

Policies can incorporate identity, role, device, posture, network location, time, resource, access duration, and supported additional authentication requirements.

Authentication and integrations​

High-level configuration is performed in the Admin Portal. Depending on the deployment, administrators can configure capabilities such as:

  • authenticators and additional verification methods;
  • OIDC for authentication and single sign-on;
  • SCIM for user provisioning and identity lifecycle synchronization;
  • SSF for security signal exchange;
  • SMTP for email-dependent workflows;
  • MDM and EDR integrations for device posture; and
  • license updates.

When licensed with ZTXGate, ZTXBAS is integrated as a library and can provide phishing-resistant biometric authentication without requiring a separate ZTXBAS server deployment.

Deployment control​

ZTXGate can be operated by the customer or an MSP and can run on-premises, in cloud-hosted infrastructure, across hybrid environments, or in fully air-gapped environments.

Core access operation does not require a mandatory CoreZT-hosted cloud control plane. External identity, MDM, EDR, SIEM, or cloud authentication services naturally require connectivity when those integrations are used.

Documentation scope​

These website docs focus on the stable concepts and the basic deployment and configuration workflow. Exact installer commands, setup-script prompts, port matrices, advanced operational procedures, and release-specific administration details are intentionally outside the scope of this introductory section for now.

What's next​

Start with Getting started for the minimum system requirements and the initial deployment workflow.

You may also want to review: