--- title: "Details about the elements of AppGate ZTNA" slug: "about-appgate-sdp-v6-6" description: "AppGate ZTNA offers secure, context-aware access management for cloud and hybrid environments, ensuring granular control and seamless connectivity for users and devices." updated: 2026-02-13T14:51:44Z published: 2026-02-13T14:51:44Z canonical: "support.appgate.com/about-appgate-sdp-v6-6" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.appgate.com/llms.txt > Use this file to discover all available pages before exploring further. # About AppGate ZTNA #### AppGate ZTNA offers secure access management for users and devices in cloud and hybrid environments. AppGate ZTNAallows organizations to implement a [Zero Trust Network Access](/v1/docs/zero-trust-based-v6-6) strategy for granular, context-aware access control in distributed environments. It introduces a [6-layer trust model](/v1/docs/zero-trust-based-v6-6) with multiple verification steps beyond sign-in, requiring further checks for specific resource connections. AppGate ZTNA operates without a traditional network perimeter and does not require specific hardware, functioning across cloud and hybrid setups through software virtualization. Controllers define access rights for users or devices individually, authenticating them based on unique session Claims like browser type, device posture, geo-location, and identity. After authentication, Entitlement tokens are issued to the AppGate ZTNA Client. The Portal provides an alternative connection method to protected resources via a browser, eliminating the need for a Client installation. The Portal uses the same trusted connectivity approach as AppGate ZTNA Clients, assigning an available Client instance for each user connection, with access rights and routing determined by assigned Policies. Typically, a Portal is deployed as a standalone appliance outside the protected network, such as in the cloud. The Connector integrates under-protected and over-privileged devices into the Zero Trust environment by hosting unmanned AppGate ZTNA Client instances with their own Entitlements, enabling local resources like sensors and servers to connect seamlessly with users and cloud services. Entitlement tokens identify which Gateways to connect to, and these tokens are passed to Gateways that provision a micro-firewall instance for each session. The firewall instances evaluate rules to allow or block access to protected hosts, applications, or servers. The Connector simplifies network integration, requiring only an outbound connection on port 443 to establish a bi-directional, multi-protocol tunnel, facilitating access to distributed resources by adding Connectors to the Site. All access activities must be logged for compliance. The LogForwarder efficiently forwards selective audit logs to external systems, allowing multiple input sources and output destinations with in-line filters. A local LogServer is also available within a Collective. ## AppGate ZTNA Key Concepts and Features Understanding the [Eight Key Concepts](/v1/docs/8-key-concepts-v6-6) of the AppGate ZTNA system is essential before configuration. Key-value pairs related to the identity and content of the user or device and are specific to each session. A defined access right or permission granted to users or devices, allowing them to access specific resources or functionalities within the Appgate ZTNA system. The application used by end-users to connect to the Appgate ZTNA system, providing secure access to resources. A web-based interface that allows users to access resources without requiring a standalone Client. It serves as a reverse proxy for user traffic. A component that extends connectivity to remote sites and unmanaged resources without requiring the use of a standalone Client. In AppGate ZTNA, a Site refers to a group of networks or resources reachable from a Gateway. An appliance that is deployed to export logs by Site. An appliance that collects logs from other members of the Collective, providing an audit trail of actions and user access. A group of appliances configured and managed together.