Enterprise Zero Trust Architecture with OpenZiti 2.0 Training

Course Overview

Learn to design and evaluate identity-based application connectivity with OpenZiti 2.0. This independent technical course connects enterprise architecture decisions with controllers, routers, tunnelers and application SDKs. Learners examine explicit access policies, authentication, availability and operational responsibility, then apply these concepts in an isolated learning environment.

The 2.0 release line is the reference baseline. Confirm exact lab versions and dependencies before delivery. The official 2.0 announcement includes generally available controller high availability, OIDC/JWT changes, overlay management API access and a fine-grained permissions model described as beta in that release announcement. Verify the status of each capability against the selected lab release.

Open-source software does not eliminate infrastructure or operational costs. No official vendor partnership, certification, compliance assurance or production security guarantee is implied.

Key Features

Scenario-led explanations, architecture diagrams, guided policy exercises, troubleshooting and a capstone review. Proposed assessment: original knowledge checks, lab validation and architecture discussion. Confirm assessment criteria and any AgileNow completion document before advertising them. Do not imply an official OpenZiti/NetFoundry exam or credential.

Price, duration, dates, delivery mode, trainer, lab access, materials and support must be confirmed in the quotation; no figures or availability have been supplied yet.

What You Will Get

• Explain identity-based connectivity and resource-specific authorisation.
• Map controller, router, tunneler and SDK responsibilities.
• Model identities, services and least-privilege policies.
• Compare existing-application access and SDK integration.
• Plan availability, monitoring, backups and recovery.
• Investigate identity, policy, routing and application failures.
• Present a phased enterprise adoption proposal and validation criteria.

Prerequisites

For network/security engineers, solution architects, platform engineers, DevOps practitioners, infrastructure administrators and application developers. Recommended foundations: TCP/IP, DNS, TLS/PKI, Linux command-line operations and basic identity management. Confirm lab host requirements and any cloud account needs before enrolment.

Independent training. No official OpenZiti or NetFoundry certification or endorsement is claimed. Fees, duration, lab access and dates require a confirmed quotation.

Course Curriculum

1. Zero trust foundations

Identity, explicit authorisation, least privilege and trust boundaries. Distinguish application access from endpoint and application security. Exercise: map actors, resources and authorised interactions for a fictional enterprise service.

2. OpenZiti architecture

Controller responsibilities, router fabric, tunnelers and SDKs. Authentication, service discovery and connection flow. Control-plane versus application-data considerations. Exercise: draw an end-to-end connection and explain each component.

3. OpenZiti 2.0 and release planning

Controller HA; OIDC/JWT authentication and enrolment; fine-grained permissions and their release-specific maturity; overlay management API access; CLI changes, deprecations and compatibility. Exercise: produce a version inventory and release-note checklist.

4. Isolated deployment lab

Define authorised lab systems and dependencies. Establish controller/router connectivity using selected-release documentation. Protect bootstrap identities and enrolment material. Validate health before application configuration. Exercise: record topology, assumptions and deployment evidence.

5. Identity lifecycle

Enrolment workflows, certificates, trust relationships and identity-provider integration concepts. Authentication policies, revocation and rotation. Exercise: enrol lab identities and verify access changes after permissions are removed.

6. Services and policies

Application services, Dial/Bind concepts, role attributes, policy matching and configuration types. Positive and negative tests. Exercise: allow one identity to access a service while confirming another is denied.

7. Existing applications and tunnelers

Client/hosting roles, interception, addressing, DNS and application dependencies. Topology choices and configuration troubleshooting. Exercise: document an application path and safely test failure conditions.

8. Application-embedded connectivity

SDK suitability, application identity, connection handling, error visibility and deployment lifecycle. Developer/platform responsibilities. Exercise: review a small integration design; language and coding depth agreed for the cohort.

9. Availability and recovery

Controller clustering and quorum considerations, router placement, failure domains, latency/capacity assumptions, backup/restore planning and controlled failover tests. Exercise: write a recovery test with success and rollback criteria.

10. Operations and troubleshooting

Logs, events, health evidence and configuration changes. Separate identity, policy, network and application failures. Exercise: investigate a deliberately misconfigured lab policy and explain diagnostic evidence.

11. Enterprise adoption

Application discovery, phased onboarding, existing identity/security integrations, administrative responsibilities, configuration review, change control and upgrades. Exercise: define rollout ownership, validation and operational handover.

12. Capstone architecture review

Present requirements, topology, identity flows, least-privilege policies, failure handling and residual risks. Demonstrate allowed/denied lab connectivity. Propose monitoring, recovery and rollout checks. Review the design and identify improvements.

Who Should Attend

For network/security engineers, solution architects, platform engineers, DevOps practitioners, infrastructure administrators and application developers. Recommended foundations: TCP/IP, DNS, TLS/PKI, Linux command-line operations and basic identity management. Confirm lab host requirements and any cloud account needs before enrolment.