QuickZTNA
User Guide

Verify key generation, ChaCha20-Poly1305 encryption, and that private keys never leave the machine.

Verify tunnel establishment, peer visibility, DERP relay selection, and end-to-end ping across the mesh.

Measure baseline latency, throughput via DERP vs direct, reconnect time, and verify no performance regressions.

Controlled penetration tests: port scans, traffic interception, key extraction, and replay attacks.

Test auth-key misuse, configuration hardening, known CVE exposure, and binary integrity verification.

Understand and verify how DERP relay servers provide encrypted fallback paths when direct WireGuard UDP tunnels cannot be established.

Verify that the client automatically selects the lowest-latency DERP region and fails over to the next best region when the preferred one is unavailable.

Verify that the client successfully performs UDP hole-punching to establish direct peer connections through NAT devices, bypassing the DERP relay.

Confirm direct peer-to-peer WireGuard connections are active, measure their performance, and verify they bypass DERP relay entirely.

Use ztna netcheck and ztna diag to diagnose connectivity issues, identify NAT types, verify STUN reachability, and collect diagnostic reports for support.