Zscaler

---
name: zscaler
description: "Expert agent for Zscaler Zero Trust Exchange. Covers ZIA internet access, ZPA private access, ZDX digital experience monitoring, App Connector deployment, and Zscaler's 150+ data center architecture. WHEN: \"Zscaler\", \"ZIA\", \"ZPA\", \"ZDX\", \"Zscaler Internet Access\", \"Zscaler Private Access\", \"Zscaler Digital Experience\", \"App Connector\", \"Zscaler tunnel\", \"ZCC client\", \"Zscaler policy\"."
license: MIT
---

# Zscaler Zero Trust Exchange

This skill covers Zscaler's Zero Trust Exchange (ZTE) platform, covering ZIA (internet access), ZPA (private access), ZDX (digital experience), and the supporting infrastructure across Zscaler's 150+ global data centers. Zscaler is deployed by approximately 40% of the Fortune 500.

## How to Approach Tasks

When you receive a request:

1. **Classify** the request:
   - **ZIA** — Internet access, SWG, cloud firewall, DLP, CASB, sandboxing
   - **ZPA** — Private access, App Connector, ZTNA policy, ZPA app segments
   - **ZDX** — Digital experience monitoring, ISP path analysis, end-user experience scoring
   - **Client (ZCC)** — Zscaler Client Connector deployment, tunnel configuration
   - **Architecture** — Platform design, PoP selection, traffic steering
   - **Policy** — URL filtering, firewall rules, access policies, DLP configuration

2. **Identify the deployment context** — Cloud-only (M365/SaaS), hybrid (on-prem apps + cloud), or transformation (full ZTNA to replace VPN).

3. **Load context** — For architecture and data center topology questions, read `references/architecture.md`.

4. **Recommend** — Provide Zscaler-specific guidance with Admin Portal navigation paths, API references, and configuration examples.

## Zscaler Architecture Overview

### Zero Trust Exchange Platform

The Zero Trust Exchange is Zscaler's unified cloud platform, processing all traffic through its global node network.

**Platform components:**
```
Zscaler Zero Trust Exchange
├── ZIA — Zscaler Internet Access (internet-bound traffic)
│   ├── Secure Web Gateway (URL filtering, SSL inspection)
│   ├── Cloud Firewall (L4-L7 enforcement)
│   ├── Cloud Sandbox (Advanced Threat Protection)
│   ├── CASB (SaaS visibility and control)
│   ├── DLP (data loss prevention)
│   └── Workload Protection (Cloud Connector)
│
├── ZPA — Zscaler Private Access (private app access)
│   ├── App Connectors (deployed in private network)
│   ├── ZPA Cloud (broker/controller in Zscaler cloud)
│   ├── Zscaler Client Connector (endpoint agent)
│   └── Browser Access (agentless, clientless)
│
├── ZDX — Zscaler Digital Experience (monitoring)
│   ├── Endpoint probes (via ZCC agent)
│   ├── Network path analysis
│   └── Application performance monitoring
│
└── ZCP — Zscaler Cloud Protection (workload and cloud posture)
    ├── Cloud Security Posture Management (CSPM)
    └── Cloud Native Application Protection (CNAPP)
```

### Global Infrastructure

**150+ data centers:** Zscaler operates data centers in every major metro globally. Each data center is a fully functional node capable of processing all ZTE functions.

**Node redundancy:** Each metro has multiple nodes. Traffic routed to nearest available node. Node failure causes instant failover to next-nearest.

**Traffic steering to nearest node:**
- ZCC agent: DNS resolution of `gateway.zscaler.net` returns nearest node IP
- Office IPsec/GRE tunnel: Configured to nearest PoP; secondary PoP for failover
- PAC file: Returns proxy PAC pointing to nearest node

**Zscaler Enforcement Node naming:**
Nodes are named by city and number: `nyc1.zscaler.net`, `lon1.zscaler.net`, etc.

**Peering:** Zscaler has direct peering with Microsoft (Azure, M365), Google (GCP, Workspace), Salesforce, ServiceNow, and hundreds of other SaaS providers at IXPs globally. This means SaaS traffic exits Zscaler's network directly to the provider without transiting the public internet.

## ZIA — Zscaler Internet Access

### Traffic Flows

**With ZCC agent (remote users):**
```
Endpoint → ZCC intercepts traffic → Encrypted Z-Tunnel to nearest ZIA node
→ ZIA processing (URL filter, SSL inspect, malware scan, DLP, CASB)
→ Internet / SaaS destination
```

**With office tunnel (GRE/IPsec):**
```
Office devices → Default route to gateway → GRE/IPsec tunnel to ZIA node
→ ZIA processing → Internet / SaaS destination
```

**Z-Tunnel 2.0:** Zscaler's proprietary protocol over DTLS (Datagram TLS). Provides better performance than legacy HTTP(S) proxy tunnel, especially for latency-sensitive traffic.

### SSL Inspection

ZIA intercepts all HTTPS traffic for inspection.

**SSL inspection bypass categories (Zscaler pre-built):**
- Financial services (banking sites)
- Healthcare
- Government
- Privacy-sensitive (personal health, personal finance)
- Certificate-pinned applications

**SSL inspection bypass configuration:**
In ZIA Admin Portal → Policy → SSL Inspection → SSL Bypass Rules
- Add by URL category
- Add by specific domain/URL
- Add by destination IP
- Apply to all users or specific user groups

**Custom CA certificate:**
Organizations can use their own internal CA for SSL inspection (instead of Zscaler's CA). The custom CA certificate must be trusted by all endpoint operating systems.

### URL Filtering

**Categories:** Zscaler maintains 200+ URL categories updated in real-time by ThreatLabZ.

**Policy structure:**
- URL Filtering Policies: Priority-ordered rules
- Each rule: Condition (URL category, user/group, time) → Action (Allow/Block/Caution/Override)
- "Caution" shows a warning page but allows continuation

**Custom categories:** Create custom URL categories with:
- Specific domains/URLs
- Keywords in URL
- IP address ranges

**Block page customization:** Custom HTML for block page; can include IT contact info, ticket submission link.

**Allow list / Deny list:** Explicit overrides for specific URLs regardless of category.

### Cloud Firewall

**Layers:**
- **L4 Firewall:** TCP/UDP port/protocol rules. Blocks outbound non-standard ports.
- **L7 Firewall:** Application-aware rules. Block specific applications (e.g., allow HTTPS but block BitTorrent even over HTTPS).
- **DNS Firewall:** Block malicious domains at DNS resolution time.
- **IPS:** Intrusion Prevention System rules (Snort-based rule format, Zscaler-managed).

**Firewall rules:** Similar to traditional NGFW rules:
```
Source User/Group → Destination IP/Domain/Country → Application → Protocol → Action
```

**Outbound firewall policy:**
Control what traffic can leave (useful for malware C2 prevention):
- Block all traffic except defined protocols (allow: HTTP/S, DNS, SMTP, IMAP, POP3)
- Block direct IP destinations (many malware tools use IP, not hostname)
- Block suspicious geographies

### Cloud Sandbox (Advanced Threat Protection)

**File sandbox:** Unknown files are detonated in Zscaler's cloud sandbox before delivery.

**Supported file types:** Office, PDF, executables, scripts, archives, iOS/Android APKs.

**Sandbox tiers:**
- **Advanced Threat Protection (ATP):** Included in standard ZIA. Signature + heuristics.
- **Advanced Cloud Sandbox:** Premium add-on. Full behavioral detonation.

**Sandboxing policy:**
- Submit all unknown files vs. suspicious only
- Action on malicious verdict: Block download
- Action on inconclusive verdict: Allow with log / Hold and wait

**AI Security (add-on):** Zscaler uses AI to detect phishing pages, command injection, and browser exploitation in real time.

### CASB

**Inline CASB:** Automatically applied when ZIA inspects SaaS traffic.

**Shadow IT discovery:** ZIA logs all cloud application usage. Dashboard shows:
- Number of cloud apps in use
- Application risk scores (Zscaler App Profile — business risk, data risk, regulatory risk)
- Department-level breakdown
- Trend over time

**Tenant restrictions:** Add `X-ZScaler-Tenant` header to M365 traffic to enforce corporate tenant access.

**Application controls:**
- Per-app controls: Allow upload to corporate Box, block upload to personal Box
- Activity-level: Block "download" to personal Box; allow "view"
- Predefined controls for 400+ popular SaaS apps

### DLP

**DLP Engines:**
- **Pattern-based:** Credit cards, SSN, IBAN, health data
- **Exact Data Match (EDM):** Hash-based matching against indexed sensitive data sets
- **Document Fingerprinting:** Match against template documents
- **ML-based classification:** Source code, financial data, M&A documents

**DLP policy:**
1. Define DLP Engine (content type to detect)
2. Define DLP Rule (engine + location + action)
3. Policy channels: Web, Email (requires integration), Endpoint

**DLP Actions:**
- Allow with log
- Block
- Allow after user justification (user must enter a reason)
- Quarantine (hold for admin review)
- Encrypt

## ZPA — Zscaler Private Access

### Architecture

```
User (ZCC) ──→ ZPA Cloud (broker) ──→ App Connector ──→ Private Application
                                       (deployed in private network)
```

**Key difference from VPN:**
- App Connector makes outbound connection to ZPA Cloud. Private application never exposed to internet.
- User gets access to the application, not the network. No lateral movement.

### App Connector

**Deployment:** VM deployed in the same network segment as the private applications.
- Supports: VMware, Hyper-V, AWS, Azure, GCP, Docker, Bare metal (Linux)
- OS: Amazon Linux 2, RHEL/CentOS, Ubuntu, Debian

**App Connector connectivity:**
- Outbound-only persistent tunnel to ZPA Cloud nodes
- No inbound firewall rules needed on the private network
- Uses DTLS/TLS over port 443

**App Connector groups:**
Group App Connectors logically (e.g., by site, by cloud region). ZPA routes user connections to App Connectors closest to the user (or via policy).

**High availability:**
Deploy 2+ App Connectors per segment. ZPA automatically load-balances and fails over.

### App Segments and Server Groups

**Server Group:** Collection of App Connectors that can reach a set of applications.

**Application Segment:** Defines the applications accessible through ZPA.
- Hostname/IP addresses and port/protocol combinations
- Domain names for DNS resolution (App Connectors do DNS resolution for private names)
- Associated with one or more Server Groups

**Example Application Segment:**
```
Name: Internal HR System
Hostnames: hrapp.internal.corp.com
Ports: 443/TCP
Domain Bypass: false
Server Group: DataCenter-Connectors
```

### Access Policies

ZPA access policy defines: Who can access which applications, under what conditions.

**Policy rule structure:**
```
Rule: Finance Team → SAP Access
Criteria:
  - User: Group = "Finance"
  - Device: Posture = "Compliant" (enrolled, EDR active)
  - Conditions: During business hours (optional)
Action: Allow
Application: SAP-Production (Application Segment)
```

**Device posture integration:**
ZPA integrates with CrowdStrike, Microsoft Defender, Carbon Black, Jamf, Intune — checks device posture as part of access decision:
- EDR agent running
- OS fully patched
- Disk encryption enabled
- MDM enrollment verified

**Browser Access (agentless):**
For users who cannot install ZCC (contractors, BYOD):
- Browser Access provides HTML5/web-based access to internal applications
- No agent required; accessed via a Zscaler-hosted proxy portal
- Less device posture visibility; use for lower-sensitivity apps

### App Connector Deployment (AWS Example)

```bash
# Deploy App Connector in AWS via AMI
# 1. Launch EC2 instance from Zscaler AMI (available in AWS Marketplace)
# 2. Instance type: m5.large minimum for production

# App Connector provisioning key (from ZPA Admin Portal)
export PROVISIONING_KEY="base64encodedkey..."

# After first boot, register connector:
/opt/zscaler/bin/zpa-connector register --key $PROVISIONING_KEY

# Verify connector status
/opt/zscaler/bin/zpa-connector status
```

**Network configuration for App Connector in AWS:**
- Security Group: Outbound 443/TCP to `*.zpa.zscaler.com` (egress-only)
- No inbound rules required
- Route private application subnets through App Connector's VPC

## ZDX — Zscaler Digital Experience

### Purpose

ZDX monitors end-to-end application performance from the user's device perspective, providing visibility into: Is the problem on the user's device, the ISP path, or the application?

### Architecture

**ZDX probes (via ZCC agent):**
- ZCC agent runs synthetic probes from endpoint: HTTP GET, DNS lookup, traceroute
- Probes run every 5 minutes (configurable)
- Data sent to ZDX Cloud for aggregation and analysis

**Monitored applications (examples):**
- Microsoft 365 (Exchange, Teams, SharePoint)
- Salesforce
- Zoom, Webex
- Custom internal applications
- Any HTTP/HTTPS application

### Metrics Collected

**Device metrics:**
- CPU utilization (high CPU → application slowness)
- RAM utilization
- WiFi signal strength and interference
- VPN/ZCC tunnel performance

**Network path metrics:**
- Hop-by-hop latency (traceroute)
- ISP identification and performance
- Packet loss
- Path to Zscaler PoP
- Path from Zscaler PoP to application

**Application metrics:**
- DNS resolution time
- TCP connection time
- TLS handshake time
- Time to first byte (TTFB)
- Total page load time

### Troubleshooting Use Cases

**Use case: "Microsoft Teams is slow"**

ZDX analysis:
1. Check user's device CPU/RAM → Normal
2. Check WiFi signal → Weak (-75 dBm)
3. Check path to ZIA node → 200ms (high)
4. Identify: User on crowded WiFi channel in open office

**Use case: "Multiple users in London complaining about Salesforce slowness"**

ZDX analysis:
1. Check ZDX Experience Score trend → Dropped at 14:00 UTC
2. Check path data → ISP latency spike for BT Business connections
3. Check Zscaler PoP health → Normal
4. Check Salesforce path from PoP → Normal
5. Identify: ISP-level issue affecting BT Business customers in London

### ZDX API

```bash
# Get ZDX app metrics
curl -H "Authorization: Bearer {token}" \
     "https://zdxapi.zscaler.com/api/v1/apps/{app_id}/metrics?since=3600"

# Get user experience score
curl -H "Authorization: Bearer {token}" \
     "https://zdxapi.zscaler.com/api/v1/users/{user_email}/experience_score"
```

## Zscaler Client Connector (ZCC)

### Tunnel Modes

**ZIA Tunnel Mode:**
- **Z-Tunnel 1.0:** HTTP CONNECT proxy. HTTP traffic proxied; non-HTTP traffic bypassed.
- **Z-Tunnel 2.0 (default):** All traffic tunneled via DTLS. Better coverage, better performance.
- **Packet filter mode:** Route all IP traffic (required for non-TCP, e.g., ICMP, UDP games).

**ZPA Tunnel Mode:**
- Separate from ZIA. ZCC establishes ZPA tunnel alongside ZIA tunnel.
- Both tunnels can run simultaneously (ZIA for internet, ZPA for private apps).

### Split Tunnel Configuration

**Split tunnel (recommended):**
- Route only corporate traffic through Zscaler
- Direct route to: Microsoft 365 URLs (per Microsoft's recommended PAC), Zoom, other low-risk SaaS
- Reduces Zscaler processing load and latency for trusted SaaS
- Configuration: PAC file or Forwarding Profile in ZCC

**Full tunnel:**
- All traffic through Zscaler
- Highest security but adds latency for every destination

**Bypass list:** Specific IP ranges or domains that bypass ZCC entirely (e.g., VoIP traffic, internal split DNS).

## Administration and Logging

### Admin Portal (admin.zscaler.com)

**Key navigation:**
- **Policy → Web Policy:** URL filtering rules
- **Policy → Firewall Filtering:** Outbound firewall rules
- **Policy → DLP:** DLP rules and engines
- **Administration → Cloud App Control:** CASB per-app controls
- **Analytics → Web Insights:** Traffic and threat analytics
- **Reports → Executive Insights:** CISO-level reporting

### Nanolog Streaming Service (NSS)

NSS streams ZIA logs to SIEM/log management platforms in real time.

**Supported outputs:**
- Splunk (Zscaler App for Splunk)
- Microsoft Sentinel (Zscaler connector)
- IBM QRadar
- Generic syslog (CEF format)
- S3/Azure Blob (for SIEM ingestion)

**Log feed types:**
- Web transactions (ZIA proxy log)
- Firewall logs
- DNS logs
- DLP incident logs
- Audit logs (admin changes)

### API

**Authentication:** OAuth 2.0 (client credentials)

**Key ZIA API endpoints:**
```
GET  /api/v1/urlCategories           # URL category list
POST /api/v1/urlFilteringRules       # Create URL filter rule
GET  /api/v1/dlpIncidents            # DLP incidents
GET  /api/v1/reports/sandbox         # Sandbox reports
```

**Key ZPA API endpoints:**
```
GET  /zpa/api/v1/application         # Application segments
GET  /zpa/api/v1/appConnector        # App connector status
POST /zpa/api/v1/accessPolicy/rules  # Create access policy rule
```

## Reference Files

Load for deep architecture knowledge:

- `references/architecture.md` — ZTE data center topology, Z-Tunnel protocol details, ZPA broker architecture, single-pass processing, SSMA (Secure Service Mesh for Apps), Zscaler Deception, Browser Isolation.