AZ Asia-Pacific - Zscaler Help Centre

Tunnel 2.0 DTLS and TLS mode

Christian Narvaez — Fri, 20 Oct 2023 06:30:15 +0000

Based on multiple reports and data analysis, it is observed that certain ISPs deprioritize UDP-based traffic which includes DTLS. DTLS is the primary transport protocol for Z-Tunnel 2.0. Such de-prioritization leads to performance issues towards internet destinations. This sometimes leads to the inability to access the destination.

Note that the DTLS uses UDP over port 443 whereas TLS uses TCP over port 443.

This is...

App Connector Selection

Christian Narvaez — Fri, 05 May 2023 05:38:32 +0000

ZPA will choose the app connector closest to the user geographically.

So let’s say a Germany user tries to connect to a server hosted in Singapore. Both SG and Germany has app connector deployed. Germany user will still connect to Germany App Connector.

ZPA Service Edge Selection

Christian Narvaez — Fri, 05 May 2023 05:35:54 +0000

1. Specifying the Trusted Network to connect with the Private Service Edge
2. Geo IP-based selection of PSE

Specifying the Trusted Network to connect with the Private Service Edge

When the ZPA component of Zscaler Client Connector is started, it establishes a client tunnel to a ZPA Public Service Edge. Zscaler Client Connector sends information about its local network, and the ZPA Public...

Load Balancing for PAC Forwarded Traffic

Matthews Loke — Wed, 09 Mar 2022 16:02:50 +0000

Many organizations use only Zscaler Client Connector as the traffic forwarding method, which means that a lot of users from one physical location may connect from behind the same edge gateway, meaning they all appear to have the same egress IP address. With the normal load balancing calculation, this leads to all the users from the same location to connect...

Microsoft Quick Assist

Jacque Xu — Fri, 17 Dec 2021 05:03:22 +0000

Quick Assist is a Windows 10 application that enables a person to share their device with another person over a remote connection. Your support staff can use it to remotely connect to a user’s device and then view its display, make annotations, or take full control. In this way, they can troubleshoot, diagnose technological issues, and provide instructions to users...

Install Zscaler Root Certificate in MacOS

Angel Lou Martinez — Tue, 11 Oct 2022 15:37:37 +0000

Policy > Access Control - SSL Inspection > Download Zscaler Root Certificate

Access your default browser.

Settings > Privacy & Security > Security > Manage certificates > Import the downloaded Zscaler Root Certificate.

Trusting Zscaler Root SSL certificate from macOS device

In the Keychain Access app ...

Tunnel 2.0: Domain Based Bypasses + Proxy Listener Configuration

Matthews Loke — Wed, 09 Mar 2022 16:17:49 +0000

In the Tunnel forwarding mode with Z-Tunnel 2.0, Zscaler Client Connector behaves as a pseudo-VPN client and ‘includes’ or ‘excludes’ traffic at the IP Layer, which means it has no native way to recognize domain-based addresses, host names or URLs for special treatment. However, you can configure domain-based bypasses with custom PAC files for the forwarding...

ZIA NSS VM Can't connect to the Zscaler Cloud

Christian Narvaez — Fri, 08 Apr 2022 07:52:36 +0000

Step 1: Check the connectivity of NSS going to Zscaler by typing the command sudo nss troubleshoot netstat | grep tcp

The results below shows that NSS VM is unable to reach Zscaler node.

Step 2: Do Arp Request to verify the connectivity by typing the command sudo tcpdump –t...

One-Click Office 365 Configuration

Jacque Xu — Fri, 17 Dec 2021 05:04:46 +0000

What you will see after enabling One-Click Office 365 Configuration:

The Office 365 One Click Exception Configuration option will be grayed out.

A pre-defined Office 365 One Click Rule will be enabled in SSL Inspection Policy (Policy > SSL Inspection). The rule isn't configurable and can't be deleted. If this rule is enabled, any Office 365 traffic will be exempted from SSL inspection and other web policies, such as URL...

Normal Block Policies vs Malicious Block Policies

Jacque Xu — Fri, 17 Dec 2021 05:04:28 +0000

In Normal Block Policies:
If it is a normal URL Filtering & Cloud App Control policy or any other policy, you will be presented with the block page because Zscaler inspect that traffic and decrypt the CONNECT request as they can allow some packet exchange for those URLs as those are not harmful. Zscaler will then send a 403 response code...

New Format for Creating a Support Ticket in the Admin Portal.

Jacque Xu — Fri, 17 Dec 2021 05:04:04 +0000

Hover your mouse pointer in the question mark (?) icon.

Under support click ‘Submit a Ticket’. //it will direct you to another window

Click 'Start Here'. //you will be directed to Zac, Your Zscaler Virtual Assistant.

Adding Bypasses for Z-Tunnel 2.0

Jacque Xu — Fri, 17 Dec 2021 04:57:17 +0000

3 BYPASSES that you can deploy on Z-Tunnel 2.0

Following are the best practices for IP-based bypasses:

VPN Gateway Bypasses

Destination Exclusions and Inclusions

Port Based Bypasses

IP-Based Bypasses

For Z-Tunnel 1.0, you can add network bypasses to the app profile PAC file. But if you are using Z-Tunnel 2.0, do not add network bypasses to Zscaler...

Azure AD Conditional Access

Jacque Xu — Fri, 17 Dec 2021 04:57:42 +0000

This article will describe the use of conditional access and how traffic are being routed and expected to be coming from.

In order to enforce user's O365/Microsoft traffic to be only accepted from a certain location (Typically Public IP), "Named location" will be needed to define either "Countries location" or "IP ranges location".

Best Practices for Implementing Access to Microsoft 365 with Zscaler

Jacque Xu — Fri, 17 Dec 2021 04:58:04 +0000

Microsoft published guidelines for work-from-anywhere (WFA) users and a strategy to split the most performance-sensitive Microsoft 365 applications, which need optimized connectivity from VPN tunnels. These applications include Microsoft Teams, Exchange Online, and SharePoint Online (Implementing VPN split tunneling for Office 365 - Microsoft 365 Enterprise | Microsoft Docs).

For an optimal user experience, Zscaler recommends...

Capturing HTTP Header on Google Chrome

Jacque Xu — Fri, 17 Dec 2021 04:58:26 +0000

Zscaler Support might ask you to provide HTTP headers when troubleshooting certain issues. The HTTP headers identify the specific URL the browser accessed when you opened a web page. Google Chrome has a built-in developer tool that allows you to capture HTTP headers and save them to a file.

Process:

open Google Chrome.

to open developer tools, press CTRL + SHIFT + i

or on...

Capturing HTTP Headers on Mozilla Firefox

Jacque Xu — Fri, 17 Dec 2021 04:58:49 +0000

Zscaler Support may ask you to provide HTTP headers when troubleshooting certain issues. The HTTP headers identify the specific URL the browser accessed when you opened a web page. You can use Mozilla's Inspector tool to capture HTTP headers in Mozilla Firefox version 88.0.1.

Process:

Open Mozilla Firefox, load your desired website. example www.facebook.com

on the top-right click on Application Menu > More Tools...

Certificate Pinning and SSL Inspection

Jacque Xu — Fri, 17 Dec 2021 04:59:06 +0000

There is no universal tool or method to check if the application does Certificate Pinning. The Certificate Pinning is used by the application to prevent MiTM attacks, so Zscaler cannot do anything more than just adding the URL to the SSL bypass.

In certain events, some applications will show the error message while it comes to Certificate Pinning while others just cannot...

Creating Custom Categories Tips

Jacque Xu — Fri, 17 Dec 2021 04:59:22 +0000

In your custom URL category, you can add only URLs or keywords, there is no option to add IP Subnets inside the URL category.

But you can insert subnet IP inside the custom URL but it will probably not work as you expect. Because Zscaler only looks for the URL and not for destination IP for what you inserted inside the custom...

Deciding Nearest ZIA Public Service Edge

Jacque Xu — Fri, 17 Dec 2021 05:00:05 +0000

To determine which is the nearest Zscaler DCs for the specific IP or machine. Here are some commands that you can use to achieve that:

You can run the below command in your command prompt to see the nearest DCs for specific IP.

Replace the IP with your public source IP:

curl https://pac.zscaler.net/getGatewayEndpoints?srcip=115.112.60.134

Disable Loopback Restriction

Jacque Xu — Thu, 06 Jan 2022 03:11:43 +0000

This setting inside the app profile must be enabled if client encountered an issue with outlook and intune. Some servers are using loopback addresses, when ZIA is on the endpoint might not be able to access those servers that are using loopback address.

https://help.zscaler.com/client-connector/configuring-zscaler-client-connector-profiles

Disneyplus - bypass through PAC file

Jacque Xu — Fri, 17 Dec 2021 05:01:08 +0000

https://help.zscaler.com/client-connector/configuring-zscaler-client-connector-profiles

IdP Integration: Google Workspace

Jacque Xu — Fri, 17 Dec 2021 05:01:35 +0000

Configuration Guide for Google Apps

This guide provides information on how to set up Google Apps as an IdP for ZIA.

Prerequisites

Ensure that you have the following:

· Google Apps account with admin privileges

· A ZIA account with an administrator role that allows you to add an IdP Configuration

Configuring Google Apps as the IdP for the Zscaler Service

To configure Google Apps as the...

iOS High Data Usage

Jacque Xu — Fri, 17 Dec 2021 05:02:13 +0000

Data usage in iOS combines the actual app's data usage along with the VPN adapter usage which results in showing 200% of the actual data usage.

Note: Zscaler App uses the VPN adapter to receive the traffic from the Apps and then forward it out to Zscaler ZEN nodes accordingly.

This behavior is seen by other Apple users as well and they...

Looking Up and Updating URLs

Jacque Xu — Thu, 06 Jan 2022 03:12:27 +0000

To use Site Review:

Go to https://sitereview.zscaler.com/

In the Enter URL field, add a URL or IP address. Use Enter on your keyboard or click Add More to add up to three sites.

The URL or IP address is automatically populated in the Enter URL field when you request a review of it from the blocked EUN page.

Click Look Up after you have added your sites. A new page appears.

On this new page,...

Measuring the Performance of the Zscaler Service

Jacque Xu — Fri, 17 Dec 2021 05:02:52 +0000

Broadband “speed testing” emerged as one of the primary metrics for measuring cloud based throughput, especially an entire segment of routed customer’s traffic. Common tools for network performance measurement, such as Speedtest and Iperf, can provide inaccurate results when using the Zscaler service. This is due to their test conditions and the methods they use to test network throughput. Hence,...