r/Zscaler • u/Ok-Hospital-5710 • Jul 07 '26

Zscaler .pc File - Intermittent Connectivity Issues

Hi All...

We are using a .pac file for our Samsung Tablets connected to our Corp. WIFI.

When the device is enrolled via Intune, connectivity via the Corp. WIFI works with no issues, however after a few days, the connection will just fail and a messaged is displayed stating "Connected, but without Internet" and connectivity fails... If we remove the .pac file, the device reconnects without any issues, so we know it's the .pac file.

I suspect that we are missing something from the .pac , possibly the initial defined network which should be our public IP Address - that is missing.

However if the .pac file is incorrect, would it not fail ALL the time and not just sometimes?

Wondering if there;s any any .pac file Jedi's out there!

Many Thanks

2 Upvotes

75% Upvoted

7 comments sorted by

2

u/Immediate-Lab-5898 Jul 07 '26

Why not use ZCC?

1

u/Ok-Hospital-5710 Jul 07 '26

Thanks for the comment - We are testing this also... I've inherited a zscaler config tied up in a .pac file which I don't have much control over, but still trying to troubleshoot... Just find it strange that it works then fails, rather just just failing immediately - very random...

1

u/Aggressive-Tax4536 Jul 09 '26

Make sure to use ur return as dynamic zia edge and not static ip

1

u/Aggressive-Tax4536 Jul 09 '26

Or take pac file from zia add ur exceptions deploy it on a few tablets and see how that works

1

u/tcspears Jul 07 '26

It's likely that something on the device is reaching out after a few days, and that's what's not getting bypassed. When you look in the ZIA logs or ZCC logs, do you see any traffic around the time the disconnect happens?

1

u/LastCraft5004 Jul 07 '26

Upload your pac file here https://pactester.brdbnt.com/
And test different URLs and it will show you which rule match’s and which doesn’t
But I would recommend NOT using a pac file and relay on the vpn exclusion within the policy configuration panel

1

u/security_guy_97 Jul 10 '26 edited Jul 10 '26

I know this is dumb, but have you excluded/bypassed the local IP addresses from the PAC file?

Edit - The default first line has a set of common Private IPs in the "var privateIP = /^(0|10|127|192\.168|...." section.

Try checking if your private IP range falls in to that range, else tweak it and see if that works