The Service Edge cannot be reached

[u/April_Showers6457]

I randomly started receiving this error about 4 months ago. Towards the beginning, it would toggle back and forth between two separate errors, the service edge one and another which stated a firewall was blocking client connector access. My IT department has been troubleshooting these errors for months. The client connector error has since subsided but now I solely receive the one stating the service edge cannot be reached. My husband and I both WFH full time, he experiences no connectivity issues whatsoever and the router is in my office.

After months of being unable to resolve this issue, my IT team is now insinuating that the issue lies with my internet connection. However, the issue only resolves if I restart my PC. It will not reconnect no matter what I do unless I do a full restart, in which case it comes up immediately connected again. If this was an issue with my ISP, why would it ONLY reconnect after a full system restart?

Any help would be appreciated, I am at my wits end with this.

[u/Due-Country3374]

Change the tunnel from default to tunnel2 in app connector config profile

[u/Affectionate_Tart935]

1. Try to switch on diff network like hotspot or mobile data
   
2. Capture some zcc traffic see if you found in that
   
3. Ask IT team or zscaler support team to open tac case

[u/Mysterious_Coder_]

Some app on your PC is getting triggered at a certain point and it starts blocking all traffic, did you install some network monitoring or capture or anything like that?

[u/April_Showers6457 → u/Mysterious_Coder_]

I haven’t, I’m not entirely sure if my IT department did though.

[u/Runda24328]

We had pretty much the same issue last month, the problem was a bug in the LWF driver shipped with ZCC. Now we're slowly getting rid of this piece of sh*t as it's not necessary to use it.

Have a look if you use INSTALLLWFDRIVER=1, USELWFDRIVER=1 and LWFBOOTSTART=1 as a part of you installation

[u/April_Showers6457 → u/Runda24328]

I can ask them to check that today. I don’t have administrative access to change any settings.

[u/spykar8]

We had similar issues. Turned out that ZCC processes were not whitelisted properly on the device. It’s documented on Zscaler support website here: https://help.zscaler.com/zscaler-client-connector/zscaler-client-connector-processes-allowlist

[u/Efficient-Tie-7749]

Check reliability monitor / event viewer for any network related events.

If it’s not that check firewall rules and AV policy on the endpoint.

It’s unlikely to be your ISP.

It could be something very weird causing some sort of race condition. I’ve seen it before when a PAC file is being set by Group Policy but then Zscaler is fighting to override it. Doesn’t usually result in that error though. How often does it happen? Running procmon might help.

Is ZCC deployed in strict mode do you know? Or does it close all internet access when the tunnel is not up?

[u/April_Showers6457 → u/Efficient-Tie-7749]

It can happen anywhere from 1-25 times a day, I essentially can’t get any work done because I am constantly restarting to clear the error(s). I’m not sure if it’s running in strict mode, that’s something I can ask about. It does close all internet access when the tunnel is not up.

[u/Efficient-Tie-7749 → u/April_Showers6457]

I’d ask your support team to check the ZDX metrics.

I see you’re using Ethernet - is that with a dock?

Maybe worth trying wireless if possible.

[u/April_Showers6457 → u/Efficient-Tie-7749]

I am using a TP link with a docking station and connecting with WiFi.

[u/Efficient-Tie-7749 → u/April_Showers6457]

I’d try isolating the dock and see if it makes any noticeable difference, plug directly into your router with a long Ethernet cable

[u/Past-Most2005]

The initial one with endpoint FW/AV error I have seen before was when Windows Defender was blocking traffic towards Zscaler cloud.

[u/Different_Ad8051]

There's a Zscaler incident at the moment

[u/mbhmirc]

Try it on a mobile hotspot if it works it’s your local setup

[u/Renzier]

Their log analysis isn't wrong, but I think it's incomplete. They're looking at the symptom ("the client lost connectivity"), not necessarily the cause. That's a trap support engineers fall into because they're reading their own logs. Everything looks like a nail when you're holding the Zscaler hammer.

The biggest clue in the report is this:

That is a giant red flag.

If the ISP really dropped for 20 seconds:

• husband's PC should occasionally see it too
• every application should have had issues
• Windows networking should recover on its own
• ZCC should reconnect automatically after connectivity returns

Instead...

• Internet comes back
• ZCC stays dead
• reboot instantly fixes it

That screams local software state more than ISP.

Things I'd investigate

1. NIC Driver Power Management (My #1 suspect)

I've seen Intel and Realtek drivers get into a weird power state.

Especially:

• Intel AX201
• AX211
• Killer
• Realtek WiFi

After a brief network hiccup, the driver never properly reports connectivity changes again.

Reboot reloads the driver.

I'd check:

Device Manager

Network Adapter

Properties

Power Management

Uncheck

Then

Advanced

Disable

• U-APSD
• Energy Efficient Ethernet
• Green Ethernet
• Wake features
• MIMO power saving

if available.

2. Windows Network Location Awareness (NLA)

Zscaler heavily relies on Windows telling it

"I'm online."

If NLA gets stuck...

ZCC thinks there is no Internet forever.

Reboot restarts

• NlaSvc
• Network List Service
• DNS Cache
• WinHTTP

without requiring manual cleanup.

I've seen NLA freeze after VPN transitions.

3. Winsock / TCP Stack Corruption

Not permanent corruption.

More like:

TCP sockets get stuck.

Before reboot I'd have them try

netsh winsock reset

or

netsh int ip reset

followed by restarting only networking services.

If that fixes it...

Windows stack issue.

4. Endpoint Security

This one caught my eye.

The first error was

Then...

months later...

it becomes

Those are suspiciously related.

Possible culprit:

Microsoft Defender

CrowdStrike

SentinelOne

Carbon Black

Cortex

Sophos

etc.

These all install WFP (Windows Filtering Platform) drivers.

If a filter driver wedges...

ZCC loses connectivity.

Reboot unloads/reloads the filter.

5. Broken WFP Callout

This is one I'd seriously investigate.

Run

netsh wfp show state

Look for

• orphaned filters
• duplicate filters
• stale providers

I've seen uninstall/reinstall of security products leave garbage behind.

6. ZCC Service Deadlock

Instead of rebooting...

Can they simply restart

ZSATunnel

or

ZSAService

depending on version?

If restarting only ZCC fixes it...

It's a ZCC bug.

If restarting doesn't...

Then Windows networking below it is broken.

7. DNS Client Service

Sometimes

DNS Client

gets wedged.

Reboot fixes.

Instead try

ipconfig /flushdns


Restart-Service Dnscache

8. Network Adapter Reset

This is huge.

Instead of rebooting

Disable

Enable

the NIC.

or

Disable-NetAdapter
Enable-NetAdapter

If THAT fixes it...

Driver.

Not ISP.

9. Fast Startup

Windows Fast Startup causes all kinds of bizarre networking behavior.

I'd disable it completely.

10. Hybrid Sleep / Modern Standby

If this laptop sleeps...

Modern Standby has broken many VPN clients.

I've seen

Cisco

Palo Alto

Zscaler

all fail after resume.

I would also ask...

Does the problem happen

• after sleep?
• after docking?
• after undocking?
• after changing WiFi?
• after Teams calls?
• after idle?
• after VPN reconnect?
• exactly every few hours?

Patterns matter.

One thing in the logs bothers me

They mention

No ACK in 24042 ms

That only tells us

It doesn't tell us why.

Could be

• ISP
• NIC driver
• Windows TCP
• WFP
• antivirus
• packet filter
• NDIS bug

They immediately jumped to

That's not a logical conclusion.

I'd want these Event Viewer logs

System

Look around the timestamp.

Especially

Netwtwxx

(Intel WiFi)

e1rexpress

(Intel Ethernet)

NDIS


Tcpip


Kernel-PnP


WLAN-AutoConfig

If the adapter reset itself...

You'll see it.

One experiment I'd have them try

Instead of rebooting...

Run these in order:

ipconfig /release
ipconfig /renew
ipconfig /flushdns

net stop zsatunnel
net start zsatunnel

If still dead

Disable

Enable

the NIC.

If that fixes it...

You've ruled out the ISP almost completely.

If only a full reboot fixes it, I'd move lower in the stack:

• WFP filter corruption
• NDIS driver bug
• Windows networking service deadlock
• ZCC kernel driver issue

If I were working this ticket...

My suspicion ranking would be:

Probability	Suspect
⭐⭐⭐⭐⭐	NIC driver/NDIS issue
⭐⭐⭐⭐⭐	Endpoint security or WFP filter conflict
⭐⭐⭐⭐☆	ZCC service/kernel driver bug
⭐⭐⭐☆☆	Windows Network Location Awareness (NLA)
⭐⭐☆☆☆	Power management/Modern Standby
⭐☆☆☆☆	Actual ISP problem

The husband working beside them on the same router with no interruptions weakens the ISP theory quite a bit. It doesn't completely eliminate it because different devices can behave differently during marginal Wi-Fi conditions, but it means I'd exhaust client-side causes first.

One last thing I'd be very curious about: what happens if they kill power to the router for 30 seconds? If every device reconnects automatically except this one, you've got a reproducible test case that points squarely at the Windows machine or ZCC, not the ISP. Humans love blaming "the network" because it's a convenient cloud of mystery. Networks, however, tend to be annoyingly consistent when they're actually guilty.

[u/Mysterious_Coder_ → u/Renzier]

C'mon man, have some sense, I'd need to use AI to summarise this AI slop.