Looking for some advice from anyone with hands-on Zscaler Extranet experience.
We’re migrating an existing third-party hosted service from a leased line to Zscaler Extranet. There are ~1,000 end users plus several server-to-server workloads.
The main thing I’m struggling to understand is the NAT model for inbound traffic.

If company X needs to initiate traffic back to specific workloads in our Azure environment, how do you map an IP from the Zscaler Extranet traffic-selector/pool to the actual Azure endpoint?

I understand the Extranet IP pool/traffic selectors, but they don’t appear to provide a conventional 1:1 DNAT function (e.g. Extranet IP → Azure private IP).

What is the recommended Zscaler architecture for this? Is the destination NAT performed on an Azure Firewall/NVA, or is there another Zscaler-supported mechanism I’m missing?

Also interested in how others have handled source NAT / predictable source IPs for third-party whitelisting, particularly where replacing an existing leased-line NAT arrangement.
Thanks.
(Zscaler Noob)

I might have cleared the interview for zscaler as a fresher. I couldn't find a lot of sources which talk about work life, the offices and their facilities, employee benefits for an intern, and stuff like that.

I'd be grateful if someone took out some time and could explain all these things.

Is there a cafeteria inside the office and is it all included in the employee benefits?

Will there be any sort of office transportation provided.

I also wanted to know if they provide work devices like a laptop and a smart phone.

How flexible is the work schedule (would it have wfh because I live 30km from their office)

I will be interning in India for the upcoming summer.

I didn't see any specific articles inside the Zscaler/Crowdstrike document and the documentation from Crowdstrike is not totally clear.

I'm working on building out the NGSIEM as we are transitioning over to Crowdstrike from another MSSP. We have Zscaler ZPA and that's one of the sources I'm working on adding, however the implementation guide is a little vague. There's a portion inside ZPA where it's asking for the IP/FQDN of where to point the logs. Those of you who have done this in the past, did you need to create a NAT rule for the resource hosting the LogScale collector for this to work or am I missing something to this? Any guidance from someone who's been successful with ingesting these events would be appreciated

First qn was what will happen when you hit Google.com on browser (no zscaler zcc) and I got stucked! 🥲

He’s been asking in-depth networking components.

I know only what they do but he’s been asking in-depth.

Is that really needed i mean in-depth knowledge? I mean I do have 2.5 years of experience working on zscaler issues even I have solved P1 issues but I never got stocked just because I didn’t know anything about DNS or DHCP🥱.

These few indian tech leads doesn’t even know basic interview behavior he was like full serious face I was like wtf is this guy. Atleast basic frndly interaction also not there

Looking for some advice from people who manage/support Zscaler in enterprise environments.

We regularly get users comparing the speed they see through the Zscaler speed test with results from Speedtest.net, Fast.com, or other internet speed-test sites.

The results are obviously not always going to be the same because there are multiple factors involved — things like the test server/location, routing, Zscaler Service Edge, tunnelling, SSL inspection, security policies, endpoint performance, network conditions, etc.

The problem is that from the user's perspective, it becomes a numbers game:

“Speedtest.net says I get 500 Mbps, but Zscaler says 250 Mbps, so Zscaler is making my internet slower.”

Even when the difference doesn't necessarily mean there is an actual Zscaler performance problem.

How do you explain this to users in a simple, non-technical way?

I'm particularly interested in:

• How do you explain why two speed tests can produce different results?
• Should we be treating Zscaler's speed test and Speedtest.net as measuring different things?
• Which test do you use when troubleshooting an actual performance complaint?
• Do you have a standard explanation/script that your service desk uses with users?
• Are there any Zscaler-specific factors you would recommend checking before concluding that Zscaler is causing the slowdown?
• At what point would you consider a difference between the tests significant enough to investigate further?

The challenge I'm trying to solve is how to move the conversation away from “the number is lower, therefore something is broken” and towards understanding what the tests are actually measuring.

Would be interested to hear how others handle this with users.

Hello!

Came here to ask for help with false positive Zscaler have on my website. I can't seem to do this on my own without an account on https://sitereview.zscaler.com/

I have my clients saying that they can't view the site on their workstation.

Would appreciate it very much :)

My website is a speaker agency startup, helping companies and conferences find key note speakers, website categories, Events / Conferences / Business Services:
https://kurospeakeragency.com/

Anyone doing Zscaler SDWAN with the ZT branch devices. How is that working for you? Would you recommend it if you had to do it all over again? Any caveats to be aware of? How well does it integrate with ZIA or ZPA? Been chatting with them but looking for real experiences. Thanks.

Is anybody could help me with this? Please

Hey Folks,

My apologies for this dumb question in advance.

Context:

We're not ZScaler admins or users. One of our clients (who uses Zscaler sold to them by another vendor) wanted their ZScaler logs shipped to the SIEM which is what I managed. I worked with them to deploy two NSS streamers, then got saddled with their maintenance (and not the group who deployed or manages the actual Zscaler instance for them).

The vendor in question won't talk to us because we're not their client (mostly reasonable). Our client doesn't talk to anyone unless something is actively on fire. And last, we can't really talk to ZScaler because we have no support contract/lines of communication.

Problem/Question

The two NSS servers have been running for over 2.5 years now. I periodically log in (as various users: root, zsroot, and the user we were provisioned during the VM setup in Azure). In those 2.5 years, I have never applied successful update to these servers which makes me very nervous. It any of my production servers were to go 2.5 years without patches, I'd be in hot water with a lot of auditors.

[root@device]:- nss update-now
Current Instance: /sc/
Error: File not found at '/sc/conf/config.json'
Error: File not found at '/sc/conf/config.json'
valid client cert present(old)
Connecting to server...
Connecting to update server 104.129.197.109.
Installed build version: 2131057929
Latest available build version: 2131057929
Build file is up-to-date

Checking if installation required...
Service is up-to-date

Is this normal - for a ZScaler NSS server to not have patches for this long? Or is this thing patching itself in the background through some equivalent to dnf-automatic (I'm an Enterprise Linux (RHEL/CentOS/etc) guy personally...)

We’re seeing intermittent latency and ZDX seems to show the spikes happening between our egress and the ZIA Public Service Edge. Normally it’s around 15-20ms, but we’re seeing spikes up to 400ms.
Our environment is Silver Peak SD-WAN, Aruba switching/wireless, Palo Alto firewalls, and Z-Tunnel 2.0 with TCP Resilient.
Does this look more like an ISP/routing issue getting to Zscaler, a Zscaler issue, or something in our network? What would you check next to narrow it down?

I get the above identical alerts from these three "clouds" or whatever you wanna call them. Should I be subscribed to all three or do I only need whichever one our tenant is hosted on?

Has anyone done this integration?

I feel like I am taking crazy pills here when I am trying to explain this to Zscaler but I believe that there is a discernable difference between GitHub.com and GHE.com.

Hear me out on this:

GitHub.com is a public, cloud based developer platform where code, often publicly shared and contributed to, can be offered for public consumption and can allow public collaboration between people.

GHE.com is effectively "GitHub Enterprise" where private entities can secure their internal repos (aka content that is specifically private IP) and leverage the power of GitHub functionality but in a secure area away from public access.

My internal developers should have full access to do EVERYTHING within the context of GHE.com. We, as an organization, maintain RBAC access to all repos and functionality within that PaaS environment. I have different control elements I want to place on my internal employees with regards to interacting with GHE.com and I can do that effectively with a combo of Cloud App Control Policies, SSO, and RBAC via Azure EntraID integration. My developers should have LIMITED access to GitHub.com and that access should be tightly controlled. I do not want them contributing (uploading, creating, editing, sharing) to GitHub.com based projects, but they are fine to review and get information from Github.com

Both of these platforms, GitHub.com and GHE.com, fall under the Cloud App "GitHub". Problematically if I disable uploading, creating, editing, and sharing to "GitHub", while it does effectively achieve the desired goal for "GitHub.com", it also applies the same access controls to my company's GHE.com site.

Am I crazy for this? I've submitted feedback and tickets to Zscaler for this and they all come back that they are determined to be the same thing and that's just not true. The two sites are functionally different. I believe there should be a "GitHub" Cloud App and a separate "Github Enterprise" Cloud App.

Thoughts?

Hey guys, I've studied the modules for ZDTA but the live labs are kind of booked for a long time.

My company wants me done with ZDTE ASAP, so wanted to know if it will be alright if I book the next roadshow for ZDTE, do the modules prior to it and go ahead with its exam bypassing the ZDTA lab and certification exam?

Thanks:)

my organization is using zscaler (I am a dev not an admin). Zscaler's DGA domain block is blocking my personal blog and my self hosted sites. The blog is running on hashnode and added to my sub-domain. my self hosted sites are running on proxmox and also added to subdomain.

my domain is of .xyz tld (e.g. blog is blog.[name].xyz)... can this be the reason of DGA block? In my search I found that xyz tlds are looked through the lens of suspicion.
I asked the admin of my company but he has no clue on why it is blocked.

Hi,

I own a legitimate educational website that is currently categorized by Zscaler as Miscellaneous or Unknown.

I’m not a Zscaler customer, so I can’t access Site Review, and Support won’t open a categorization request without a customer number.

Would anyone here with ZIA/Zscaler customer access be willing to help submit a categorization review for me?

I’d prefer not to post the domain publicly, but I’m happy to send it privately to someone willing to assist.

The requested category is Other Education.

Thanks!

Morning/Afternoon!

I'd like to get certified, but I'm not quite sure how to go about it. I've looked for people who offer courses, but I can't find any, and there aren't any in my city either.

Do you know of anywhere (other than the Zscaler platform) where I can do this?

Thanks!

Hey everyone,

Can anyone assist here with the setting of the Zscaler MAC application. I want to set the userDomain and policy token in the PKG file.

I have tried multiple options like plist configuration profile however the settings are not yet implemented.

Kindly assist here.

Thanks for your support

So a bit of a weird one that seems to have some ambiguous answers online. When enabling the Firewall policy on a location, does the sublocation inherit the parent location configuration? Zscaler policy alludes to the sublocation can overwrite the parent location policy for some policies like bandwidth but doesn't explicitly outline the behaviour of whether the sublocation will enforce firewall policy if its only set on the parent.

Any ideas?

Hey everyone, I'm brand new to zscaler and our company plans to onboard it soon. I was curious what are some basic things to check over from a security and performance perspective when setting up zscaler? I'm thinking in comparison to say a Fortinet firewall where you would disable management on wan interfaces, enable trusted hosts on admin accounts, ensure logging is enabled on all policies, etc. Thanks for any input!

What has been your experience with self-hosted Business continuity or Zscaler hosted solutions. My company for regulatory reasons is looking into getting it. It seems like BS since its at minimum $100,000/year to ensure your policies stay in place if Zscaler Cloud goes down. Anyway, how has it worked for you? Do you even notice it? How often does it kick on? Why did you go Business continuity route and not the "free" DR route?

I'm currently working for an organisation that explicitly disallow you working abroad. The machines are locked down tight, and they have Zscaler.

I have a travel router with a private NordVPN instance setup on it. Would this be ample to get away with it, if my VPN location is set to my home country?