ZIA traffic forwarding — five ways in

Hero · on-ramp to the Service Edge

1. Why forwarding is the ticket

URL Filtering, SSL inspection, and DLP cannot see a request that never arrived. Most “Zscaler is broken” incidents in the first 90 days of a rollout are forwarding incidents wearing a policy costume.

Zscaler’s own guidance is a combination, not a single method: tunnels for sites, Client Connector for laptops, PAC files where you need explicit browser control, and proxy chaining where an existing forward proxy already owns the path. Cloud Connector exists for cloud workloads — it is not one of the five user-path methods in this lesson.

Three words that close the ticket: method (how the packet is steered), Location (how ZIA names the source), proof (My IP Address page + logs).

2. Mental model — three parts only

Pre-train these before you open the Admin Portal.

1. Forwarding method — ZCC, PAC, GRE, IPSec, or explicit proxy. This is transport. It does not write URL policy.
2. Location object — the named site ZIA attaches to the session. Fields you will actually click: Name, Country, Time Zone, Static IP Addresses, VPN Credentials, Proxy Ports, and under Gateway Options: Use XFF from Client Request, Enable IP Surrogate, Enforce Surrogate IP for Known Browsers.
3. Public Service Edge (PSE) — where inspection and Nanolog happen. Failover is primary + secondary (tunnels / PAC return list) or nearest-edge (ZCC).

3. Decision flow — pick the method first

Feel · Path A office vs Path B roam

Read the diagram first, then the table. Do not start in Hosted PAC Files because “everyone has a browser.”

4. Choose-when — all five methods

Zscaler Help Choosing Traffic Forwarding Methods and Best Practices for Traffic Forwarding treat these as complementary. Government clouds are stricter: PAC or explicit proxy sent directly to Zscaler is not supported there — those tenants send PAC/explicit traffic through GRE or IPSec.

5. Mini runbook — PAC + ZCC (tunnels live next door)

GRE and IPSec get their own click-path, VIP math, and Tunnel Insights proof in ZIA GRE & IPSec tunnels. Do not paste a GRE wizard into this page and call the job done. Here you ship the two methods L2 actually configures in week one of a laptop-first rollout.

Side A — Hosted PAC (ZIA Admin)

Primary source: Zscaler Help About Hosted PAC Files / Writing a PAC File.

1. Open Hosted PAC Files

   Path: Administration → Hosted PAC Files. The cloud already hosts four defaults: recommended.pac, proxy.pac, mobile_proxy.pac, kerberos.pac. Copy a default, do not edit it in place.

2. Add a versioned custom PAC

   Add PAC File → name it for the pilot (example: pune-pilot-v2). Use a new filename or ?v= on the URL so browsers do not keep yesterday’s file. Run Validate in that same window before Save — a missing semicolon returns DIRECT for everything.

3. Write the return list

   Official shape uses the ${GATEWAY} and ${SECONDARY_GATEWAY} variables. Common ports in Help examples: 80, 443, 9400, 9443. Put RFC1918, Zscaler PAC host, and IdP/ACS hosts on DIRECT first — that is how you prevent a PAC loop and a SAML hairpin.

4. Activate, then publish the HTTPS PAC URL

   Save + Activate. Hand the hosted HTTPS URL to GPO/MDM or to the ZCC App Profile Custom PAC URL field (512-character max; HTTPS required if Enforce Secure PAC URLs is on).

function FindProxyForURL(url, host) {
  var lan = /^(10|127|192\.168|172\.(1[6-9]|2[0-9]|3[01]))\./;
  if (isPlainHostName(host) || shExpMatch(host, "*.corp.example") ||
      dnsDomainIs(host, ".zscaler.net") || dnsDomainIs(host, ".zscalerthree.net") ||
      dnsDomainIs(host, "login.microsoftonline.com") ||
      dnsDomainIs(host, "login.windows.net"))
    return "DIRECT";
  if (lan.test(host)) return "DIRECT";
  return "PROXY ${GATEWAY}:80; PROXY ${SECONDARY_GATEWAY}:80; DIRECT";
}

Side B — ZCC Forwarding Profile + App Profile

Primary source: Zscaler Help Configuring Forwarding Profiles for Zscaler Client Connector / Configuring Zscaler Client Connector App Profiles.

1. Add Forwarding Profile

   Path (Experience Center): Infrastructure → Connectors → Client → Forwarding Profile for Platforms → Add Forwarding Profile. Older Client Connector Portal label: Administration → Forwarding Profile.

2. Map each network state to a mode

   States you will see: On Trusted Network, Off Trusted Network, VPN Trusted Network, Split VPN Trusted Network. Modes: Tunnel, Tunnel with Local Proxy, Enforce Proxy, None.

   Laptop-first default that does not double-tunnel a GRE site: Off Trusted = Tunnel (Z-Tunnel 2.0). On Trusted = None so the branch GRE/IPSec owns the LAN.

3. Trusted Network Detection must fail at home

   Use a hostname that exists only on internal DNS (or a gateway-IP test). If portal.company.com resolves on the public internet, TND passes at home, ZCC stays None, and the laptop is naked.

4. App Profile PAC + Z-Tunnel 2.0

   App Profile holds Custom PAC URL and ZIA enablement. In Tunnel mode, the Forwarding Profile PAC is for bypass / ${ZAPP_TUNNEL2_BYPASS} — do not use it to aim traffic at the Zscaler cloud. The App Profile PAC is what returns PROXY ${GATEWAY}:443.

Side C — Location object (the bind everyone skips)

Primary source: Zscaler Help Configuring Locations / Configuring Dedicated Proxy Ports / Configuring Proxy Chaining.

Path: Infrastructure → Locations → Legacy Locations → Add Location (UI may say Location Management). A method without this bind still reaches a PSE — it just lands in the wrong policy stack.

• GRE site — attach Static IP Addresses (the tunnel source).
• IPSec site — attach VPN Credentials created under Infrastructure → Locations → VPN Credentials.
• Explicit / dedicated port — under Addressing choose Proxy Ports. For chaining, enable Use XFF from Client Request so sublocations see the real client, not the upstream proxy.
• Gateway Options you will actually toggle in a pilot: Enable IP Surrogate, Enforce Surrogate IP for Known Browsers, authentication required for unknown users.
• Save + Activate. Then open https://ip.zscaler.com from that site.

6. Runtime path — after go-live

Once forwarding is live, every request is the same four stations. The method only changes station 1.

7. Traps + how to prove traffic hits ZIA

Proof · close the ticket with a named field

Three production failures show up in every Batch 11 lab. Learn the evidence, not the folklore.

Sources

• Zscaler Help — Choosing Traffic Forwarding Methods
• Zscaler Help — Best Practices for Traffic Forwarding
• Zscaler Help — About Hosted PAC Files · Writing a PAC File · Forwarding Traffic Based on User’s Location Using PAC Files
• Zscaler Help — Configuring Forwarding Profiles for Zscaler Client Connector · Configuring Zscaler Client Connector App Profiles · Best Practices for Using PAC Files with Zscaler Client Connector
• Zscaler Help — Configuring Locations · Configuring Dedicated Proxy Ports · Configuring Proxy Chaining
• Zscaler Help — Understanding Proxy Mode · Verifying a User’s Traffic is Being Forwarded to the Zscaler Service

Related: ZIA GRE & IPSec tunnels · Zscaler authentication · ZIA architecture · ZIA traffic flow · ZCC App & Forwarding Profiles · Batch 11 · Lesson 4 — auth deployment