Green icon ≠ working — Client Connector war-room

1. Why the green icon lies

Operators collapse five client failures into one screenshot. The service is Off. The user is not entitled for ZIA. The forwarding profile action for Off-Trusted is None. The PAC URL is invalid, so enrollment never finished. The IdP is hairpinned through the tunnel, so SAML loops. Those are five first clicks. The tray being green only means the UI process is alive.

This page is the war-room for the agent. Lesson 4 ships the install and the App Profile. The evidence desk proves the cloud after the packet leaves the laptop. Here you prove the five facts on the device before you open URL policy.

Hero · wings are not a tunnel

2. Concept — five client facts

Memorise five named objects before you click. Each is allowed to prove one thing. Over-claiming the tray is how you ship a bad App Profile at 02:00.

3. Path — ticket → first check

Flowchart first. Do not open the App Profile editor until a diamond says so. Do not restart the laptop until Service Status and the two enable flags are written on the ticket.

Path · pick the branch before the restart

4. How to choose — first check + proof field

Print this next to the Client Connector window. If you cannot recite the proof field, you are not ready to edit an App Profile.

5. Do — runbook Side A → B → C

Side A proves the agent on the laptop. Side B proves the two Admin objects that laptop downloaded. Side C proves the wire and packages logs. On a messy Sev-2, do them in this order until a field lights up.

Side A — Device: Service Status, services, Troubleshoot

1. Open Client Connector, not the Admin Portal

   On the failing device, open the app. Official: Using Zscaler Client Connector. Read Service Status. Confirm whether the user (or a remote admin) used Turn Off on Internet & SaaS, Private Access, ZDX, or Endpoint DLP. Help: the app disables those services for a period of time and then re-enables them. A timed Off is not a URL block.

2. Read ZIA and ZPA as two switches

   Internet & SaaS Off explains a dead browser and an off-cloud My IP page. Private Access Off explains a dead private FQDN even when Salesforce works. Dashboard Help also tracks ZIA Service Turn Off and ZPA Service Turn Off counts across enrolled devices — use that if more than one laptop flipped.

3. If the UI is up but the tunnel is not, prove the processes

   Official allowlist: ZSATray is the UI, ZSATunnel handles traffic tunneling, plus ZSAService on Windows. Traffic-forwarding runbook: allowlist ZSATunnel.exe, ZSATray.exe, ZSAService.exe (and ZDPService.exe if Endpoint DLP is in scope). A living tray with a dead ZSATunnel is a process ticket, not a policy ticket.

4. Use the official Troubleshoot section before you reinstall

   Path: More → Troubleshoot. Official actions: Run Zscaler Diagnostics (one-time snapshot of network state), Restart Service, Export Logs (ZIP to your support admin), Start Packet Capture (Help: Enabling Packet Capture — set Run Session For first). Do not start a capture on a production laptop without a duration and a change note.

sc query ZSAService
tasklist | findstr /i "ZSATunnel ZSAService ZSATray"

REM Official allowlist names: ZSATray = UI, ZSATunnel = tunneling, ZSAService = service
REM If ZSATray is up and ZSATunnel is missing, the tray can still look green.

Side B — Admin: App Profile, Forwarding Profile, PAC

1. Confirm which App Profile the device actually has

   Path: Infrastructure → Connectors → Client → Windows (or macOS / Linux / iOS / Android — the OS is the tab). App Profiles. Official fields: Name, Rule Order (ascending numerical order — lowest number wins), Status = Enabled, Forwarding Profile drop-down. A VIP profile at order 4 never matches if Default-Win sits at 1. Source: Configuring Zscaler Client Connector App Profiles.

2. Open the Forwarding Profile that App Profile names

   Path: Infrastructure → Connectors → Client → Forwarding Profile for Platforms → Add Forwarding Profile (or the existing profile). Read the action for the network type the laptop thinks it is on: On-Trusted, Off-Trusted, VPN-Trusted, Split VPN-Trusted. If you use Z-Tunnel 2.0, Help requires a forwarding profile with Z-Tunnel 2.0 selected. Source: Configuring Forwarding Profiles; About Z-Tunnel 1.0 & Z-Tunnel 2.0.

3. Read the PAC URL on that profile

   Error 3016 PAC URL is not Valid = the URL on the forwarding profile is wrong. Error 3017 PAC File is not Valid = the file itself is invalid. A failed PAC download stops Client Connector from authenticating the user — check network connectivity to the PAC host. Source: Zscaler Client Connector Errors.

4. If a third-party VPN is in the picture, stay on this object

   Official error: Client Connector detects an active VPN — check the forwarding profile. Help on App Profiles / PAC: add the VPN gateway hostname or IP to the system PAC so Tunnel with Local Proxy can DIRECT that traffic. Do not start by killing SSL inspection.

Side C — Proof: My IP, auth exemption, Export Logs

1. Prove the browser hit a Public Service Edge

   On the user’s device open https://ip.zscaler.com. Official: Verifying a User’s Traffic is Being Forwarded to the Zscaler Service. If the page says the request did not come from a Zscaler IP, stop. There is no Policy Action to chase. Fix Service Status / entitlement / PAC / forwarding action, then reload.

2. If the ticket is an auth loop, exempt IdP + ACS first

   PAC best practices + App Profile PAC Configuration: IdP and ACS must not be forced through the tunnel. A STRICTENFORCEMENT install whose pre-enroll PAC does not DIRECT the IdP bricks its own SSO path — that is a token / PAC ticket, not a “disable ZCC” ticket. Full Entra gallery / ACS runbook: Lesson 4 and the gold authentication lesson.

3. Package official logs before you escalate

   More → Troubleshoot → Export Logs writes a ZIP for your support admin. Remote path (Help: Configuring User Access to Support Options): Enrolled Devices → Device Details → Fetch Logs. Quote Service Status, Forwarding Profile name, PAC error if any, and the My IP sentence in the same note as the ZIP.

4. Only then open the evidence desk

   On-cloud My IP plus a still-failing SaaS URL is a Web Insights ticket. A private FQDN is User Activity. Slow + Allowed is ZDX. Those tools are the next lesson — they are not the first click when the tray is the question. Evidence desk.

6. Five war-room tickets

These five land every quarter. Memorise first check + proof field. Times and identities below are lab-only.

ZCC-01 — Green icon, service Off

02:12 · P2. Priya on a hotel network. Slack photo of a green tray. Salesforce spins. L1 already drafted a URL Allow for salesforce.com.

First check: on her Client Connector, Service Status. Official: Using Zscaler Client Connector — the user can disable Internet & SaaS (and Private Access, ZDX, Endpoint DLP) for a period.

If ZIA is Off: quote that line. Turn it back on (or wait for the timed re-enable). Reload ip.zscaler.com. There is no Blocked Policy Name yet.

If ZIA is On and ZIA Enabled is False: entitlement — the user is not entitled for Internet & SaaS in Client Connector. That is an App Profile / service-assignment ticket, not a Salesforce Allow.

ZCC-02 — Auth loop after enroll

02:25 · P2. New hire enrolls. Browser bounces login.microsoftonline.com → Zscaler ACS → IdP again. L1 wants Client Connector uninstalled “so they can get in.”

First check: PAC on the Forwarding Profile the pre-enroll POLICYTOKEN / App Profile is using. Confirm the IdP and the ACS are not forced through the tunnel.

Proof field: a PAC DIRECT (or equivalent bypass) for the IdP and ACS. If the PAC failed to download, you will see the official PAC-download error — authentication cannot start until that file loads. Error 3016 / 3017 live on the same object.

ZCC-03 — 3016 / 3017 PAC

02:40 · P2. Overnight someone edited the PAC host. Half the WFH fleet cannot authenticate. The tray still looks installed.

First check: Infrastructure → Connectors → Client → Forwarding Profile for Platforms → the PAC URL on the profile those devices use.

Proof field: 3016 PAC URL is not Valid if the URL is wrong; 3017 PAC File is not Valid if the file is invalid. Help: a failed PAC download stops Client Connector from authenticating the user. Fix the URL or the file, confirm the device can reach it, then re-auth one pilot — not a tenant-wide Force re-auth.

ZCC-04 — Active VPN detected

02:55 · P2. Contractor connects corporate GlobalProtect, then Client Connector reports ZIA is down. L1 wants SSL inspection disabled.

First check: Zscaler Client Connector Errors — this class of error occurs if Client Connector detects an active VPN. Check the forwarding profile. Read VPN-Trusted (and Split VPN-Trusted) actions. Add the VPN gateway hostname / IP to the system PAC if you are on Tunnel with Local Proxy (official PAC best practices).

Proof field: the official active-VPN wording plus the VPN-Trusted action you intended. A None action on VPN-Trusted is a design choice — quote it; do not “fix” it with SSL.

ZCC-05 — Connected agent, off-cloud browser

03:10 · P2. Service Status looks healthy. Internet works. ip.zscaler.com says the request did not come from a Zscaler IP. Someone typed “Zscaler is down” in the channel.

First check: which trusted-network type did the laptop detect, and what is the Forwarding Profile action for that type? A hotel laptop that matches On-Trusted (fragile DNS / DNS suffix criteria) will take the On-Trusted action — often None — and go DIRECT. Tunnel with Local Proxy plus a missing system proxy does the same for browser traffic.

Proof field: the official off-cloud sentence on My IP, plus the network type + action pair. Then fix detection or the Off-Trusted action (Tunnel / Z-Tunnel 2.0 is the usual WFH intent). Reload My IP on the same browser.

7. Traps + close-the-ticket proof

Proof · named field, then Closed

Sources

• Zscaler Help — Using Zscaler Client Connector (Service Status; disable Internet & SaaS, Private Access, ZDX, Endpoint DLP)
• Zscaler Help — Troubleshooting Zscaler Client Connector (More → Troubleshoot: Export Logs, Restart Service, Run Zscaler Diagnostics)
• Zscaler Help — Using Zscaler Diagnostics
• Zscaler Help — Enabling Packet Capture for Zscaler Client Connector (More → Troubleshoot → Start Packet Capture)
• Zscaler Help — Zscaler Client Connector Errors (PAC download fails auth; active VPN → check forwarding profile; 3016 PAC URL; 3017 PAC file)
• Zscaler Help — Zscaler Client Connector: Connection Status Errors
• Zscaler Help — Configuring Forwarding Profiles for Zscaler Client Connector (Infrastructure → Connectors → Client → Forwarding Profile for Platforms)
• Zscaler Help — About Forwarding Profiles
• Zscaler Help — Configuring Zscaler Client Connector App Profiles (Rule Order, Status, Forwarding Profile, PAC Configuration)
• Zscaler Help — Best Practices for Using PAC Files with Zscaler Client Connector
• Zscaler Help — About Z-Tunnel 1.0 & Z-Tunnel 2.0
• Zscaler Help — Zscaler Client Connector Processes to Allowlist (ZSATray, ZSATunnel, ZSAService)
• Zscaler Help — Understanding the Zscaler Client Connector Dashboard (ZIA Service Turn Off / ZPA Service Turn Off)
• Zscaler Help — Viewing Device Fingerprint Information (ZIA Enabled, ZPA Enabled)
• Zscaler Help — Interacting with Zscaler Client Connector Remotely (view service status; enable / disable ZIA and ZPA)
• Zscaler Help — Configuring User Access to Support Options (Enrolled Devices → Fetch Logs)
• Zscaler Help — Client Connector Traffic Forwarding Support Troubleshooting Runbook
• Zscaler Help — Verifying a User’s Traffic is Being Forwarded to the Zscaler Service (ip.zscaler.com)

Related: Batch 11 · Lesson 4 — Authentication and ZCC deploy · Gold · Zscaler Authentication (Entra SAML + SCIM) · ZCC App & Forwarding Profiles · Evidence desk — first tool + proof field · Lesson 3 — traffic forwarding · 16 ZCC scenarios