ZIA GRE & IPSec tunnels — choose, build, prove

Hero · site to ZIA

Why tunnels matter

ZIA is not sitting in the branch. To inspect office traffic when Client Connector is not on every device, you forward packets to a Public Service Edge. GRE and IPSec are the classic site-level methods. They are not ZPA app access.

If the tunnel is wrong you get silent bypass (no policy), a green VPN with the wrong Location (wrong policy stack), or SaaS that hangs on large objects (MTU black hole). Location-only policy is one door for everyone on that path. After the site is mapped, authentication still decides who is on the wire.

Mental model — three objects

Memorize three parts before you open the Admin Console. Most “tunnel is up but internet is broken” tickets skip part 2.

1. Edge device — router or firewall that builds GRE (protocol 47) or IPSec (ESP) and steers internet traffic with PBR.
2. ZIA cloud objects — a Static IP plus GRE tunnel, and/or VPN credentials, both bound to a Location. Nothing is live until you Activate.
3. Service Edge path — primary VIP/DC and secondary VIP/DC. Keepalives, IPSLA, RPM, ICMP, or DPD must move traffic when the primary dies.

Path · primary and backup

GRE vs IPSec — how to choose

Encryption need is the clean first fork. Then check whether the transit path allows GRE protocol 47, and whether the edge box can fail over cleanly.

GRE runbook

Primary source: Zscaler Help Configuring GRE Tunnels and Self-Provisioning of GRE Tunnels (Help Portal export, 01 Aug 2026).

Guidelines before CLI

• Two GRE tunnels → two Public Service Edges in different data centers. If the primary path dies, the router must change the routing table so the secondary is used.
• PBR so only internet-bound traffic enters the tunnel. Match source/destination/protocol; action is the tunnel nexthop.
• Enable GRE keepalives on both tunnels. If the platform has no GRE keepalives, use ICMP probes. Cisco: IPSLA. Juniper: RPM.
• Most routers apply PBR before NAT, so ZIA still sees internal client IPs. If NAT runs first, consider disabling it or you lose logging granularity. Use sublocations for internal networks inside the GRE.
• If inbound ACLs exist, allow GRE protocol 47.

Side A — Provision GRE on ZIA

1. Add GRE Tunnel (self-provision)

   Path: Infrastructure → Locations → Static IPs & GRE Tunnel → GRE Tunnels → Add GRE Tunnel. The Add GRE Tunnel Configuration wizard opens.

2. Source IP tab

   Static IP Address: pick one available static IP. One static IP maps to one GRE tunnel config. You cannot change it later on an edit. A static IP already mapped to a Location does not appear in the list. Optional Description.

3. Data Center tab

   Domestic Preference: enable only if you must prefer DCs in the country of the IP origin even when they are farther. Primary Data Center VIP and Secondary Data Center VIP: each list shows the five geographically closest active DCs; one is auto-selected. Help’s rule: the two VIP destinations must not be the same data center. DCs flagged Do Not Provision (DNP) on config.zscaler.com do not appear. If the org uses Private Service Edges, those VIPs list first.

4. Internal IP Range tab

   Is Unnumbered IP: enable only if you do not need an internal address on each side. Otherwise Select Internal GRE IP Range from the default pool of 10 ranges, or search other RFC1918 space. Help’s support-provisioned example assigns a /29 that you split into two /30s: first host = your router, second host = the Service Edge, then repeat on the backup tunnel.

5. Review → Save → Activate

   The Review tab is the last chance to edit. Save is not enough. Activate the change.

Side B — Location object

1. Add Location

   Path in current Help: Infrastructure → Locations → Location Management → Legacy Locations → Add Location (the GRE article also writes Infrastructure → Locations → Legacy Locations). UI may say Legacy Locations.

2. General fields

   Name, Country, optional City/State/Province, Time Zone. Time-based policy uses this timezone — a 08:00–17:00 Cloud App Control rule fires in local hours per Location.

3. Bind the GRE source

   Help labels this list Public IP Addresses on the GRE article and Static IP Addresses and GRE Tunnels on Configuring Locations. Choose the public tunnel-source IP you provisioned. The same static IP is the public source for both GRE tunnels.

4. Save and Activate

   Location binding that is not Activated is the classic “tunnel green, logs show unknown location” ticket.

Side C — Router / firewall

1. Preferred topology

   Help prefers two GRE tunnels from an internal router behind the firewall so ZIA sees internal IPs. Source the GRE from a loopback that holds the public static IP; allow protocol 47 on the firewall. If that is not feasible, GRE from the border router and disable NAT so internal IPs remain visible.

2. Primary and secondary GRE

   Primary: source = your public static IP, destination = Primary Data Center VIP, tunnel IPs = first /30. Secondary: same source, destination = Secondary Data Center VIP, second /30. Enable keepalives (or ICMP / IPSLA / RPM) on both.

3. PBR and NAT order

   Match internet-bound traffic → nexthop through GRE. Track the primary; if it is down, use the secondary. Do not send private WAN into ZIA. Keep PBR before NAT unless you deliberately want one PAT address.

Tunnel source public IP:        _______________
Primary Data Center VIP:        _______________
Secondary Data Center VIP:      _______________
Internal GRE /30 primary:       router ____ / PSE ____
Internal GRE /30 backup:        router ____ / PSE ____
Location Name:                  _______________
Activated?:                     yes / no

Vendor samples on Help: GRE Configuration Example: Cisco 881 ISR, GRE Configuration Example: Juniper SRX.

IPSec runbook

Primary source: Zscaler Help Understanding IPSec VPNs, Configuring an IPSec VPN Tunnel, Adding VPN Credentials.

Side A — VPN credentials and Location

1. Collect peers first

   For each tunnel you need: IP address or hostname of the local gateway, the shared secret, and the IP addresses or hostnames of the Public Service Edges. Plan two VPNs to two different Service Edges.

2. Add VPN Credential

   Path: Infrastructure → Locations → VPN Credentials → Add VPN Credential.

   Choose Authentication Type used to identify the peer: FQDN, IP, or XAUTH. For FQDN, User ID is the FQDN (Help: up to 256 characters). Enter New Pre-Shared Key and optional Comments (CSV import limit is 10,240 characters). For Authentication Type IP, the static IP must already be known to Zscaler — submit it to Support first if it is not. You need the FQDN (or IP) and PSK later when you link the Location and when you build IKE on the edge.

3. Link credentials to a Location

   On Add/Edit Location, use the VPN Credentials control. Without this link the IKE SA can still come up while traffic misses location policy. Save and Activate.

Side B — Edge VPN (generic, then vendor guide)

1. Local ID rule (Help)

   If the VPN credential is an FQDN, the peer’s local ID can be a private IP. Otherwise local ID should be the public IP that was provisioned as the static IP / IP-type credential. Private local ID against a public-IP credential → negotiation fails.

2. IKEv2 Phase 1 / Phase 2

   Match a supported proposal. Help bolds recommended values in the IKEv2 table. Phase 1 authentication is Pre-Shared Key. Phase 2: ESP, Tunnel Mode. SA lifetime context: Phase 1 24 Hours, Phase 2 8 Hours, unlimited lifebytes. Help recommends disabling PFS for Phase 2. AES-GCM needs the matching subscription; without it Help recommends NULL encryption on the child SA.

3. NAT-T and DPD

   NAT-T is integrated in IKEv2 when the initiator is behind NAT. NAT keepalive interval in the table: 20 seconds. Enable DPD. Help recommends a 10–20 second DPD interval with at least 3 retries (the supported-parameter table also lists DPD Timeout Interval 20 seconds and DPD Maximum Retries 5). Zscaler does not treat ongoing data as proof the peer is alive. If the device only supports on-demand DPD, allowlist Zscaler IPs so Zscaler-initiated DPD is not dropped.

4. Selectors, MTU, MSS

   Route-based or policy-based VPN as the platform allows. Steer internet-bound traffic only. Help’s starting values: tunnel MTU 1400 bytes, MSS 1360 bytes (or measure your optimal MTU — see Determining the Optimal MTU for GRE or IPSec Tunnels).

IKE:                          IKEv2
Authentication Type:          FQDN  (or IP if Support already has the static IP)
User ID / FQDN:               _______________
Local ID rule:                FQDN cred → private IP OK | IP cred → that public IP
Primary PSE peer:             _______________
Secondary PSE peer:           _______________
Location Name:                _______________
MTU / MSS start:              1400 / 1360
DPD:                          10–20s, ≥3 retries
Tunnel Insights both peers:   UP?

Prove it is up

A green crypto SA is not the close. You need health on both peers, the correct Location on a test transaction, and a failover you actually ran.

GRE:   tunnel interface up · keepalive / IPSLA / RPM tracking the primary
       ping <Primary Data Center VIP> source <GRE source>
IPSec: IKEv2 SA READY · child SA up · DPD succeeding
Both:  PBR hit counts incrementing on internet traffic only
ZIA:   Tunnel Insights both peers Up · web log Location = site Name

Classic fails

Sources

• Zscaler Help — Configuring GRE Tunnels (dual DC, PBR, keepalives / IPSLA / RPM, protocol 47, Location bind, /29 split, Tunnel Insights)
• Zscaler Help — About GRE Tunnels / Self-Provisioning of GRE Tunnels (Add GRE Tunnel tabs: Static IP Address, Domestic Preference, Primary/Secondary Data Center VIP, Is Unnumbered IP, Select Internal GRE IP Range)
• Zscaler Help — Best Practices for Deploying GRE Tunnels (1 Gbps per GRE tunnel when internal IPs are not behind NAT)
• Zscaler Help — Configuring Locations (Legacy Locations, Static IP Addresses and GRE Tunnels, VPN Credentials)
• Zscaler Help — Understanding IPSec VPNs (IKEv2 table, NULL vs AES-GCM, local ID rule, DPD, NAT-T, MTU 1400 / MSS 1360)
• Zscaler Help — Configuring an IPSec VPN Tunnel (400 Mbps per public source IP, dual peers, IPv6 selectors note)
• Zscaler Help — Adding VPN Credentials (Authentication Type, User ID, New Pre-Shared Key)
• Zscaler Help — About VPN Credentials (FQDN, XAUTH, or IP)
• Zscaler Help — Determining the Optimal MTU for GRE or IPSec Tunnels
• Local Help Portal PDF exports used for evidence: Configuring_GRE_Tunnels.pdf, Understanding_IPSec_VPNs.pdf (01 Aug 2026)

Related: ZIA traffic flow · ZIA forwarding methods · ZIA authentication · Router GRE / IPSec lab simulator