T Techclick ← All lessons
Zscaler · ZIA · Interactive lesson

ZIA operator path forward, inspect, prove

Dummy: Priya at Apex Freight. You will choose GRE vs PAC vs ZCC, place an SSL inspect pilot, and quote Web Insights — not the ZCC icon.

22 min read · L2 primary · Quiz at end

⚡ Quick Answer

Complete ZIA operator path: forwarding, identity, firewall-then-web policy, SSL inspect, ATP/DLP, Web Insights proof, 8 scenario MCQs.

After this page you can

The ticket

Priya at Apex Freight: “Outlook on the web spins. Teams is fine. ZCC is green.” That is a ZIA ticket, not a ZPA ticket. ZCC green only means the client is alive.

Hero · ZIA internet path
Laptop reaching internet through ZIA
User → forwarding (ZCC or GRE/PAC) → ZIA Public Service Edge → policy → internet/SaaS.
Quick answer

ZIA is the internet and SaaS path. Traffic must hit a Public Service Edge, then firewall, then SSL, then web engines. If it never arrives, policy will not save you.

Mental model — three parts

  1. Forwarding — how packets reach ZIA (GRE, IPSec, PAC, ZCC).
  2. Identity — who is on the wire (SAML/SCIM, location, surrogate IP).
  3. Policy stack — firewall first, then SSL inspect, then ATP / URL / cloud app / DLP.
Flow 1 · ZIA packet path
User + ZCC or GRE/PAC Public SE known location? Policy stack FW → SSL → ATP URL / Cloud App DLP → allow/block Internet / SaaS

Firewall module first, then web module. If firewall blocks, URL policy never runs. Source: ZIA Policy Leading Practices — Order of Operations.

Hard words: Public Service Edge (PSE) is the ZIA enforcement node. Known location is a source IP you configured under Administration → Location Management. Surrogate IP maps an internal IP to a user after auth — it needs no NAT in front of the tunnel.

How to choose forwarding

Forwarding feel
Branch tunnels into the ZIA cloud
Zscaler recommends GRE as the site method when the router supports it. IPSec when GRE is not possible. PAC and ZCC cover users and roamers. Mix them; do not pick one for the whole company.
MethodUse whenTrap
GRE (primary + backup PSE)HQ/branch router, static public IPMTU/MSS; NAT hiding internal IPs
IPSecNo GRE, or SD-WAN mandatePhase-1/2 mismatch; extra subscription in some designs
PACBrowser explicit proxy, known vs remote portUsers disable PAC; remote users hit 9443 and always inspect
ZCC (Z-Tunnel 1.0 / 2.0)Roaming and laptopsTrusted Network true → traffic skips ZIA

Source: Choosing Traffic Forwarding Methods and ZIA traffic-forwarding reference architecture (GRE recommended).

Runbook — Side A / B / C

Side A · edge (router or ZCC)

  1. Site

    Build two GRE tunnels to two ZIA PSEs. Keep internal IPs visible (no PAT in front). Clamp MSS if users report slowness after cutover.

  2. Roamer

    Install ZCC (Intune/GPO). Confirm enrol user, tunnel up, forwarding profile. Do not declare success on icon colour alone.

Side B · ZIA Admin

  1. Location

    Administration → Location Management. Map the public IP. Enable authentication if you need user policy.

  2. SSL pilot

    Policy → SSL Inspection → Add SSL Inspection Rule. Decrypt only grp-ssl-pilot first. Distribute Zscaler root CA with Intune.

  3. URL / Cloud App

    Policy → URL Filtering and Cloud App Control. Remember: firewall can still block a URL you allowed.

admin.zscaler.net · Policy → SSL Inspection → Add SSL Inspection Rule
Training mock · not live

Policy / SSL Inspection / Add SSL Inspection Rule

Add SSL Inspection Rule

2
Pilot-Inspect-Users
HQ-Pune · Bangalore-Branch
grp-ssl-pilot
Decrypt

Official path: Policy → SSL Inspection. Rules evaluate in ascending order. Pilot a group before org-wide Decrypt. Source: help.zscaler.com configuring SSL Inspection policy.

Side C · prove

  1. Web Insights

    Analytics → Web Insights. Filter user Priya + URL outlook.office.com. Quote action, rule name, location.

  2. SSL

    If the browser shows a name-mismatch or unknown CA, the client does not trust the inspect CA — that is Side A, not a URL block.

Runtime path after go-live

Runtime feel
Request, inspect, policy, access
SSL traffic: CONNECT/SNI first, then decrypt if the inspect rule hits. Source: Understanding Policy Enforcement.
Inspect feel
TLS inspection at the proxy
Pinned apps and banking categories usually stay exempt. Pilot an exemption; do not disable inspect for the org on a P1.

Traps and proof

SymptomFirst checkDo not
No ZIA logs, ZCC greenTrusted Network, PAC, forwarding profileAdd a block rule “to test”
Cert warning on one appInspect CA on the device, exemption listOrg-wide Disable Decrypt
URL allow, still blockedFirewall Control / DNS Control hitKeep editing URL only
Whole branch slow after GREMTU 1400/1476, DF bit, MSS clamp“Disable Zscaler”
Pilot checklist
Unsafe path

Disabling ZCC for the company to “prove it is Zscaler.” You lose the only evidence channel.

Next: troubleshooting desk → · Or start ZPA path →

Knowledge check

Eight field tickets. Pick the first safe move.

Q1

Zscaler’s recommended site tunnel when the router supports it?

Correct: b. Reference architecture: GRE when possible; two tunnels to two DCs.
Q2

Web module never runs if…

Correct: b. Order of operations: firewall then web.
Q3

Remote PAC users typically hit which PSE port for inspect?

Correct: b. Known location often 80; remote 9443 always inspects.
Q4

SSL inspect rule path?

Correct: b. Documented ZIA admin path.
Q5

Priya cert warning after Decrypt. First?

Correct: b. Trust the inspect CA before touching policy.
Q6

No ZIA logs, ZCC green. First suspect?

Correct: b. Traffic never arrived at ZIA.
Q7

URL allow, still blocked. Next policy to open?

Correct: b. FW can block what URL allowed.
Q8

Whole branch slow the morning GRE went live. First?

Correct: b. Classic GRE MTU ticket.

Sources

Related: Path hub · GRE/IPSec deep · Entra SAML · Troubleshooting desk