T Techclick ← All lessons
Zscaler · ZIA + ZPA · Interactive lesson

Troubleshooting desk split, quote, fix

Three Apex Freight tickets. You stay on the call. You do not disable Zscaler. You quote Web Insights, Diagnostics, or a ZDX hop.

20 min read · L2 primary · Quiz at end

⚡ Quick Answer

Live troubleshooting desk for ZIA and ZPA: split the ticket, three dummy incidents, status codes, ZDX hops, 8 scenario MCQs.

After this page you can

Three tickets before lunch

Same dummy company, Apex Freight. Do not disable Zscaler. Split ZIA / ZPA / ZDX, quote one evidence field, then change one thing on a pilot user.

Hero · three tickets
Three incident cards on an operations desk
Ticket 1 internet, ticket 2 private app, ticket 3 slowness. Different desks.
Quick answer

Open with ZCC colour, IdP user, exact URL or FQDN. If it is SaaS, open Web Insights. If it is private, open User Activity Diagnostics. If it is slow, open ZDX and name the hop.

Split the ticket

Flow 1 · split the ticket before you touch policy
What is broken? Internet / SaaS or private app? ZIA desk ZPA desk Slow? → ZDX hop

Never mix the three in one guess. Outlook web = ZIA. SAP on an internal FQDN = ZPA. “Everything slow” = ZDX hop before any disable.

Decision feel
One diamond three paths
Internet = ZIA. Private FQDN = ZPA. Slow = ZDX. Mixing them is how juniors reinstall ZCC for a missing allow rule.

Live desk — order you speak

  1. Open

    “Share ZCC icon colour, logged-in user, and the exact URL or app name.”

  2. Classify

    outlook.office.com → ZIA. sap.apexfreight.internal → ZPA. “Everything slow since morning” → ZDX first.

  3. Quote evidence

    One Web Insights row or one Diagnostics status code or one ZDX hop. Then change.

  4. Pilot

    Fix Priya. Then a change window for the site. Never org-wide on a P1 guess.

Ticket 1 — ZIA · Outlook spins

Priya, ZCC green, Teams OK, OWA spins. This is ZIA.

  1. Analytics → Web Insights → user + outlook.office.com. Empty log? Forwarding / Trusted Network, not URL policy.
  2. Log exists, action Blocked? Quote the rule (URL vs Firewall vs SSL).
  3. Cert warning? Inspect CA missing on the laptop — Side A.
  4. IdP loop? Exempt login.microsoftonline.com from PAC/tunnel hairpin.
ZIA proof field

Web Insights: action, policy name, location, SSL inspected yes/no.

Ticket 2 — ZPA · SAP cannot connect

Aditya, ZCC green, SAP dead. This is ZPA.

admin.private.zscaler.com · Analytics → Diagnostics → User Activity
Training mock · not live

Analytics / Diagnostics / Log Type: User Activity

User Activity · priya@apexfreight.in

sap.apexfreight.internal
(empty)
BRK_MT_SETUP_FAIL_NO_POLICY_FOUND
Close

Empty Connector + Close means ZPA never selected a connector. Status BRK_MT_SETUP_FAIL_NO_POLICY_FOUND means allow policy is missing or the segment/group is disabled. Source: help.zscaler.com session status codes.

  1. Empty Connector + Close → mapping/policy, not connector ping.
  2. NO_POLICY_FOUND → add/enable allow, or enable the segment.
  3. REJECTED_BY_POLICY → a deny matched; do not add a second allow above it without reading order.
  4. Named connector + fail → connector LAN DNS/port to SAP.

Ticket 3 — slowness

Never start with disable. Who / which app / wired or Wi-Fi / one user vs site vs org.

Close the ticket
Operator proof on screen
Success is before/after ZDX or a new policy-hit row, not “user said better.”

Unsafe vs safe

UnsafeSafe
Disable ZCC for the companyCollect ZCC support tool from Priya only
Reinstall ZCC because SAP is downRead Connector field on Diagnostics
Org-wide Decrypt offPilot exemption + inspect CA check
New GRE because one user is slowZDX hop; if device Wi-Fi, stop
Close sentence

What you proved, what you did not change, next window if a change is needed.

Back to path hub · Deep: ZIA command center · ZPA command center

Knowledge check

You are on the phone. Pick the first safe move.

Q1

First sentence on the call?

Correct: b. Open script from the live desk module.
Q2

OWA spins, Teams works. Desk?

Correct: b. SaaS = ZIA.
Q3

Empty Connector + Close?

Correct: b. Diagnostics first.
Q4

NO_POLICY_FOUND?

Correct: b. Documented policy-block code.
Q5

One user slow, site fine. First?

Correct: b. Do not rebuild the site for one laptop.
Q6

SAML loop after ZCC?

Correct: b. IdP traffic must not hairpin.
Q7

Unsafe P1 move?

Correct: b. You lose evidence and create a second outage.
Q8

Close sentence includes?

Correct: b. Change-control close.

Sources

Related: Path hub · ZIA path · ZPA path · ZIA command center · ZPA command center