# Troubleshooting desk split, quote, fix

Source: https://ai.techclick.in/blog_zscaler_zia_zpa_troubleshooting_desk
Markdown: https://ai.techclick.in/blog_zscaler_zia_zpa_troubleshooting_desk.md
Publisher: Techclick Infosec Pvt Ltd

Live troubleshooting desk for ZIA and ZPA: split the ticket, three dummy incidents, status codes, ZDX hops, 8 scenario MCQs.

## Three tickets before lunch

 Same dummy company, Apex Freight. Do not disable Zscaler. Split ZIA / ZPA / ZDX, quote one evidence field, then change one thing on a pilot user.

  Hero · three tickets
  Ticket 1 internet, ticket 2 private app, ticket 3 slowness. Different desks.
  Quick answer

 Open with ZCC colour, IdP user, exact URL or FQDN. If it is SaaS, open Web Insights. If it is private, open User Activity Diagnostics. If it is slow, open ZDX and name the hop.

## Split the ticket

  Flow 1 · split the ticket before you touch policy

   ZIA vs ZPA vs ZDX decision

- What is broken? Internet / SaaS or private app? ZIA desk ZPA desk Slow? → ZDX hop Never mix the three in one guess. Outlook web = ZIA. SAP on an internal FQDN = ZPA. “Everything slow” = ZDX hop before any disable. Decision feel Internet = ZIA. Private FQDN = ZPA. Slow = ZDX. Mixing them is how juniors reinstall ZCC for a missing allow rule. ## Live desk — order you speak #### Open “Share ZCC icon colour, logged-in user, and the exact URL or app name.”

- #### Classify outlook.office.com → ZIA. sap.apexfreight.internal → ZPA. “Everything slow since morning” → ZDX first.

- #### Quote evidence One Web Insights row or one Diagnostics status code or one ZDX hop. Then change.

- #### Pilot Fix Priya. Then a change window for the site. Never org-wide on a P1 guess.

## Ticket 1 — ZIA · Outlook spins

 Priya, ZCC green, Teams OK, OWA spins. This is ZIA.

- Analytics → Web Insights → user + outlook.office.com. Empty log? Forwarding / Trusted Network, not URL policy.

- Log exists, action Blocked? Quote the rule (URL vs Firewall vs SSL).

- Cert warning? Inspect CA missing on the laptop — Side A.

- IdP loop? Exempt login.microsoftonline.com from PAC/tunnel hairpin.

  ZIA proof field

 Web Insights: action, policy name, location, SSL inspected yes/no.

## Ticket 2 — ZPA · SAP cannot connect

 Aditya, ZCC green, SAP dead. This is ZPA.

     admin.private.zscaler.com · Analytics → Diagnostics → User Activity

     Training mock · not live

       Analytics / Diagnostics / Log Type: User Activity

### User Activity · priya@apexfreight.in

        Application  sap.apexfreight.internal

          App Connector  (empty)

          Status code  BRK_MT_SETUP_FAIL_NO_POLICY_FOUND

        Connection status  Close

   Empty Connector + Close means ZPA never selected a connector. Status BRK_MT_SETUP_FAIL_NO_POLICY_FOUND means allow policy is missing or the segment/group is disabled. Source: help.zscaler.com session status codes.

- Empty Connector + Close → mapping/policy, not connector ping.

- NO_POLICY_FOUND → add/enable allow, or enable the segment.

- REJECTED_BY_POLICY → a deny matched; do not add a second allow above it without reading order.

- Named connector + fail → connector LAN DNS/port to SAP.

## Ticket 3 — slowness

 Never start with disable. Who / which app / wired or Wi-Fi / one user vs site vs org.

- ZDX: device, Wi-Fi, ISP, Zscaler hop, app hop. Quote the hop.

- ZIA slow after GRE: MTU/MSS.

- ZIA slow on one SaaS after inspect: exemption on the pilot, then a named inspect-exception.

- ZPA slow: connector CPU, path to app, one connector vs group.

  Close the ticket
  Success is before/after ZDX or a new policy-hit row, not “user said better.”

## Unsafe vs safe

   Unsafe  Safe

  Disable ZCC for the company  Collect ZCC support tool from Priya only
  Reinstall ZCC because SAP is down  Read Connector field on Diagnostics
  Org-wide Decrypt off  Pilot exemption + inspect CA check
  New GRE because one user is slow  ZDX hop; if device Wi-Fi, stop

  Close sentence

 What you proved, what you did not change, next window if a change is needed.

  Back to path hub  · Deep:  ZIA command center  ·  ZPA command center

## Knowledge check

   You are on the phone. Pick the first safe move.

      Q1  First sentence on the call?

    Disable ZCC     ZCC colour, IdP user, exact URL or FQDN     New GRE     Reboot the connector
 Correct:  b . Open script from the live desk module.

  Q2  OWA spins, Teams works. Desk?

    ZPA     ZIA Web Insights     Branch Connector rebuild     PRA
 Correct:  b . SaaS = ZIA.

  Q3  Empty Connector + Close?

    Ping SAP     Policy/mapping never selected a connector     Increase Bandwidth Control     Issue a new inspect CA
 Correct:  b . Diagnostics first.

  Q4  NO_POLICY_FOUND?

    Connector upgrade pause     Allow missing or segment disabled     MTU     PAC port 80
 Correct:  b . Documented policy-block code.

  Q5  One user slow, site fine. First?

    New GRE     ZDX device/Wi-Fi hop     Org Decrypt off     Delete Access Policy
 Correct:  b . Do not rebuild the site for one laptop.

  Q6  SAML loop after ZCC?

    Disable SCIM forever     Exempt IdP/ACS from PAC/tunnel hairpin     Wildcard ZPA segment     Sandbox
 Correct:  b . IdP traffic must not hairpin.

  Q7  Unsafe P1 move?

    Pilot exemption for one app     Disable ZCC company-wide to prove it     Quote ZDX hop     Collect ZCC support tool
 Correct:  b . You lose evidence and create a second outage.

  Q8  Close sentence includes?

    Only ‘please try again’     What you proved, what you did not change, next window     New public IP     Always rebuild HA
 Correct:  b . Change-control close.

       Check answers
       Reset

## Sources

- ZIA policy enforcement
- ZPA session status codes
- Connector diagnostics
- Techclick syllabus M12, M18–M20

 Related:  Path hub  ·  ZIA path  ·  ZPA path  ·  ZIA command center  ·  ZPA command center

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt