# ZPA app segments — name the app, list the ports Source: https://ai.techclick.in/blog_zscaler_zpa_app_segments Markdown: https://ai.techclick.in/blog_zscaler_zpa_app_segments.md Publisher: Techclick Infosec Pvt Ltd FQDN plus ports, discovery wildcards, health reporting limits, port 53 exclusion. Scored quiz. ## The ticket Aditya: “SAP GUI opens. Our custom TMS on tms.apex.internal:8443 times out. ZCC is green.” ZCC green only means the client is alive. The Application Segment probably never listed TCP 8443. Hero · named private apps A segment is not ‘the VLAN’. It is the FQDN or IP plus the TCP/UDP ports ZPA is allowed to broker. Quick answer Define the app (FQDN/IP + ports), put it in a Segment Group, map App Connector Groups, then Access Policy allow. Wildcards are for discovery. Huge RFC1918 ranges are a last resort with a time limit. ## Mental model — four objects - Application Segment — what (name, FQDN/IP, TCP/UDP ports, health). - Segment Group — a basket you attach to Access Policy. - Server Group / Connector Group — who can reach the app LAN. - Access Policy — who is allowed. Default is deny. Flow 1 · ZPA app objects Flow 1 · ZPA app objects - App Segment FQDN + ports Segment Group policy basket Connector Group path to LAN Access Policy allow or default deny Health reporting checks reachability to each defined port — not whether SAP is ‘up’ as an application. Source: Understanding Health Reporting. Say this out loud Wildcard finds apps. Named segment is production. Missing port means no microtunnel. Empty Connector is mapping, not ping. Hard words: Defined application is an exact FQDN/IP. Application discovery is a wildcard or subnet used to learn names. Health reporting is connector reachability to those ports (On Access / Continuous / None). ## How to choose wildcard vs named Decision · Specific vs Wildcard Discovery first, then named segments. Do not leave *.corp.com in production Access Policy forever. Design Use when Trap Named FQDN + exact ports Production SAP, file, RDP, TMS Forgetting extra ports (8443, 3200–3299) Wildcard *.apex.internal Week-1 discovery Leaving it, then writing ‘allow all’ IP /16 or /8 Only if you have no DNS names — time-box it 10.0.0.0/8 as a permanent segment (explicitly discouraged) Browser Access on the segment Clientless HTTPS Missing internal URL / cert on that segment Source: ZPA Leading Practices Guide and Configuring Defined Application Segments . Decision · discovery vs production Decision · discovery vs production Still discovering? Wildcard Named ports Wildcard to learn names. Production = defined FQDN + exact ports. Then delete the wildcard. ## Runbook — Side A / B / C ### Side A · app owners #### Get the real reachability FQDN users type, every TCP/UDP port, and which site’s connector can route to it. Do not guess 443-only. - #### DNS inside the LAN Connectors resolve the FQDN. If LAN DNS is wrong, health is red even when the VIP exists. ### Side B · ZPA Admin - #### Create defined segment Configuration → Application Segments (or Resource Management → Applications). Applications = tms.apex.internal . TCP From/To = 8443. Exclude port 53. Health = On Access. - #### Group + connectors Place it in Segment Group sg-finance-apps . Attach the App Connector Group that sits on that LAN. Overlapping FQDN+port with another segment is a conflict — fix uniqueness. admin.zscaler.net · Configuration → Application Segments → Add Training mock · not live Configuration / Application Segments / Add Application Segment ### Add Application Segment Name TMS-Apex Applications tms.apex.internal TCP Port Ranges 8443–8443 Health Reporting On Access Cancel Save Exclude DNS 53. Continuous health is blocked if you have >10 ports or a wildcard/subnet. Training mock · not live. ### Side C · prove - #### Diagnostics Analytics → Diagnostics / User Activity. Aditya + tms.apex.internal. You want a Connector name, not empty, and an Allow policy. - #### Health If health is red, the connector cannot reach that IP:port. That is LAN routing/DNS, not ‘ZCC reinstall’. ## Runtime path after go-live Ops · health dots Health = TCP/UDP reachability from the connector. It is not an SAP work-process check. Client requests FQDN → ZPA matches a segment → Access Policy must Allow → a connector in the mapped group opens the microtunnel to the port. Double encryption stays disabled unless you have a documented reason. ## Traps and proof Symptom First check Do not 443 works, 8443 dead Port list on the segment Reinstall ZCC Empty Connector Segment ↔ connector group mapping + Access Policy Ping SAP from your laptop first Wildcard still in prod Named segments for discovered apps, then delete wildcard Allow all on the wildcard Continuous health greyed out >10 ports or discovery segment Open a severity-1 on ‘health broken’ Pilot checklist - tms.apex.internal:8443 Allow with a named Connector. - No second segment owns the same FQDN+port. - Wildcard discovery is time-boxed or already removed. Unsafe path Publishing 10.0.0.0/8 as a permanent application segment. Zscaler explicitly discourages it. You will fight port conflicts forever. ← ZPA operator path · Next: App Connector → ## Knowledge check Six segment tickets. Pick the first safe move. Q1 SAP on 443 works, custom app on 8443 is dead. First segment check? Disable ZCC TCP port list on the Application Segment includes 8443 New GRE URL Filtering Correct: b . A segment is FQDN/IP + ports. Missing 8443 means ZPA never brokers that microtunnel. Q2 Zscaler leading practice vs a giant RFC1918 range? Always publish 10.0.0.0/8 One segment per user Avoid large IP ranges; prefer wildcard domains, then tighten to named apps Only IPv6 Correct: c . ZPA Leading Practices: discourage 10.0.0.0/8. Use *.internal.corp.com, discover, then define named apps. Q3 Continuous health reporting is not available when… The segment has >10 ports or is a wildcard / subnet discovery segment ZCC is green Double encryption is off Browser Access is unused Correct: a . Understanding Health Reporting: no continuous for >10 ports or wildcard/IP subnet discovery. Q4 DNS port 53 on the segment — Zscaler recommendation? Always include 53 TCP and UDP Only TCP 53 Replace access policy Exclude DNS 53 from TCP/UDP port ranges Correct: d . Configuring Defined Application Segments: exclude DNS traffic (port 53). Q5 Two segments overlap on the same FQDN and port. Risk? Faster access Automatic HA Port/FQDN conflict — ZPA may pick the wrong segment or fail eligibility Inspect CA issue Correct: c . Keep named apps unique. Discovery wildcards are temporary. Q6 After discovery, what should you do with the wildcard? Create defined segments for named apps and remove the wildcard Leave it forever Publish 0.0.0.0/0 Move it to ZIA URL filtering Correct: a . Leading practices: define discovered apps, remove wildcards, then write granular access policy. Check answers Reset ## Sources - Configuring Defined Application Segments - Understanding Health Reporting - ZPA Leading Practices Guide Related: ZPA operator path · App Connector · Access policy --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt