T Techclick ← All lessons
Zscaler · ZPA · Interactive lesson

ZPA operator path broker, don’t VPN

Dummy: Aditya cannot open SAP. You will map Connector Group → Server Group → Application Segment → Access Policy and read User Activity Diagnostics.

22 min read · L2 primary · Quiz at end

⚡ Quick Answer

Complete ZPA operator path: connector, server group, application segment, access policy, Browser Access, Diagnostics status codes, 8 scenario MCQs.

After this page you can

The ticket

Aditya: “ZCC is green. SAP will not open. Teams works.” Teams is ZIA. SAP is a private FQDN — that is ZPA. Green ZCC does not mean a connector was selected.

Hero · ZPA private path
User through cloud broker to connector to app
User → ZPA Cloud (policy) → App Connector on the app LAN → SAP. No inbound firewall hole.
Quick answer

ZPA replaces VPN with a brokered microtunnel. Access Policy allow is mandatory — no match is deny. Map Application Segment → Server Group → Connector Group or Diagnostics stay empty.

Mental model — four objects

  1. App Connector — VM next to the app; dials out to ZPA Cloud.
  2. Server Group — which connectors can reach this app (Dynamic Discovery almost always on).
  3. Application Segment — FQDN/IP + ports users are allowed to request.
  4. Access Policy — who may use that segment (user, group, posture).
Flow 1 · ZPA microtunnel
ZCC user SAML session ZPA Cloud Access Policy pick Connector App Connector inside app LAN Private app

No inbound hole on the data centre. Connector dials out. If Diagnostics show empty Connector, policy or mapping never selected one — do not ping the app first.

Hard words: Segment Group is a policy bundle of segments. Browser Access is clientless HTTPS to a private app. Double Encryption adds a second encrypt hop — do not enable it because it sounds safer without a design.

Wildcard vs specific FQDN

Two tunnels feel
ZIA versus ZPA as separate paths
Keep ZPA for private apps. Do not dump *.company.com:1-65535 unless you enjoy lateral movement tickets.
Classic miss

Segment 1: *.example.com ports 1–65535. Segment 2: www.example.com port 8843 only. User hits www:80. ZCC picks the more specific FQDN, misses port 80, and does not fall through to the wildcard. Source: About Application Access.

admin.private.zscaler.com · Configuration → Application Segments
Training mock · not live

Configuration / Application Segments / Add

Application Segment · SAP-Prod

sap.apexfreight.internal
3200, 3300, 443
SG-DC1-SAP (Dynamic Discovery)
On Access

More specific FQDN wins. If the specific segment misses the port, ZCC does not fall through to the wildcard — traffic leaves ZPA. Source: help.zscaler.com About Application Access.

Runbook — Side A / B / C

Side A · App Connector host

  1. Place it

    Same L3 as the app (or routed). Outbound to ZPA Cloud. NTP, DNS, no SSL intercept on the connector itself.

  2. Enrol

    Provisioning key from Configuration → App Connectors. Health green is necessary, not sufficient.

Side B · ZPA Admin

  1. Connector Group

    Put DC1 connectors together. Map that group to the SAP Server Group.

  2. Application Segment

    Configuration → Application Segments. FQDN + exact TCP ports. Health Reporting: On Access.

  3. Access Policy

    Policy → Access Policy. Allow grp-sap-users to Segment Group SAP. Remember default is deny.

Side C · prove

  1. Diagnostics

    Analytics → Diagnostics → User Activity. Filter Aditya + sap.apexfreight.internal. You want a named Connector, not empty.

  2. Status codes

    BRK_MT_SETUP_FAIL_NO_POLICY_FOUND = allow missing or segment disabled. BRK_MT_SETUP_FAIL_REJECTED_BY_POLICY = a deny matched. Source: Understanding Private Access Session Status Codes.

admin.private.zscaler.com · Analytics → Diagnostics → User Activity
Training mock · not live

Analytics / Diagnostics / Log Type: User Activity

User Activity · priya@apexfreight.in

sap.apexfreight.internal
(empty)
BRK_MT_SETUP_FAIL_NO_POLICY_FOUND
Close

Empty Connector + Close means ZPA never selected a connector. Status BRK_MT_SETUP_FAIL_NO_POLICY_FOUND means allow policy is missing or the segment/group is disabled. Source: help.zscaler.com session status codes.

Runtime

ZCC intercepts the FQDN in the segment. ZPA Cloud evaluates Access Policy, then picks a connector from the server group. Connector connects to the app on the LAN. If DNS on the connector LAN is wrong, the user still sees “cannot connect” with a named connector and high setup time — that is LAN DNS, not policy.

Proof desk
Health checks on the operator monitor
Named connector + successful session status beats a green tile.

Traps and proof

SymptomFirst evidenceFix shape
ZCC green, app dead, Connector emptyUser Activity DiagnosticsPolicy or server-group ↔ connector-group map
Named connector, app still deadSetup time, connector LAN DNS/portFix app reachability, not ZCC reinstall
One URL works, sibling port failsTwo overlapping segmentsAlign ports on the specific FQDN
Browser Access cert errorBrowser Access cert / SANFix cert, not Access Policy
Pilot checklist

Next: troubleshooting desk → · Path hub

Knowledge check

Eight ZPA tickets. Policy before ping.

Q1

ZPA replaces VPN mainly because…

Correct: b. Brokered microtunnel.
Q2

Default when Access Policy has no match?

Correct: b. No match = deny.
Q3

Empty Connector + Close on User Activity?

Correct: b. Eligibility, not ping.
Q4

More specific FQDN misses the port. What happens?

Correct: b. About Application Access: no fall-through.
Q5

BRK_MT_SETUP_FAIL_NO_POLICY_FOUND means?

Correct: b. Documented policy-block code.
Q6

Dynamic Server Discovery default?

Correct: b. ZPA Azure reference architecture: on by default.
Q7

Named connector, app still dead. Next?

Correct: b. Reachability after selection.
Q8

Health Reporting Continuous is blocked when…

Correct: b. Documented limitation on Application Segments.

Sources

Related: Path hub · App segments deep · Connector deploy · Troubleshooting desk