# ZPA operator path broker, don’t VPN Source: https://ai.techclick.in/blog_zscaler_zpa_operator_complete Markdown: https://ai.techclick.in/blog_zscaler_zpa_operator_complete.md Publisher: Techclick Infosec Pvt Ltd Complete ZPA operator path: connector, server group, application segment, access policy, Browser Access, Diagnostics status codes, 8 scenario MCQs. ## The ticket Aditya: “ZCC is green. SAP will not open. Teams works.” Teams is ZIA. SAP is a private FQDN — that is ZPA . Green ZCC does not mean a connector was selected. Hero · ZPA private path User → ZPA Cloud (policy) → App Connector on the app LAN → SAP. No inbound firewall hole. Quick answer ZPA replaces VPN with a brokered microtunnel. Access Policy allow is mandatory — no match is deny. Map Application Segment → Server Group → Connector Group or Diagnostics stay empty. ## Mental model — four objects - App Connector — VM next to the app; dials out to ZPA Cloud. - Server Group — which connectors can reach this app (Dynamic Discovery almost always on). - Application Segment — FQDN/IP + ports users are allowed to request. - Access Policy — who may use that segment (user, group, posture). Flow 1 · ZPA microtunnel User to private app through ZPA - ZCC user SAML session ZPA Cloud Access Policy pick Connector App Connector inside app LAN Private app No inbound hole on the data centre. Connector dials out. If Diagnostics show empty Connector, policy or mapping never selected one — do not ping the app first. Hard words: Segment Group is a policy bundle of segments. Browser Access is clientless HTTPS to a private app. Double Encryption adds a second encrypt hop — do not enable it because it sounds safer without a design. ## Wildcard vs specific FQDN Two tunnels feel Keep ZPA for private apps. Do not dump *.company.com:1-65535 unless you enjoy lateral movement tickets. Classic miss Segment 1: *.example.com ports 1–65535. Segment 2: www.example.com port 8843 only. User hits www:80. ZCC picks the more specific FQDN, misses port 80, and does not fall through to the wildcard. Source: About Application Access. admin.private.zscaler.com · Configuration → Application Segments Training mock · not live Configuration / Application Segments / Add ### Application Segment · SAP-Prod Applications (FQDN) sap.apexfreight.internal TCP ports 3200, 3300, 443 Server Group SG-DC1-SAP (Dynamic Discovery) Health Reporting On Access Cancel Save More specific FQDN wins. If the specific segment misses the port, ZCC does not fall through to the wildcard — traffic leaves ZPA. Source: help.zscaler.com About Application Access. ## Runbook — Side A / B / C ### Side A · App Connector host #### Place it Same L3 as the app (or routed). Outbound to ZPA Cloud. NTP, DNS, no SSL intercept on the connector itself. - #### Enrol Provisioning key from Configuration → App Connectors. Health green is necessary, not sufficient. ### Side B · ZPA Admin - #### Connector Group Put DC1 connectors together. Map that group to the SAP Server Group. - #### Application Segment Configuration → Application Segments. FQDN + exact TCP ports. Health Reporting: On Access. - #### Access Policy Policy → Access Policy. Allow grp-sap-users to Segment Group SAP. Remember default is deny. ### Side C · prove - #### Diagnostics Analytics → Diagnostics → User Activity. Filter Aditya + sap.apexfreight.internal. You want a named Connector, not empty. - #### Status codes BRK_MT_SETUP_FAIL_NO_POLICY_FOUND = allow missing or segment disabled. BRK_MT_SETUP_FAIL_REJECTED_BY_POLICY = a deny matched. Source: Understanding Private Access Session Status Codes. admin.private.zscaler.com · Analytics → Diagnostics → User Activity Training mock · not live Analytics / Diagnostics / Log Type: User Activity ### User Activity · priya@apexfreight.in Application sap.apexfreight.internal App Connector (empty) Status code BRK_MT_SETUP_FAIL_NO_POLICY_FOUND Connection status Close Empty Connector + Close means ZPA never selected a connector. Status BRK_MT_SETUP_FAIL_NO_POLICY_FOUND means allow policy is missing or the segment/group is disabled. Source: help.zscaler.com session status codes. ## Runtime ZCC intercepts the FQDN in the segment. ZPA Cloud evaluates Access Policy, then picks a connector from the server group. Connector connects to the app on the LAN. If DNS on the connector LAN is wrong, the user still sees “cannot connect” with a named connector and high setup time — that is LAN DNS, not policy. Proof desk Named connector + successful session status beats a green tile. ## Traps and proof Symptom First evidence Fix shape ZCC green, app dead, Connector empty User Activity Diagnostics Policy or server-group ↔ connector-group map Named connector, app still dead Setup time, connector LAN DNS/port Fix app reachability, not ZCC reinstall One URL works, sibling port fails Two overlapping segments Align ports on the specific FQDN Browser Access cert error Browser Access cert / SAN Fix cert, not Access Policy Pilot checklist - Pilot user opens SAP. Diagnostics show connector name AC-DC1-01. - A user not in grp-sap-users is denied with a policy status code. - Posture fail is visible in policy, not as “app down.” Next: troubleshooting desk → · Path hub ## Knowledge check Eight ZPA tickets. Policy before ping. Q1 ZPA replaces VPN mainly because… It inspects SSL like ZIA Connector dials out; no inbound hole; policy brokers the app It uses GRE It is a PAC file Correct: b . Brokered microtunnel. Q2 Default when Access Policy has no match? Allow Deny Bypass to internet Ask the user Correct: b . No match = deny. Q3 Empty Connector + Close on User Activity? SAP process down ZPA never selected a connector (map/policy/health) MTU 1400 URL category Correct: b . Eligibility, not ping. Q4 More specific FQDN misses the port. What happens? Falls through to wildcard segment ZCC bypasses ZPA for that request ZIA inspects it Browser Isolation Correct: b . About Application Access: no fall-through. Q5 BRK_MT_SETUP_FAIL_NO_POLICY_FOUND means? Connector CPU high Allow missing or segment/group disabled Inspect CA GRE down Correct: b . Documented policy-block code. Q6 Dynamic Server Discovery default? Off always On for almost all server groups Only Browser Access Only PRA Correct: b . ZPA Azure reference architecture: on by default. Q7 Named connector, app still dead. Next? Reinstall ZCC for the org Connector LAN DNS/port to the app Disable Access Policy New GRE Correct: b . Reachability after selection. Q8 Health Reporting Continuous is blocked when… User is in India Segment has >10 ports or wildcard-only apps ZCC 4.x SAML is used Correct: b . Documented limitation on Application Segments. Check answers Reset ## Sources - About Applications - About Application Access (FQDN conflict) - Configuring Application Segments - Session status codes - App Connector diagnostics Related: Path hub · App segments deep · Connector deploy · Troubleshooting desk --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt