Network Helpdesk - Help Centre

Forwarding Control Rule

Christian Narvaez — Wed, 25 Mar 2026 00:22:42 +0000

Overview

Zscaler Internet Access (ZIA) control rules apply uniformly to traffic regardless of how it is forwarded—whether through the Zscaler Client Connector (ZCC) or via GRE/IPsec tunnels from known locations.

Scope of Control Rules

Control rules are evaluated after traffic reaches ZIA. This means:

They do not influence the initial forwarding method (ZCC vs GRE/IPsec).

They apply equally to all traffic that matches...

ChatGPT Can't Access in Asian users

Christian Narvaez — Fri, 21 Nov 2025 02:41:23 +0000

There is a known issue for ChatGPT whereas ChatGPT can't be accessible for Asian Users especially if ZIA users are using Hong Kong as Primary data center.

To resolve this Issue. ChatGPT traffic must go through to either Singapore or Taipei Zscaler DC.

sample PAC script as below:

/* for PH and MY users who wants to use ChatGPT then use...

How Custom URL Works

Christian Narvaez — Thu, 15 Jan 2026 09:21:20 +0000

Use Case:
Sometimes users have requirement to create different URL categories for same domain or sub-domains to be used in different policies like DLP, URL Filtering, File Type control, etc. This could lead to the issue where policies might not work as expected and can impact user access to the domains.

Example: The below...

ZCC Logs

Christian Narvaez — Fri, 21 Nov 2025 02:41:20 +0000

Any issue you face with respect to Authentication/Service/Registry/Interaction/Windows/Traffic/Network/update can be checked from the ZCC logs.

Exporting logs in ZCC:

Right click on Tray Icon to Export the logs or Export Logs from “More” options in debug mode. Exporting logs is the preferred method (ZIP file).

When to open which log file?

AppInfo - To leverage information about system, application, CPU utilization, Route print etc....

Benefits of Reauthentication Timeout Policy

Christian Narvaez — Fri, 21 Nov 2025 02:41:14 +0000

Zscaler recommends configuring Authentication Time out to 7 Days.

If there are organization that sets their timeout policy to "never". we can help to justify to enable the timeout policy with the below benefits.

1) Based on the core principle of Zero Trust , Specify the period after which users are prompted to re authenticate to ZPA to maintain their access to...

How ZPA intercept traffic

Christian Narvaez — Fri, 21 Nov 2025 02:41:11 +0000

Configuration in ZPA Portal

Expected Result

Diagnostic Visibility

IP Address, FQDN and ports are not defined

ZPA won't pick up the traffic

No logs as traffic not going through ZPA

App Connector Selection

Christian Narvaez — Fri, 21 Nov 2025 02:41:06 +0000

App connector selection is based on many factors.

Calculate virtual RTT for all the Connector Groups serving the application.

Apply Geofencing to the Connector Groups (filter based on country code).

Build pool of possible routes from available Routes.

Return the route to serve the requested application.

ZPA App Connector : Cannot decrypt data from instance_id.crypt

Christian Narvaez — Fri, 21 Nov 2025 02:41:01 +0000

In normal day-to-day operations, sometimes ZPA App connector will be shown disconnected in the ZPA Admin Portal due to different reasons.

To understand what has actually happen, we will need to login to the ZPA App Connector and issue "sudo systemctl status zpa-connector". This command will show the status of the ZPA App Connector, and tell us what the nature of...