Zscaler Private Access Technical Guide for Enterprise Zero Trust Access

Overview

Zscaler Private Access (ZPA) is a cloud-delivered zero trust network access (ZTNA) platform that connects authenticated users, workloads, and third parties to specific private applications instead of extending network access through a traditional VPN. Its core purpose is to hide applications behind outbound-only connectors, enforce identity- and context-based policy, and reduce lateral movement by eliminating broad network trust.

Enterprises use ZPA to modernize remote access, support hybrid work, simplify mergers and acquisitions, and provide segmented access to data center and cloud-hosted applications. Common use cases include access to internal web apps, SSH and RDP services, VDI, and private apps in AWS, Azure, and on-premises environments.

Architecture

Core components

• ZPA Public Service Edge: Zscaler cloud brokers policy and stitches user sessions to private apps.
• Zscaler Client Connector: Endpoint agent that establishes user identity, posture, and traffic forwarding.
• App Connector: Lightweight VM or host deployed near private applications; creates outbound TLS tunnels to Zscaler.
• Service Edge: Optional customer-dedicated processing for data residency, performance, or regulatory needs.
• Identity Provider: Okta, Microsoft Entra ID, Ping Identity, or similar for SAML-based authentication.
• Server Groups / Application Segments: Logical groupings that map connectors to applications and policies.

Deployment models

• On-premises: App Connectors in data centers near internal applications.
• Public cloud: Connectors in AWS, Azure, or GCP VPC/VNet subnets.
• Hybrid: Multiple connector groups across regions with app segments spanning environments.

Data flow

1. User launches an internal app such as https://hr.internal.corp.
2. Client Connector identifies the app and sends policy context to ZPA.
3. ZPA validates user identity, posture, and access policy.
4. The nearest eligible App Connector creates an outbound path to the application.
5. Traffic is brokered application-to-user, never network-to-network.

Implementation Guide

1. Integrate the IdP in the ZPA admin portal and enable SAML attributes for user and group mapping.
2. Deploy App Connectors in redundant pairs per site or cloud region.
3. Register connectors and place them into a Server Group.
4. Define Application Segments for FQDNs, ports, and protocols.
5. Create Access Policies based on users, groups, posture, location, and application.
6. Roll out Client Connector with MDM or software distribution.
7. Validate access and monitor connector health.

Example Linux connector host preparation

sudo hostnamectl set-hostname zpa-app-connector-01
sudo timedatectl set-timezone UTC
sudo sysctl -w net.ipv4.ip_forward=1
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --reload
curl -I https://gateway.zpa.zscaler.net
openssl s_client -connect gateway.zpa.zscaler.net:443 -brief

Example DNS and routing checks from an application subnet

dig +short hr.internal.corp
nc -zv 10.20.14.25 443
traceroute 10.20.14.25
curl -vk https://hr.internal.corp --resolve hr.internal.corp:443:10.20.14.25

Example declarative application segment definition

application_segment:
  name: hr-internal-prod
  domain_names:
    - hr.internal.corp
    - payroll.internal.corp
  segment_group: corp-dc-east
  server_groups:
    - dc-east-connectors
  tcp_ports:
    - "443"
    - "8443"
  udp_ports: []
  bypass_type: NEVER
  health_reporting: ON_ACCESS

Code Examples

1. Bash health validation

#!/usr/bin/env bash
set -euo pipefail
for host in gateway.zpa.zscaler.net config.zpabeta.net hr.internal.corp; do
  echo "Checking $host"
  getent hosts "$host" || true
  timeout 5 bash -c "</dev/tcp/$host/443" && echo "443 reachable" || echo "443 failed"
done

2. YAML policy-as-documentation

access_policy:
  name: allow-hr-users
  action: ALLOW
  conditions:
    users:
      - group: HR-Employees
    posture:
      - crowdstrike_healthy: true
      - disk_encrypted: true
    applications:
      - hr-internal-prod

3. Python log parser for connector issues

import re
log = open('/var/log/zpa-connector.log').read()
patterns = {
    'auth_fail': r'SAML assertion validation failed',
    'broker_unreachable': r'Failed to establish control channel',
    'dns_issue': r'NXDOMAIN|no such host'
}
for name, pattern in patterns.items():
    count = len(re.findall(pattern, log, re.I))
    print(f'{name}: {count}')

Security Hardening

• Use least-privilege app segments; publish exact FQDNs and ports instead of broad wildcard domains.
• Enforce MFA in the IdP and require device posture such as EDR healthy state and disk encryption.
• Deploy at least two App Connectors per site across separate hypervisors or availability zones.
• Restrict connector egress to required Zscaler destinations over TLS 1.2+ and validate outbound proxy exceptions if used.
• Use dedicated server groups for sensitive apps such as admin portals, SSH bastions, and domain controllers.
• Integrate logs with SIEM and monitor for unusual access patterns, repeated policy denials, and connector flaps.

Comparison

Troubleshooting

Error 1: Connector cannot reach broker

Log sample:

2026-03-12T08:14:22Z ERROR tunnel-manager Failed to establish control channel to broker gateway.zpa.zscaler.net:443: i/o timeout

Fix: Verify outbound TCP 443, DNS resolution, proxy bypass rules, and system time sync.

Error 2: User denied by policy

Log sample:

2026-03-12T08:17:41Z WARN policy-engine Access denied for user alice@corp.example app hr.internal.corp reason="Posture check failed: disk_encrypted=false"

Fix: Confirm Client Connector posture integration, MDM compliance state, and matching policy order.

Error 3: Application resolution failure

Log sample:

2026-03-12T08:19:03Z ERROR app-connector upstream dial failed target=hr.internal.corp:443 error="lookup hr.internal.corp on 10.10.0.10:53: no such host"

Fix: Correct internal DNS forwarders, connector resolver settings, and split-horizon DNS records.

Best Practices

Do

• Segment by application sensitivity: keep finance, HR, and admin apps in separate segments and policies.
• Test with pilot groups before broad rollout.
• Place connectors close to apps to reduce latency and simplify firewall rules.
• Use SCIM or group sync from the IdP to avoid stale entitlements.

Don't

• Do not publish *.corp.local when only three FQDNs are needed.
• Do not rely on user identity alone for privileged apps; require posture and MFA.
• Do not deploy a single connector per site; connector loss becomes an outage.
• Do not ignore DNS design; many ZPA issues are resolver and split-DNS problems, not transport failures.