Scribd
Upload
3 views2 pages

M01 Student Summary

ZIA (Zscaler Internet Access) is a cloud-native Secure Web Gateway that forwards user traffic to the Zscaler cloud for policy enforcement before accessing the internet. Key components include the Public Service Edge (PSE), Load Balancer (SMLB), and Zscaler Client Connector (ZCC), with various traffic forwarding methods such as PAC files and GRE tunnels. The document also compares ZTunnel 1.0 and 2.0, detailing their mechanisms and traffic scopes, and outlines the ZIA data flow and key terms associated with the architecture.

Uploaded by

shameel.lfc
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
3 views2 pages

M01 Student Summary

ZIA (Zscaler Internet Access) is a cloud-native Secure Web Gateway that forwards user traffic to the Zscaler cloud for policy enforcement before accessing the internet. Key components include the Public Service Edge (PSE), Load Balancer (SMLB), and Zscaler Client Connector (ZCC), with various traffic forwarding methods such as PAC files and GRE tunnels. The document also compares ZTunnel 1.0 and 2.0, detailing their mechanisms and traffic scopes, and outlines the ZIA data flow and key terms associated with the architecture.

Uploaded by

shameel.lfc
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Module 01

ZIA Foundations & Architecture


Student Summary · Saturday 7 June 2026

ZIA (Zscaler Internet Access) is a cloud-native Secure Web Gateway (SWG) delivered as a service. Traffic is
forwarded from users and offices to the Zscaler cloud where policy is enforced before reaching the internet.

1. ZIA Architecture Components

Component Role
PSE / ZEN (Public Service Edge) Zscaler-operated enforcement node in 150+ PoPs.
Inspects all forwarded traffic. Also called ZEN (Zscaler
Enforcement Node).
SMLB (Load Balancer) Distributes traffic across PSEs within a data centre.
Transparent to users.
SMCA (Central Authority) Issues SSL certificates, validates SAML assertions, sets
auth cookies. The trust anchor of ZIA.
SMSM (Nanolog) Compressed log storage. Stores every web transaction
for Web Insights and NSS streaming.
ZCC (Zscaler Client Connector) Endpoint agent. Forwards user traffic to PSE via ZTunnel
1.0 or 2.0.

2. Traffic Forwarding Methods


▸ PAC File: browser proxy setting; HTTP/HTTPS only; no ZCC needed; most common for managed browsers
▸ GRE Tunnel: network-level; all TCP/UDP from office router to PSE; site-to-cloud; no per-device config
▸ IPsec Tunnel: encrypted GRE alternative; IKEv1/v2; PSK authentication; used where GRE not available
▸ ZCC (Zscaler Client Connector): endpoint agent; supports ZTunnel 1.0 (proxy) and ZTunnel 2.0 (full TUN
adapter)
▸ KERBEROS / Digest Auth: used internally by ZCC for auth — not customer-configured
KEY FACT [Link] — bookmark this URL. It confirms ZIA forwarding method, tenant, username, and PSE
data centre in one page.

3. ZTunnel 1.0 vs ZTunnel 2.0

Feature ZTunnel 1.0 ZTunnel 2.0


Mechanism HTTPS proxy (port 80/443) TUN adapter (kernel-level)
Traffic scope HTTP/HTTPS only All IP traffic (TCP + UDP)
Non-web apps Not forwarded to ZIA Forwarded to ZIA Firewall
ZCC version req. Any ZCC 3.x+
Preferred for Simple HTTP environments Full ZIA enforcement
(recommended)

4. ZIA Data Flow (Request Lifecycle)


▸ Step 1: User opens browser → ZCC/PAC/GRE forwards to nearest PSE (ZEN)
▸ Step 2: PSE checks auth cookie — if absent, redirects to SAML IdP (SMCA orchestrates)
▸ Step 3: After auth, PSE evaluates policy: URL Filter → Cloud App → SSL → DLP → Sandbox
▸ Step 4: If allowed: PSE proxies request to destination, returns response to user
▸ Step 5: Log record written to SMSM (Nanolog) — available in Web Insights within seconds
TIP Policy evaluation is top-to-bottom within each engine. Cloud App Control evaluates BEFORE URL Filter — a
Cloud App Allow rule can bypass URL Filter block rules. Always configure both engines consistently for reliable
enforcement.

5. Key Terms Quick Reference

Term Meaning
PSE Public Service Edge — Zscaler-operated ZIA enforcement
node (same as ZEN)
SMLB Zscaler Load Balancer — distributes traffic across PSEs
SMCA Zscaler Central Authority — authentication hub, cert
issuer, policy coordinator
SMSM Nanolog — compressed log store for Web Insights and
NSS streaming
ZEN Zscaler Enforcement Node — another name for PSE
ZCC Zscaler Client Connector — endpoint agent for ZIA and
ZPA forwarding
PAC Proxy Auto-Config — JavaScript file directing browser to
proxy
ZTunnel ZCC tunnel mode: 1.0 = HTTPS proxy; 2.0 = full TUN
adapter (all traffic)

You might also like