MASTERING ZSCALER: HANDS ON

Lab 02 — Traffic Forwarding Setup

The Network Guy | Module 02 | Sun 7 June 2026
────────────────────────────────────────────────────
────────────────────

Deadline: Complete Lab 02 before Module 03A on Sunday 14 June 2026. Submit screenshots of
[Link] and ZIA Analytics to confirm forwarding is working.

Prerequisites: Active Azure free account. ZIA Admin Portal access with the class enrollment token
(provided by your trainer). Azure Entra ID configured as IdP (class tenant is pre-configured).

Lab Objective: Deploy ZCC on an Azure Windows VM, create a ZIA Location for your VM's public IP,
and verify that all traffic from the VM is forwarded through Zscaler.

Step 1: Create an Azure Windows VM

You will use a Windows Server VM in Azure as your lab jump host.
1.1 — Sign in to Azure Portal
1. Open [Link] in your browser.
2. Sign in with your Azure free account credentials.
3. If prompted to start a free trial, accept (you get $200 credit for 30 days).
1.2 — Create a Virtual Machine
4. In the Azure Portal search bar, type "Virtual machines" and click the result.
5. Click + Create > Azure virtual machine.
6. Fill in the Basics tab:
 Resource group: click Create new > name it "zscaler-lab" > OK.
 Virtual machine name: "lab-jumphost-01"
 Region: choose the region closest to you.
 Image: Windows Server 2022 Datacenter — Gen2 (or Gen1 if Gen2 unavailable).
 Size: click See all sizes > search "B1s" > select Standard_B1s (1 vCPU, 1 GB RAM). This is free-tier
eligible.
 Administrator username: labadmin
 Administrator password: choose a secure password (min 12 chars, upper+lower+number+special).
Note it down.
 Public inbound ports: Allow selected ports > select RDP (3389).
7. Click Next: Disks. Accept defaults (Standard SSD, 127 GB OS disk).
8. Click Next: Networking. Note the Virtual Network and Subnet created automatically.
9. Leave all networking defaults. The public IP will be auto-created.
10. Click Review + create. Review the summary. Click Create.
11. Wait 2-3 minutes for the VM to deploy.
1.3 — Note Your VM's Public IP
12. When deployment completes, click Go to resource.
13. On the VM overview page, find the Public IP address field on the right side.
14. Note this IP address — you will use it in Step 2 to create a ZIA Location.
Example: Your public IP might look like: [Link] — note the exact value.

1.4 — Restrict RDP to Your Home IP (Security Best Practice)

15. In the Azure Portal, on your VM page, click Networking in the left menu.
16. Find the inbound rule for port 3389 (RDP). Click the rule to edit it.
17. Change Source from "Any" to "IP Addresses".
18. Enter your home/office public IP in the Source IP ranges field.
 If you don't know your IP, visit [Link] from your local machine.
19. Click Save.
Why: Leaving RDP open to Any will result in brute-force login attempts within minutes. Always restrict
to your IP.

1.5 — Connect via RDP

20. On the VM overview page, click Connect > RDP.
21. Click Download RDP File.
22. Open the downloaded .rdp file. Click Connect when prompted.
23. Enter credentials: username = labadmin, password = the one you set in Step 1.2.
24. Accept the certificate warning. Click Yes.
25. You are now inside the Azure VM. Keep this RDP session open for the rest of the lab.
Performance tip: If the VM is slow, go to: System > Display > Advanced display settings > change
resolution to 1024x768. Also: Control Panel > System > Advanced > Performance > Visual Effects >
Adjust for best performance.

Step 2: Create a Location in ZIA

A Location tells ZIA that traffic from your Azure VM's public IP belongs to your organisation.
2.1 — Log in to ZIA Admin Portal
26. From your LOCAL machine (not the Azure VM), open a browser.
27. Navigate to the ZIA Admin Portal URL provided by your trainer.
28. Log in with your admin credentials.
2.2 — Create the Location
29. In the ZIA Admin Portal, navigate to:
 Infrastructure > Traffic Forwarding > Locations
30. Click Add Location.
31. Fill in the fields:
 Name: Azure-Lab-[YourFirstName] (e.g., Azure-Lab-Sam)
 Country: your country
 IP Address(es): enter the public IP from Step 1.3 (e.g., [Link])
 Leave all other fields at default.
32. Click Save.
33. Click Activate Changes (blue banner at the top of the page) to push the config.
Note: ZIA changes are staged until you click Activate. Always activate after saving a Location, policy,
or setting.

Step 3: Install & Enroll ZCC on the Azure VM

You will install the Zscaler Client Connector inside the Azure VM.
3.1 — Download ZCC Installer
34. In the ZIA Admin Portal, navigate to:
 Administration > ZCC Portal
35. Click Download ZCC.
36. Select: Platform = Windows, Architecture = x64.
37. Note the Enrollment Token shown on this page (a 6-character alphanumeric code).
38. Click Download. Save the installer file.
Enrollment Token: This 6-character token is unique to your ZIA organisation. Copy it — you will need
it during ZCC installation. Do not share it publicly.

3.2 — Copy the Installer to the Azure VM

39. The ZCC installer is on your local machine. You need to get it into the Azure VM.
40. Option A (easiest) — Copy/paste via RDP:
 In the RDP session, open Internet Explorer or Edge inside the VM.
 Navigate to the ZIA Admin Portal inside the VM and download ZCC directly from there.
41. Option B — Azure Files or OneDrive:
 Upload the installer to OneDrive on your local machine, then download from OneDrive inside the VM.
3.3 — Install ZCC
42. Inside the Azure VM, run the ZCC installer (double-click the .msi file).
43. If a User Account Control (UAC) prompt appears, click Yes.
44. The ZCC installation wizard runs. Accept defaults. Click Install.
45. Wait for installation to complete (1-2 minutes). Click Finish.
46. ZCC will launch automatically and show in the system tray (bottom-right of taskbar).

3.4 — Enroll ZCC

47. ZCC will show a setup screen asking for your organisation details.
48. Enter the Enrollment Token from Step 3.1.
49. Click Enroll (or Continue).
50. ZCC opens a browser window for SAML authentication. The browser opens the Azure Entra ID login
page.
51. Log in with your student account credentials (provided by your trainer).
52. After successful authentication, the browser shows "Authentication successful" and closes.
53. ZCC tray icon should now show green (Connected).
If ZCC shows yellow (Tunnel Only): This means the tunnel is up but SAML authentication is
pending. Right-click ZCC tray icon > Sign In to retry the SAML login.

If ZCC shows red/Fail-Close: Check that outbound TCP 443 and UDP 9480 are not blocked by the
Azure NSG. In the Azure Portal, go to your VM > Networking > Outbound port rules. The default Azure
NSG allows all outbound — so this should not be blocked.

Step 4: Verify Forwarding with [Link]

This is the golden forwarding test. Perform this step inside the Azure VM.
4.1 — The [Link] Test
54. Inside the Azure VM, open a web browser (Edge or Chrome).
55. Navigate to: [Link]
56. If traffic is going through Zscaler, you will see:
 A message: "You are currently connected through Zscaler Internet Access"
 Your Zscaler gateway hostname (e.g., [Link])
 The Public Service Edge (formerly ZEN) name
57. Take a screenshot of this page.
If you see your ISP/Azure IP instead: Traffic is NOT going through Zscaler. Check: (1) ZCC tray icon
is green (Connected). (2) Right-click ZCC > About — confirm your username is shown. (3) Right-click
ZCC > ZCC Diagnostics — check the forwarding status. (4) Verify your Forwarding Profile exclusion list
does not exclude [Link].

4.2 — ZCC About Verification

58. Inside the Azure VM, right-click the ZCC tray icon (system tray, bottom-right).
59. Click About.
60. Confirm the following:
 Your enrolled username is shown (your student email).
 The Zscaler cloud is shown (e.g., Zscaler).
 The active Public Service Edge (gateway hostname) is shown.
61. Take a screenshot of the About dialog.

Step 5: Confirm Traffic in ZIA Analytics

Confirm that ZIA received and logged your traffic.
5.1 — Open ZIA Web Insights
62. From your LOCAL machine, log in to the ZIA Admin Portal.
63. Navigate to: Analytics > Web Insights.
64. In the top-right, set the time filter to: Last 1 Hour.
65. Click Apply.

5.2 — Find Your Username in Transactions

66. Click the Transactions tab (or Users tab depending on your ZIA version).
67. In the search/filter field, type your student username or email.
68. You should see recent web requests from your account.
69. Confirm that the Location column shows "Azure-Lab-[YourName]" for your transactions.
70. Take a screenshot of the transaction log showing your username.
If no transactions appear: Wait 2-5 minutes — there is a slight delay before transactions appear in
ZIA Analytics. Try browsing to a few more websites (e.g., [Link], [Link]) inside the Azure VM,
then refresh ZIA Analytics.

Lab 02 Submission
Submit the following screenshots to your trainer before Module 03A:
71. Screenshot of [Link] showing "Connected through Zscaler" and the gateway hostname.
72. Screenshot of ZCC About dialog showing your enrolled username and active Service Edge.
73. Screenshot of ZIA Analytics > Transactions showing your username and the Azure-Lab Location.

Azure Cost Management — Keep Your Free Tier

Important: The Azure free account includes 750 hours/month of B1s VMs. With one VM running 24/7,
that is exactly 750 hours. Do NOT run more than one VM simultaneously or you may incur charges.

74. When you are not using the VM for lab work, stop (deallocate) it in Azure Portal.
75. To stop: Azure Portal > Virtual Machines > lab-jumphost-01 > click Stop.
76. To restart for next lab: click Start. The public IP may change when you restart — update your ZIA
Location if it does.
Static IP option: To avoid the IP changing, assign a Static public IP. In Azure Portal > VM >
Networking > click the public IP link > Configuration > change Assignment to Static > Save. Static IPs
in Azure are free while assigned to a running resource.

────────────────────────────────────────────────────────────────────────────────

Lab 02 Completion Checklist

 [] Azure VM deployed (lab-jumphost-01, Standard_B1s or B2s)
 [] RDP access confirmed — logged into Azure VM
 [] ZIA Location created with Azure VM public IP
 [] ZCC downloaded and installed on Azure VM (admin rights used)
 [] ZCC enrolled with your student credentials — Status: Connected
 [] [Link] test passed: 'Connected through Zscaler Internet Access' message visible
 [] ZCC About dialog shows enrolled username and active Public Service Edge
 [] ZIA Analytics > Transactions shows your username with Location: Azure-Lab-[YourName]
 [] Azure VM stopped/deallocated to preserve free-tier credits
────────────────────────────────────────────────────────────────────────────────

NOTE: Screenshots required: (1) [Link] showing Zscaler connection, (2) ZCC About dialog, (3) ZIA
Analytics transaction with your username. These are prerequisites for Lab 03A.