วีดีโอ

Cordinate with your network team ,

@@ITZecurity Thank you Sir for reply. If I am correct it is public IP address of Wan interface of router on which we will configure tunnel.

@dhananjay3974 yes you are correct

You are correct

NAT not needed, zscaler recommends to sent private IPs for better visibility and load balancing.

@@ITZecurity got it...router will send it's internal user private IP to Zscalar over GRE and Zscalar should NAT the IP so user will get internet...where NAT is performed...can you please make a video on it

NAT will happen at zscaler end, once the traffic reaches at zscaler public service edge.

@@ITZecurity thank you

You would go with idp bypasses , which will essentially help you to eliminate the idp related traffic blockages. You can go with zcc for vdi as well instead of pac file.

@@ITZecurity what would be best practice if we need source user id details in webinsight? In our environment, we have multi-session VDI user machine so how could we go with single sign-on instead of authenticate manually?

help.zscaler.com/cloud-branch-connector/what-zscaler-client-connector-vdi

Let's connect and discuss wa.me/qr/XJUPLLN4HHWKF1

If you have users. Servers, guest and ot infra, then we have to go with gre /ipsec + zcc to cover all of the traffic sources. Zcc tunnel2.o for endpoints connecting from corporate / remote and sent out all ports of tcp ans udp to zscaler . Both firewall ans web filtering policies can enforce here.

@@ITZecurity thank you for your response. But still I'm confused with GRE/IPSec over ZCC what we want to achieve that we can't only with Pure ZCC Traffic Method? For server, GRE/IPSec over PAC what would be benefit?

In our corporate office you may have multiple sources, based on the type of sources you will have to decide the traffic forwarding method. 1. Only laptop/ desktop users , let's go with zcc 2. If servers, go with ipsec/ gre and pac file to decide which traffic should go to zscaler or bypassed at locally , you have to make route changes on the network as well. 3. Depend on the infra and what are we going to achieve this would change.

In all cases you can configure all these traffic forwarding options with certain tweaking.

@@ITZecurity here I'm most confused. I would be immensely grateful if you do more easy layman language?

China mainland firewall won't do strict policy enforcement in premium internet links in china.

You can write to info.itzecurity@gmail.com for discussion.

Check with your sap application team to get all ip and port numbers. The profiles on end-user machines will have the fqdn or ip with port numbers

Yes

Zscaler won't save inspected data in storage, it's keep in memory for policy validation and then Wipeout.

Sure ,

@@ITZecurity please share your availability

@@malikkhan392 I will be available from 10 AM to 12PM tomorrow

@@ITZecurity I'm sharing meeting invitation. Please join it🤗

@@malikkhan392 sure.

Certain url will not work through zscaler as those server side restrictions and regulatory requirements as well to take consideration..

@@ITZecurity yes got your point. Will it be a security threat then as no inspection is done by zscaler?

@@1-minutetips109 yes , possibly, can find alternative options to route via zpa using sipa concept or route it through alternate pse or ask the remote server team to whitelist zscaler destinations..

Yes we can, if you want to do ssl interception from the source

@@ITZecurity what if we share zscaler root certificate from zia admin portal? On checking zscaler root certificate from portal and from public sources both are same. Could you please confirm once??

Certificate from portal for ssl interception. Which is mandatory to do ssl interception.

@@ITZecurity yes that's true My query is like we can download zscaler root certificate from admin portal and from public sources. Are they both same or is there any difference . On opening both certificates both looks similar.

No , see here the comparison. www.zscaler.com/pricing-and-plans

Here you go, help.zscaler.com/zpa/networking-deployed-connectors

Hi, your administrator will have the access to zscaler internet access portal and mobile portal. App profiles will be available in mobile portal. Your administrator can have controls.

No you can have nat devices to reach out zscaler cloud instead of public ip.

@@ITZecurity so it is a TLS communication between VSE and zscaler cloud. So the firewall should not do any SSL inspection on this traffic. Right?

That's right.

We can enforce user based policies throught vse as it's act as public service edge inside customer premise.

Verify the credentials

@@ITZecurity Ah no, it's even before i can enter them at all.

Ah OK. Something may missed in the configuration, let's try to capture debug logs fro fgt.

I don't have dumps, but definitely we can discuss about the solution.

Hi , pls contact on info.itzecurity@gmail.com or wa.me/qr/XJUPLLN4HHWKF1

You can look at the tunnel logs under web insights. Also tunnel status at your source end.

Check if you have permission.

@@ITZecurity I do have admin permission, but surprisingly next day it start working. Thanks for your reply

Do you have any contact number if I can reach you or email id.

Open in new tab

Support team can provision authentication domain on ZIA portal.

@@ITZecurity So, this video is ONLY discussing or describing making a connection "between" Azure Active Directory (AAD) and Zscaler ZIA? ... An important point to highlight because THESE DAYS many presenters, not just you, are 'jumping' back and forth between Open application windows, sometimes using <Alt>+<Tab> and they do not clearly explain, 'Okay, now I switch from...' and over into XZY console or application. Yes, it is possible to watch and re-watch a presentation and {hopefully} pick-up on the details of what is being shown but, it is more User-friendly to clearly state the "action" happening in the video directly -- as it happens. ~ Thank you very much for this important effort at User training.

Hi, thanks for your interest, sure will do. Could you please tell few topic you would like see in video?

Connect us on info.itzecurity@gmail.com for quick tech chat..

If you are using ZCC, the pac files will be bonded on app profile and forwarding profiles. The Forwarding profile pac file will be act as system proxy as this profile is responsible for route the traffic Fromm browser or apps to zcc.

When you are using ZCC, app profile pac is used for forward traffic to the service edge. Forward profile pac used for send the traffic to ZCC from your apps. Not required GPO or SCCM push. Will happen automatically...

You may reach out info.itzecurity@gmail.com for quick tech chat..

Recommended is GRE + ZCC/PAC files. If not you can go ahead with IPSec+ ZCC/ PAC. ZCC can use for corporate laptop users and pac file for servers ..

config user group edit FortiGateAccess set member azure config match edit 1 set server-name azure set group-name <Object Id> next end next end This configuration will map azure group in to fortigate group. Map those groups in each profiles. I am sure about the first question, will check and update here.

Thanks for your comments. Let me know your specific topic to learn , I will work on it. Or we can have one to one discussion through info.itzecurity@gmail.com

@@ITZecurity sure. Thank you

Here you go, help.zscaler.com/zpa/connector-deployment-guide-centos-oracle-and-redhat Look at Step 3: Deploy the App Connector on CentOS, Oracle, or Redhat To deploy an App Connector, you need to download the RPM package on the App Connector you're deploying. However, in some cases, the App Connector might be unable to download the package, and you'll have to download it on a server instead. Choose one of the following deployment options depending on your situation. Downloading the RPM package on the App Connector Downloading the RPM package on a Server

Proxy IP will assigned by you as per your ip schema on your enterprises,

Sure, will do ,thanks.

On the portal itself , under administration ---virtual service edges

You can download from portal ZIA itself.