Since the user is connected via ZPA, the issue is specific to the private access path, not general internet access (ZIA). The most logical step is to verify the ZPA configuration itself, starting with the Application Segment, which defines the private application and its connectivity rules. Ensuring the segment is correctly configured and the designated App Connector Group is healthy is the core troubleshooting step for ZPA application access problems.

Zscaler Private Access (ZPA) is the component designed specifically for providing secure, policy-based access to internal applications without placing users on the corporate network. It creates micro-tunnels directly to authorized applications (like the internal web server) based on identity and context, perfectly enforcing the ‘least privilege’ principle required for contractors.

The Zscaler Client Connector performs posture checks to ensure a device meets security standards (like having antivirus enabled, disk encryption, etc.). If these checks fail, the connector can enforce policy actions. A common policy is to block access to private applications via ZPA while still allowing general internet access via ZIA (which might use a less strict policy). Therefore, the most direct impact is the loss of ZPA access.

For network infrastructure like data centers, branch offices, or cloud VPCs that cannot run the Client Connector software, traffic is routed via static IPsec or GRE tunnels to the Zscaler cloud. IPSec is a common, secure tunneling protocol for this purpose. GRE Tunnel is also an option, but IPSec provides encryption. PAC files and the Client Connector are for user endpoints.

The Bandwidth Control feature in ZIA allows administrators to prioritize, guarantee, or limit bandwidth for specific applications (like video conferencing), users, or locations. By creating a policy to guarantee minimum bandwidth for the video call application, you can directly address the quality-of-service issue without affecting security inspection.

Zscaler Digital Experience (ZDX) is specifically designed for monitoring and measuring the digital experience of users from their devices to applications. It provides visibility into performance metrics (latency, packet loss, app response time) and can proactively alert on degradation, allowing IT to troubleshoot issues before they significantly impact productivity.

To control access based on website type (social media) and user identity, you use the URL Filtering module. This requires: 1) Selecting the correct ‘URL Category’ (e.g., ‘Social Networking’), and 2) Setting the ‘Users/Groups’ field to target the ‘Interns’ group with a BLOCK action and the ‘Marketing’ group with an ALLOW action (order of rules matters).

The Cloud App Discovery report (part of Cloud App Control) analyzes traffic logs to identify and categorize thousands of cloud applications in use across the organization. It classifies them as Sanctioned, Tolerated, or Unsanctioned, providing the critical visibility into ‘shadow IT’ that the security team needs for risk assessment.

The App Connector is a software component installed in a network segment (e.g., data center, cloud VPC) that can reach the private applications. It initiates outbound connections to the Zscaler cloud, registers itself, and then brokers secure, micro-tunneled connections from authorized ZPA users directly to the specific applications it serves, without exposing the network.

Since the user is connected via ZPA, the issue is specific to the private access path, not general internet access (ZIA). The most logical step is to verify the ZPA configuration itself, starting with the Application Segment, which defines the private application and its connectivity rules. Ensuring the segment is correctly configured and the designated App Connector Group is healthy is the core troubleshooting step for ZPA application access problems.0