Z-Tunnel
termcloudnetworking
Client Connector's transport to a Service Edge: 1.0 is an HTTP CONNECT tunnel shaped for web; 2.0 speaks TLS/DTLS and carries all ports and protocols.
New deployments steer to 2.0 - the all-traffic device tunnel.
Z-Tunnel is the transport a Zscaler client uses to reach a service edge, and the version in use determines what can be inspected at all. Version 1.0 forwards proxy-aware traffic using CONNECT requests, in the manner of a traditional proxy, which handles ordinary web browsing and is simply blind to everything else on the device.
Version 2.0 changes the scope rather than the encryption. It carries all endpoint traffic over DTLS, falling back to TLS where UDP is blocked, regardless of port or protocol, which is what makes non-web traffic subject to policy. That is the actual reason to migrate: not speed, but coverage of the traffic that was previously invisible.
The practical consequences show up as support tickets. An application that worked before a migration and fails afterwards is usually one that was never being inspected and now is. A network that blocks the UDP the tunnel prefers forces a fallback that behaves differently under load. And on Windows the choice between a route-based virtual adapter and a filter driver interacts with any other VPN client on the machine, which is why that setting appears in so many escalations that first look like cloud problems.