ZCC
acronymcloudsecurity
Zscaler Client Connector: the endpoint agent that authenticates the user, classifies the network state, and forwards traffic per its forwarding profile.
Two documents rule it: forwarding profile (plumbing) and app profile (platform policy).
Zscaler Client Connector is the agent that decides, on the endpoint, what happens to each packet before anything else can. That decision is driven by forwarding profiles, which key on where the device is: on a trusted network, on a VPN, or off-network entirely, with separate behaviour configured for the internet service and the private access service.
The tunnel choice underneath matters more than it looks. Z-Tunnel 1.0 forwards proxy-aware traffic using CONNECT requests, much like a traditional proxy, which is fine for ordinary web traffic and blind to everything else. Z-Tunnel 2.0 carries all endpoint traffic over DTLS or TLS regardless of port or protocol, which is what makes non-web traffic inspectable. On Windows there is a further choice between a route-based virtual adapter and a filter driver that captures traffic without creating one, and the filter driver interoperates far better with other VPN clients.
This is why most user-reported problems are really forwarding-profile problems. A device that thinks it is on a trusted network behaves completely differently from one that does not, and captive portals, unexpected trusted-network detection, and the wrong tunnel version account for a large share of tickets that first look like cloud outages.
Also known as: zscaler client connector