vendor hub
Zscaler
Everything on ronutz.com for Zscaler, through one door: its tools, grouped by family, and its articles, and where they exist its certification guides, a reading path, the career chapter, the industry record and the lineage. Tools compute locally in your browser; articles are grounded in vendor documentation.
Working with Zscaler →
The career chapter: what the work with Zscaler actually was, which accounts, which escalations, and what it certified.
The Zscaler story in the industry section →
How Zscaler got here: the acquisitions, the pivots, and the people whose work ended up inside the platform.
Zscaler lineage →
What Zscaler is made of, and who made it. Every acquisition below is verified against primary sources, with the product line it turned into where that connection is documented rather than inferred.
Certification prep
Tools (10)
Zscaler Zero Trust Exchange
ZCC forwarding decision explainer
Paste a Client Connector posture (network state, ZIA action, tunnel version) and read the documented forwarding spine back layer by layer - with the bypass mechanisms explained, and the reason this is an explainer rather than a simulator stated up front.
NätverkZDX score factor explainer
Paste the metrics ZDX exposes and read back what each one is: probe family, documented meaning, the score against the documented Poor band, and the honesty notes on what Zscaler does not publish.
NätverkZIA firewall rule-order simulator
Paste a Firewall Filtering rule list and an optional flow: watch ascending-order, first-match evaluation execute, see which rule (or the deny-by-default Default rule) decides, and get pairwise shadow findings naming the rules that can never fire.
Security & WAFZIA SSL Bypass Planner
Paste an asset list and get a deterministic TLS inspection plan: what inspects, what gets a Do Not Inspect rule, what needs a Client Connector bypass - each with sourced rationale, a blind-spot ledger, and the backstop checklist.
Security & WAFZscaler Tunnel Chooser
Answer six questions about a location - bandwidth, HA, static IP, encryption, GRE support, endpoint NAT - and get the deterministic GRE-vs-IPsec recommendation with the minimum tunnel count, computed from Zscaler's own published figures, every step shown.
Nätverk
TLS fingerprints
HTTP header-order fingerprint
Paste a request header block and see how header order and casing fingerprint the client - the passive-HTTP analog of JA3.
Security & WAFJA3 / JA3N passive TLS fingerprint
Paste a JA3 string and it recomputes the JA3 hash, computes the permutation-stable JA3N, decodes the fields, and flags GREASE values.
Security & WAFJA4 / JA3 TLS fingerprint decoder
Decode a JA4 TLS client fingerprint or a JA3 fingerprint into its fields, compute the hashed JA4 from raw values, or compute a JA3 MD5. It auto-detects which you paste. All in your browser.
Security & WAFp0f passive TCP/IP signature explainer
Decode a p0f v3 SYN fingerprint into its eight fields and see what each reveals about the sender's OS, network path, and stack.
NätverkUser-Agent entropy analyzer
Paste a User-Agent string and see the identifying tokens it exposes, the distinguishing bits each contributes, and the Client Hints migration.
Security & WAF
Articles (29)
Zscaler Zero Trust Exchange
Client Connector Profiles: Where the Endpoint Decides How to Forward
Zscaler Client Connector's behavior is two documents deep: the forwarding profile decides how traffic leaves the device in each network state, and the app profile decides platform policy - bypasses, PAC files, certificates. The three network states, the trusted-network criteria that switch between them, why DNS beats hostname resolution for detection, and the bypass mechanics that keep VPNs and pinned apps alive.
Security & WAFReadFive SSE Vendors, One Decision, Five Different Answers
Every secure service edge has to answer the same question: does this flow pass. Zscaler, Netskope, F5 Distributed Cloud, FortiSASE and Prisma Access answer it with genuinely different machinery, and the differences are where migrations go wrong.
Security & WAFReadGetting Traffic to ZIA: The Forwarding Decision
A cloud proxy only protects what reaches it, so every ZIA design starts with the same question: how does traffic get there? The four working answers - Client Connector on the device, tunnels from the location, PAC files steering browsers, and proxy chaining from an existing edge - what each one covers, what each one misses, and how real deployments layer them.
NätverkReadGRE Tunnels: The Simplest Envelope in Networking
Generic Routing Encapsulation puts one packet inside another and asks nothing else of the path - no encryption, no authentication, just an envelope with a forwarding address. Why that simplicity is the point: the 24-byte anatomy, what GRE can carry that plain routing cannot, the keepalive question, and the trade a designer accepts when choosing GRE over an encrypted tunnel.
NätverkReadIPsec and IKE: How Encrypted Tunnels Negotiate Themselves
IPsec is two jobs in one suite: IKE negotiates who you are and which keys to use; ESP carries the protected packets. IKEv1 versus IKEv2, what a security association actually is, tunnel versus transport mode, why NAT almost broke everything until NAT-T, and why encryption always costs throughput - with a live worked example of the capacity math.
NätverkReadLocations and Sublocations: Teaching the Cloud Where Your Sites Are
A ZIA location is a site the platform recognizes - by its tunnels or its egress addresses - and the recognition is what unlocks per-site policy, authentication expectations, and bandwidth control. Sublocations subdivide a site by internal network segment: the guest Wi-Fi policed differently from the corporate floor, the servers differently from both. The Gateway Options toggles, the three documented bandwidth modes, and why egress identification is the whole game.
NätverkReadThe ZDX Score: What the Probes Measure and How the Number Is Made
Zscaler Digital Experience turns user experience into a 1-100 score, and the anatomy is precise: Web Probes measuring Page Fetch Time, DNS Time, Server Response Time, and Availability; CloudPath probes measuring the network path hop by hop; probes every five minutes; the lowest score of the hour becoming the hour's score; group scores averaging each user's worst. What each metric means, the Poor band's automatic root-cause analysis, and what Zscaler does not publish about the formula.
NätverkReadThe Zscaler Zero Trust Exchange: A Proxy Where the Perimeter Used to Be
Zscaler's platform is not a firewall in the cloud - it is a globally distributed proxy that terminates every connection, inspects what it can see, and only then connects onward. Where ZIA, ZPA, and ZDX sit on that switchboard, what a Public Service Edge actually does, and why connect-to-app-not-network is the architectural sentence that explains everything else.
Security & WAFReadTLS Inspection in ZIA: The Policy, the Bypasses, and the Bill
ZIA's TLS inspection is the forward-proxy interception pattern run as policy: rules evaluated in ascending order decide Inspect or Do Not Inspect, a Zscaler or customer CA signs the regenerated certificates, and every bypass is a deliberate blind spot. The rule anatomy, the untrusted-certificate and minimum-TLS backstops, why pinned applications must be exempted, and what an uninspected flow still costs.
Security & WAFReadTunnel Overhead, MTU, and MSS: The Byte Math Every Tunnel Owes
Every tunnel adds bytes, every path has a ceiling, and the difference between the two is where mysterious slowness lives. The overhead each encapsulation charges, why fragmentation is the worst of the three escapes, how Path MTU Discovery is supposed to work and how firewalls break it, and MSS clamping - the one-line fix that makes TCP fit on the first try.
NätverkReadTwenty questions to ask before signing a SASE proposal
A SASE proposal is a purchasing arrangement wrapped around several products, usually on a multi-year subscription, usually with a discount that expires soon. The questions that decide whether it fits are rarely about features. They are about where traffic goes, what the team loses sight of, what happens when the single path fails, what the exit looks like, and what the price does in year two. Twenty of them, grouped so a steering committee can put them to the supplier in writing before the discount does its work.
Operations & FieldcraftReadURL Filtering and Cloud App Control: Two Policies, One Precedence Rule
ZIA controls web access with two cooperating policies: URL Filtering judges destinations by category, Cloud App Control judges applications by identity and activity - and by default the app policy wins. The Allow/Caution/Block verbs with quotas, the Facebook precedence example straight from the documentation, the Allow Cascading toggle, and why uninspected TLS caps what either policy can see.
Security & WAFReadZIA Cloud Firewall: Rule Order Is the Whole Ballgame
The Firewall Filtering policy is a first-match machine: rules evaluated in ascending order, evaluation stops at the first hit, and the undeletable default rule at the bottom blocks everything that fell through. The rule anatomy, the any-means-ignored criteria convention, disabled rules that keep their seat, the recommended-policy pattern, and the shadowing failure that order makes possible.
Security & WAFReadZIA Log Fields: The Vocabulary Investigations Are Written In
A ZIA log feed is a template of fields you choose - %s{login}, %s{csip}, %s{action} - and knowing which field carries what is the difference between a log and an answer. The web-versus-firewall division of labor, the obfuscation-prefix fields that pseudonymize identity, the hex-encoding rule that keeps hostile URLs parseable, and the Standard-tier subtlety where allowed sessions log in aggregate while blocks log per session.
Security & WAFReadZscaler Tunnel Types: Z-Tunnel, GRE, and IPsec, With the Numbers
Three tunnels carry traffic to the Zero Trust Exchange, and they are not interchangeable: the Client Connector's Z-Tunnel for devices, GRE and IPsec for locations. The published capacity figures - 1 Gbps, the 250 Mbps NAT penalty, 400 Mbps per source IP - the scale-out shapes the documentation itself uses, the HA pattern, and the MTU habit that keeps all three healthy.
NätverkRead
More
CASB in the Exchange: Inline, Out-of-Band, and the Posture of SaaS Itself
Zscaler's CASB is not a separate box but two vantage points on the same policy brain: inline, riding the ZIA proxy over data in motion, and out-of-band, connecting to SaaS tenants by API to scan data at rest. What each plane sees that the other cannot, shadow-IT discovery, SSPM's configuration-against-frameworks audit, and why the DLP engines you tuned once enforce in both planes.
Security & WAFReadFile Type Control and Cloud Sandbox: The Download's Two Judges
A file entering or leaving through ZIA answers to two judges: File Type Control rules on what kinds of files may move at all, and the Cloud Sandbox on what never-seen files actually do. The cloud-wide hash denylist that makes one detonation everyone's immunity, the First-Time Action decision that trades user patience against patient zero, and what the Advanced tier widens.
Security & WAFReadMergers and Acquisitions on the Exchange: Day-One Access Without Merging Networks
The M&A integration scenario is where zero trust earns its architecture: ZPA grants the acquired company's people day-one access to named applications without joining networks, overlapping RFC 1918 space stops being a blocker because connectors resolve locally on each side, identity merges in phases behind SAML and SCIM, and forwarding migrates location by location. The order of operations, and why the network merge can wait indefinitely.
NätverkReadNanolog, NSS, Cloud NSS, and LSS: Getting the Logs Out
Zscaler's logs live in the cloud-side Nanolog; three delivery paths bring them home: the NSS virtual machine streaming compressed logs over mTLS to your SIEM, Cloud NSS posting batches straight to a SIEM's HTTPS API, and ZPA's Log Streaming Service delivering private-access logs through your App Connectors. The VM's two-core anatomy, the feed limits, the HTTP status semantics where a 400 drops the batch, and the one exclusion rule that keeps the pipeline from eating itself.
NätverkReadPosture and Device Trust: Letting the Device's State Vote
Identity says who is asking; posture says what they are asking from. In the Zscaler platform the Client Connector evaluates device conditions, ZPA consumes them as posture profiles in access policy criteria, and ZIA consumes device trust levels in its own rules - one sensor, two policy planes. How the vote works per session, why posture criteria are conjunctive with identity, and the honest limits of asking a device about itself.
Security & WAFReadReports and Executive Summaries: Turning the Nanolog Into Sentences Leadership Reads
Between the raw log stream and the board slide sits ZIA's reporting layer: interactive reports for the analyst's follow-the-thread loop, scheduled reports for the calendar, dashboards for the wall, and the executive-summary shape for leadership. What each form is for, why usage-over-time questions belong to reports rather than log greps, and the honest boundary where reporting ends and the SIEM begins.
Security & WAFReadThe Administrator Audit Log: Who Changed What, From Where, With What Outcome
ZIA records every admin action - console and API alike - as an audit record with a precise anatomy: timestamp, action, category and sub-category, resource, admin, client IP, interface, result, and a before/after diff. The five-failures-in-a-minute lockout that writes itself into the log, the six-month retention window, how the trail streams to a SIEM, and how to read it for privilege escalation.
Security & WAFReadThe Exfiltration Alert: A Walkthrough From Signal to Posture Answer
A suspected data-exfiltration alert is the scenario where the whole Zscaler series converges: read the alert against the log fields, establish what inspection could actually see, walk the DLP and CASB planes for what left and what rests exposed, check the firewall's non-web corridors, and answer with posture changes - isolation for the gray, tightened bypasses, byte-count vigilance - rather than a single heroic block.
Security & WAFReadTroubleshooting Client Connector: The Diagnostics Menu and the First Four Checks
When a user 'can't get online through Zscaler,' the Client Connector carries its own toolkit: the connection states, Export Logs, admin-enabled packet capture, Restart Service, and the session-scoped Log Mode. The ip.zscaler.com verification, the generate_204 captive-portal probe, the synthetic 100.64.0.0/16 range that Private Access addresses applications from, the DTLS-throttling signature that a switch to TLS cures, and the discipline of localizing before fixing.
NätverkReadUpdates and Change Management: Running Change on a Platform That Also Changes Itself
A cloud security platform has three change streams - the vendor's cloud, your agent fleet, and your policy - and only the last two take your orders. What the admin actually governs: the Client Connector's Update Settings and per-year release summaries for the fleet, the audit log as the policy change record, and the ringed-rollout and change-freeze disciplines that are operator practice layered on the documented controls, stated as such.
Security & WAFReadZIA Data Loss Prevention: Dictionaries, Engines, and the Fingerprint Tiers
Zscaler's inline DLP is the fundamentals' four instruments assembled into a hierarchy: dictionaries with confidence and proximity dials, engines combining dictionaries through boolean expressions, and rules aiming engines at traffic - with EDM and IDM as the Advanced-suite fingerprint tiers, indexed on your side via the Index Tool. The rule criteria, the AND-logic subtlety, OCR for images, and the inspection prerequisite under it all.
Security & WAFReadZPA Access Troubleshooting: Policy, Health, or DNS - Pick the Right Suspect
An intermittent private-app failure has exactly three suspect families in ZPA's geometry: the policy said no, the delivery legs are unhealthy, or the connector cannot resolve or reach the server. How to split them fast - the deny-versus-broken distinction, connector health and DNS as the usual intermittency culprits, the segment-bypass traps that masquerade as outages, and where the diagnostics actually live.
NätverkReadZPA App Segments and Access Policy: Naming Applications, Then Earning Them
ZPA's control plane is a four-tier vocabulary - App Segments naming applications, Segment Groups bundling them for policy, Server Groups binding them to App Connector groups - and an Access Policy that denies by default, evaluates top-down first-match on the most specific segment, and gates every allow on criteria from SAML attributes to posture. The bypass precedence rule, the IdP-domain caveat, and the block-above-allow doctrine.
Security & WAFReadZPA Architecture: Two Outbound Calls and a Broker in the Middle
Zscaler Private Access exposes nothing: the user dials out, an App Connector beside the application dials out, and a Service Edge stitches the two into a per-application Microtunnel. The components - App Connectors, Public and Private Service Edges, the Central Authority - the inside-out TLS model that makes apps invisible, and why the broker never inspects the data it carries.
Security & WAFRead