ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021

Process_StudentGuide_6.1_v1.0

Slide 1 - Troubleshooting ZIA

Slide notes

Welcome to this training module on the process for troubleshooting Zscaler Internet Access (ZIA).

Page 1 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 2 - Navigating the eLearning Module

Slide notes

Here is a quick guide to navigating this module. There are various controls for playback including play and pause,
previous, and next slide.

You can also mute the audio or enable Closed Captioning which will cause a transcript of the module to be displayed on
the screen. Finally, you can click the X button at the top to exit.

Page 2 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 3 - Module Agenda

Slide notes

In this module we look at the process for troubleshooting internet connectivity through Zscaler, and at the information
that is required in order to open a support ticket.

Page 3 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 4 - Troubleshooting Process

Slide notes

In the first section, we will discuss an approach to troubleshooting internet connectivity through Zscaler.

Page 4 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 5 - Troubleshooting Process

Slide notes

The first step in troubleshooting any connectivity issue, is to identify as far as possible precisely where the connection is
failing, and who is impacted by the failure. With an Internet Access connection through Zscaler, an issue can occur in one
of a number of places: On the end user’s device; on the local network; between the end user’s location Firewall and
Zscaler; between the end user and Zscaler (if they are connecting directly);

between the end user and the Identity Provider (IdP); between the IdP and Zscaler; between Zscaler and The Internet; or
with the destination service. Your goal here is to home in as quickly as possible to the ‘failure domain’, to allow you to
focus your troubleshooting efforts on the actual problem area.

Page 5 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Many standard networking tools, and some specialized Zscaler tools are available to assist in this process, such as: a
simple ‘ping’ to the destination service; a ‘traceroute’ to the destination service; the Zscaler Proxy Test Website; or even
the Zscaler Analysis Tool.

Page 6 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 6 - Troubleshooting Process

Slide notes

Having localized the problem, the next stage is to isolate precisely what logical process is failing, to allow you to identify
a solution to the problem: Are there network connectivity problems in general? Is there a connection issue between
specific infrastructure entities? Is there some form of misconfiguration, either of the network connections, or of a Zscaler
Policy?

Page 7 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 7 - Troubleshooting Process

Slide notes

Having localized and isolated the problem, you then need to come up with a solution to it, which is best done using a
troubleshooting cycle such as the one shown here.

To start the cycle, you must leverage your knowledge and experience as a network or support engineer to form a theory
as to what problem might cause the symptom(s) that you are seeing.

Having come up with a theory, you then need to figure out the best way to test your theory, …what can you change or
re-configure which (according to your theory) should fix the issue.

Page 8 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Then you can go ahead and test your theory, at which point there could be two possible outcomes:

• First, your theory proved to be correct, and connectivity has been restored for the end user. This means that you
have fixed the problem, or at least a problem, and you can step out of the troubleshooting cycle (for now).

• Alternatively, your theory is proved to be incorrect, at which point you need to reverse any configuration
changes that you made during your tests, and come up with a new theory.

Page 9 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 8 - Troubleshooting Process

Slide notes

There are only so many theories that any engineer can come up with, and if you run out of ideas you will need to consult
more experienced colleagues, who may well have seen the problem before, or can at least bring a fresh set of eyes to the
problem.

Page 10 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 9 - L1 Suggested Troubleshooting Flow

Slide notes

Here is a suggested flow diagram for Level 1 support engineers troubleshooting connectivity issues through Zscaler.

The very first thing to check, is whether or not the end user is actually going through Zscaler. This can be done using the
Zscaler Proxy Test Website.

If not, then you may need to troubleshoot some local, or intermediate network connectivity issues.

Page 11 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

If the Zscaler Client Connector is required for connectivity…

…you may need to verify that it is installed correctly on the end user’s client device.

Page 12 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 10 - L1 Suggested Troubleshooting Flow

Slide notes

If the Proxy Test shows that the end user is connecting through Zscaler, the next process to troubleshoot is end user
authentication, if it is required.

Check to see whether the end user can actually authenticate, …

…and if, not check the end user’s account to make sure it is still valid. Bear in mind that there may be other problems
that prevent a successful authentication, such as the end user not being able to reach the IdP.

Page 13 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 11 - L1 Suggested Troubleshooting Flow

Slide notes

If the end user can actually authenticate, or if authentication is not required at all and the user still has problems
accessing a site or the Internet in general, check to see whether some Zscaler policy is blocking the user. This may be a
legitimate block, if the requested site has been deemed dangerous or inappropriate, or it may be a ‘false positive’ that
requires management and re-configuration.

Page 14 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 12 - L1 Suggested Troubleshooting Flow

Slide notes

Having identified and corrected any problems during this process, re-test connectivity to see whether the end user can
now connect to the site, or to The Internet. If so, then the problem may have been solved.

Page 15 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 13 - L1 Suggested Troubleshooting Flow

Slide notes

If at any point in this flow you run out of ideas, or things to test, you probably need to escalate the issue to a support
engineer at the next Level.

Page 16 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 14 - Information Required to Open a Ticket

Slide notes

In the final section, we will have a look at the information that you require in order to raise a support case to Zscaler.

Page 17 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 15 - Information Required for a Zscaler Support Ticket

Slide notes

There is a certain minimum of information that is required in order to open a ZIA support ticket with Zscaler, so it is a
good idea to start collecting this data early in the troubleshooting process.

We will of course, need to know who the customer is that is raising the ticket, and the full details of the contact at the
customer or partner responsible for managing the ticket, including their time zone. Also, the type of customer, whether
a current ZIA customer, or whether the customer is a prospect, or working on a Proof of Concept (POC).

‘Ticket Overview’ information that will be required, include:

Page 18 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Issue Subject: A summary of the problem with main symptom and scope. This is a free text field, and should be as
concise as possible, but at the same time give a complete indication of the nature of the problem.

Description: A detailed description of the problem. This is a free text field that allows you to fully explain the nature of
the problem, the symptoms, where and when the problem occurs, what process you suspect is at fault, and what steps
you have taken to identify the problem, or corrective actions that you have taken with no success.

Ticket Type: Select from the available types; ‘Problem’, ‘Question’, ‘Categorization’, or ‘Provisioning’. See the Support
Overview module for what each of these types denote.

Ticket Priority: Select from the available priorities; ‘Urgent’, ‘High’, ‘Medium’, or ‘Low’. See the Support Overview
module for what each of these priorities denote.

Page 19 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 16 - Information Required for a Zscaler Support Ticket

Slide notes

We always need to know the traffic forwarding method in use for the end user, whether traffic forwarding is transparent
to them (using some form of tunnel), or whether there is some form of explicit configuration (a PAC file applied, or the
Zscaler Client Connector). We will need to know which of the Zscaler Clouds the customer is provisioned on, and the
data centers used by them.

This information can be found from the host names of the ZIA Public Service Edges that the end users connect through,
from the data provided at the Proxy Test Website page. We also need to know when the problem started, whether it is an
on-going issue, or if it has stopped, when did it stop.

Page 20 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 17 - Information Required for a Zscaler Support Ticket

Slide notes

We need to understand the scope of the issue, whether it is permanent or intermittent, whether it applies to all sites,
users, data centers, destinations, or apps. Useful information would include what you think to be the trigger criteria for
the issue, whether there has been recent a change in conditions or configurations that might have a bearing. We need to
know if there is a work-around in place, and if so, what that is.

Finally, you have the ability to upload any data that may help us to troubleshoot the problem, such as: screenshots of
the Zscaler Proxy Test Website data; the output from the Zscaler Cloud Performance Test, or Analyzer tool; Log files from
any related systems, for example - firewall systems, routers, Zscaler Client Connector, or servers.

Page 21 of 22
ZCTA-IA_Zscaler-Troubleshooting- Monday, April 05, 2021
Process_StudentGuide_6.1_v1.0

Slide 18 - Thank you & Quiz

Slide notes

Thank you for following this training module on the process of troubleshooting Zscaler Internet Access. We hope this
module has been useful to you and thank you for your time.

What follows is a short quiz to test your knowledge of the material presented during this module. You may retake the
quiz as many times as necessary in order to pass.

Page 22 of 22