Category ✅

URL category overrides are not instant and they lose to a more specific URL policy. Check policy order, location scope, and the user cloud cache. Techclick CLI lab: symptoms, commands, traps, and proof.

ZIA bandwidth classes can throttle a URL category independently of the WAN. Check the class hit in Web/Cloud App logs before you call the ISP. Techclick CLI lab: symptoms, commands, traps, and proof.

Read ZSAUpm / ZCC logs for the module that fails hash or service start. Roll back that module or repair the service, do not keep pushing the same package. Techclick CLI lab: symptoms, commands, traps, and proof.

ZPA only intercepts names you publish. Add the FQDN or the DNS search suffix to the application segment and the client forwarding profile. Techclick CLI lab: symptoms, commands, traps, and proof.

Server groups are defined by IP, FQDN, or dynamic discovery. After a subnet change, discovery still looks at the old range. Update the group, then verify from the connector. Techclick CLI lab: symptoms, commands, traps, and proof.

Z-Tunnel 1.0 is HTTP/S proxy-ish. Z-Tunnel 2.0 can carry more than TCP 80/443. If the app is UDP or a non-standard port, 1.0 will silently fail. Techclick CLI lab: symptoms, commands, traps, and proof.

Location is derived from the GRE/IPSec source IP or from the Client Connector. If the source IP is not in a location object, ZIA treats the traffic as unknown. Techclick CLI lab: symptoms, commands, traps, and proof.

This is almost never a corrupt client. It is PAC pointing at the wrong cloud, a stale IdP cookie, or ZCC listening on the wrong loopback port. Techclick CLI lab: symptoms, commands, traps, and proof.

Exempt that URL or category from SSL inspection. Do not turn off inspect for the location. Confirm the user actually trusts the Zscaler root. Techclick CLI lab: symptoms, commands, traps, and proof.

Pull the transaction ID, see which dictionary and rule hit, then tune the dictionary or add a file-type exception. Do not disable the DLP rule. Techclick CLI lab: symptoms, commands, traps, and proof.

On the connector host, read zpa-connector logs, then DNS to the control plane, then the health of the published app port. Yellow is usually DNS, time, or the app port — not the ZPA cloud. Techclick CLI lab: symptoms, commands, traps, and proof.

Prove GRE from the router: source public IP, destination ZIA VIP, proto 47 allowed, and keepalive. Most 'Zscaler down' tickets are a NAT or ACL on the router. Techclick CLI lab: symptoms, commands, traps, and proof.

The connector says authenticated but traffic still goes direct. Work the four layers in order - authentication, PAC, tunnel mode, then forwarding profile - and you find it in minutes instead of hours.