top of page

ZCC Z-Tunnel 2.0 vs 1.0: Which One Is Dropping Your SaaS

  • 3 days ago
  • 2 min read
Zscaler network security troubleshooting lab
Zscaler · Techclick CLI troubleshooting lab
Outlook works. A UDP-heavy SaaS voice app dies only when ZCC is on. Disabling ZCC fixes it.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on Zscaler for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

Z-Tunnel 1.0 is HTTP/S proxy-ish. Z-Tunnel 2.0 can carry more than TCP 80/443. If the app is UDP or a non-standard port, 1.0 will silently fail.

Why this ticket shows up

Many tenants still have a mix of tunnel versions. A user on 1.0 cannot send the packets the SaaS needs.

Symptoms operators actually see

  • TCP 443 apps work, UDP or high ports fail

  • Only some laptop images fail

  • ZCC about page shows Tunnel 1.0

  • Works on a colleague with 2.0

CLI first — copy this block

Run these on the Zscaler device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

# Windows
reg query HKLM\SOFTWARE\Zscaler
powershell -c "Get-NetTCPConnection -OwningProcess (Get-Process ZSATunnel).Id"
findstr /i "Tunnel Version Z-Tunnel" %ProgramData%\Zscaler\*.log

How to read that output

Read the tunnel version from the ZCC log or UI. If it is 1.0 and the app is not HTTP, you found the design limit, not a random bug.

Triage order

  1. Confirm the app protocol (UDP? custom port?).

  2. Read tunnel version on a working and a failing laptop.

  3. Move the failing user to a 2.0 forwarding profile.

  4. Bypass the app only if 2.0 is not approved yet.

  5. Do not disable ZCC as the permanent fix.

Classic traps

What you see

Real cause

Fix

Disable ZCC

User is on Tunnel 1.0

Upgrade forwarding profile

Open a Zscaler SEV1

This is expected 1.0 behavior

Change the profile

Reinstall Office

The failing app is UDP voice

Wrong layer

Proof the ticket is closed

  • About page shows Z-Tunnel 2.0

  • Voice app works with ZCC on

  • ZIA or ZPA still sees the user

Say this in an interview

I ask which Z-Tunnel version the laptop is on before I debug a non-HTTP app through ZCC.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments


bottom of page