ZIA Bandwidth Control Drops One SaaS: Classes, Not the Circuit

Zscaler · Techclick CLI troubleshooting lab

Zoom is unusable at 11:00. Speedtest is fine. The branch circuit is 200 Mbps.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Zscaler for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

ZIA bandwidth classes can throttle a URL category independently of the WAN. Check the class hit in Web/Cloud App logs before you call the ISP.

Why this ticket shows up

A well-meaning 'limit streaming' class sometimes includes conferencing or updates. Speedtest is not in that class, so the circuit looks healthy.

Symptoms operators actually see

• One SaaS is poor, speedtest is great

• Happens at the same hour

• Bandwidth class counter is high

• Other branches without the class are fine

CLI first — copy this block

Run these on the Zscaler device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

# laptop
tracert -d 8.8.8.8
ping zoom.us
nslookup zoom.us
# then read ZIA Cloud App / Bandwidth class for that user and time

How to read that output

If traceroute is clean and only the classified app is poor, it is a ZIA class, not last-mile. The log line names the class.

Triage order

1. Confirm the WAN with a speedtest and a traceroute.

2. Find the user's Cloud App log at the failure time.

3. Note the bandwidth class and rate.

4. Move conferencing out of the streaming class.

5. Retest a call at the same hour.

Classic traps

What you see	Real cause	Fix
Upgrade the circuit	Class is 2 Mbps for the app	Fix the class
Disable ZCC	GRE path has the same class	It will still throttle
Blame Zoom	Other sites are fine	Read the class

Proof the ticket is closed

• Call MOS/quality returns

• Class no longer includes conferencing

• Circuit utilization unchanged

Say this in an interview

A healthy speedtest plus a dying SaaS is bandwidth classification until the log says otherwise.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/