top of page
Search

ZIA Location Unknown: Traffic Leaves the Branch but ZIA Does Not Know the Site

  • 5 days ago
  • 2 min read
Zscaler network security troubleshooting lab
Zscaler · Techclick CLI troubleshooting lab
Users are on the office LAN. ZIA logs show location unknown and the guest policy. The GRE tunnel looks up.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on Zscaler for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

Location is derived from the GRE/IPSec source IP or from the Client Connector. If the source IP is not in a location object, ZIA treats the traffic as unknown.

Why this ticket shows up

ZIA locations are just public IPs plus tunnel IDs. A second circuit, a backup NAT, or a missed IP in the location object sends production traffic into the unknown bucket.

Symptoms operators actually see

  • Location field is unknown or road-warrior

  • Office users get guest SSL policy

  • Tunnel is up

  • A second public IP was added last week

CLI first — copy this block

Run these on the Zscaler device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show ip nat statistics
show ip route | include 0.0.0.0
curl -4 ifconfig.me
show crypto session remote <zia-vip>
show interfaces tunnel 10 | include Internet address

How to read that output

The IP that ZIA sees must exist on the location. curl ifconfig.me from the router should match the location object. A second NAT pool that is not listed will classify as unknown.

Triage order

  1. Discover the public IP ZIA actually sees.

  2. Compare it to every IP on the location.

  3. Add the missing IP or fix NAT so only the registered IP exits.

  4. Retest and confirm the location name in Web logs.

  5. Document backup circuits on the same location.

Classic traps

What you see

Real cause

Fix

Rebuild GRE

Backup NAT IP is unlisted

Add the IP

Change PAC

This path is tunnel, not PAC

Fix the location

Enroll every user in ZCC

Office path is GRE

Location IP is enough

Proof the ticket is closed

  • Web log shows the office location name

  • Office SSL policy applies

  • Unknown volume drops

Say this in an interview

Unknown location means ZIA does not recognize the source IP. I match NAT to the location object before I touch policy.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments

bottom of page