ZPA Server Group Empty: App Discovers Nothing After a Subnet Change

Zscaler · Techclick CLI troubleshooting lab

Application segment used to work. After a DC move, the server group is empty and users get no healthy targets.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Zscaler for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Server groups are defined by IP, FQDN, or dynamic discovery. After a subnet change, discovery still looks at the old range. Update the group, then verify from the connector.

Why this ticket shows up

ZPA does not magically follow a VM to a new subnet. The connector health-checks whatever you configured last quarter.

Symptoms operators actually see

• Server group member count 0

• App Connector green, application red

• DNS still points at the old VIP

• Only one of three apps broke after the move

CLI first — copy this block

Run these on the Zscaler device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

# from App Connector
getent hosts internal-app.corp.local
curl -vk https://internal-app.corp.local --max-time 5
ip route get <new-server-ip>
ss -tni | grep <new-server-ip>

How to read that output

If the connector cannot resolve or connect to the new IP, ZPA will publish an empty group. Fix DNS or the server group definition; do not add more connectors yet.

Triage order

1. Read the current server group definition.

2. Resolve the app FQDN from the connector.

3. Update the group to the new IP or FQDN.

4. Health-check the port from the connector.

5. Wait for the application to go green before you retest users.

Classic traps

What you see	Real cause	Fix
Add another connector	The group still has the old subnet	Edit the group
Open ZPA inbound	Path is connector to app	Fix east-west routing
Users need a new client	Discovery is empty	Client is fine

Proof the ticket is closed

• Server group shows 1+ healthy members

• Connector curl succeeds

• One remote user connects

Say this in an interview

I treat an empty ZPA server group as a discovery or routing problem on the connector, not a user-client problem.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/