top of page
Search

Zscaler Client Connector Auth Loop: PAC and IdP Checks Before Reinstall

  • 3 days ago
  • 2 min read
Zscaler network security troubleshooting lab
Zscaler · Techclick CLI troubleshooting lab
ZCC opens a browser, user signs in, then the same prompt returns. Three reinstalls already happened.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on Zscaler for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

This is almost never a corrupt client. It is PAC pointing at the wrong cloud, a stale IdP cookie, or ZCC listening on the wrong loopback port.

Why this ticket shows up

ZCC hands auth to the IdP and expects a token back on 127.0.0.1. A PAC that sends 127.0.0.1 to the proxy, or an IdP session that never returns, looks like a broken install.

Symptoms operators actually see

  • Browser loops on the IdP

  • Works in incognito sometimes

  • Only one PAC environment fails

  • Loopback 9000/9010 blocked by local firewall

CLI first — copy this block

Run these on the Zscaler device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

# on the Windows laptop (admin CMD)
netsh winhttp show proxy
bitsadmin /util /getieproxy localsystem
curl -I http://127.0.0.1:9000
nslookup gateway.<cloud>.net
type %userprofile%\AppData\Roaming\Zscaler\*.log | findstr /i "auth PAC 127.0.0.1"

How to read that output

winhttp proxy should not send 127.0.0.1 to Zscaler. curl to the ZCC loopback must not hang. If IdP works in incognito, it is a cookie/session problem, not a binary problem.

Triage order

  1. Check that PAC or system proxy bypasses 127.0.0.1 and login.microsoftonline.com if needed.

  2. Confirm ZCC process is listening on its loopback port.

  3. Clear the IdP session and retry once.

  4. Verify the user is in the correct ZIA cloud (zscalertwo vs zscalerthree).

  5. Reinstall only after those four are clean.

Classic traps

What you see

Real cause

Fix

Reinstall ZCC

PAC proxies localhost

Bypass 127.0.0.1

Disable ZCC

IdP conditional access blocks the app

Fix the CA policy

Wrong cloud in PAC

User enrolled in another cloud

Match cloud name

Proof the ticket is closed

  • Auth completes once

  • ZCC shows enrolled

  • User traffic appears in ZIA

Say this in an interview

I treat ZCC auth loops as PAC or IdP path problems. Reinstall is the last step, not the first.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments

bottom of page