- Experience Center Help
- Analytics
- Digital Experience Monitoring
- Users
- Cloud Path Errors
Experience Center
Cloud Path Errors
If there are any errors in the Cloud Path in the Users Dashboard, you see error icons in the Hop View as well as the Command Line View. In the Hop View, the icons are displayed under the hop, while in the Command Line View, icons are displayed next to the IP address. Clicking the icon displays the error message.
The icons in the Cloud Path indicate the following:
: This message is for informational purposes only. No action is required.
: This is a warning message. This indicates that action might be necessary to resolve an issue and achieve accurate Cloud Path results.
: This is a critical error. This indicates an issue that could affect the user experience.
Error Message
Error Description
Solution
The Zscaler Client Connector could not discover the user's Internet egress IP address.
Verify the configuration and try a different protocol (ICMP/UDP). The current Cloud Path protocol is blocked.
ICMP protocol might not be supported on the network.
Ensure the underlying network allows ICMP packets.
Path is not available.
No action required.
Path is not available.
No action required.
Path is not available.
No action required.
Path is not available.
No action required.
We are not able to display the actual Cloud Path for applications accessed through Private Applications.
No action required.
Connection to the host is successful, but there are issues in connecting to your URL.
Verify that your URL for the Web probe is correct.
There is a network error. One of the interfaces is down, the probes are not receiving a response, or the ISP upstream connectivity might be down.
Verify your ISP connectivity and that the ICMP/UDP protocol configured for the probe is not blocked on the network.
ICMP and UDP probes are not supported in a No Default Route (NDR) environment.
Ensure you're running probes via TCP.
There were issues when connecting to your web proxy.
Verify your proxy policy and authentication mechanism and that access is allowed for this application URL.
The egress could not be probed. It did not respond with an ICMP TTL expired message for the Digital Experience Monitoring Cloud Path probe.
Configure the router to return ICMP TTL expired messages for packets with IP TTL1.
The domain is invalid or not resolvable.
Verify the name of the domain or your DNS configuration.
The network path to the client egress IP address cannot be traced correctly because the egress IP is tunneled. This also means that the end-to-end latency value does not include the latency from the client to the Internet egress point.
Configure an access list for your router or SD-WAN device to bypass ICMP/UDP from the tunnel (GRE/IPSec) for your client egress IP address.
The network path from the client to the Internet egress point (client egress) cannot be traced. Zscaler Client Connector was unable to fetch Digital Experience Monitoring service data from the Zscaler cloud. This also means that the end-to-end latency value does not include the latency from the client to the internet egress point.
Report the error to Zscaler Support.
The network changed during the Cloud Path probe run. Cloud Path probes for that sample were aborted.
Zscaler Client Connector detected the network change. No action is required.
The TCP traceroute to the Zscaler Service Edge was dropped.
Check your network connection.
ICMP, TCP, or UDP protocol traceroute might not be supported on the network.
Ensure the underlying network permits the configured protocol.
to
of
Page
of
Private Applications and Digital Experience Monitoring Error Codes
Digital Experience Monitoring can report error codes for the following Private Applications errors. These errors are applicable to either the Private Applications Public Service Edge or Private Applications Private Service Edge component.
Session Status
Description
Resolution
The Private Applications Public Service Edge was unable to process the application request since an App Connector group was not specified in the Server group configuration.
Edit the Server group to add the App Connector group(s). To learn more, see Editing Server Groups.
The Private Applications Public Service Edge or the Private Applications Private Service Edge cannot set up a connection since the application is not configured.
- Ensure that the Application and Application Segment are configured in the Admin Portal.
- Ask the user to access the application again. If the error persists, contact Zscaler Support.
The Private Applications service blocked the application request because the user isn't allowed to access the requested application.
Update the policy to allow the user access.
The Private Applications Public Service Edge or Private Applications Private Service Edge was waiting for a data connection request from an App Connector that could provide access to the application, but the request timed out while waiting. The request from an App Connector is triggered in response to the initial application request from Zscaler Client Connector.
Ensure that the App Connectors can reach the Private Applications Public Service Edge or Private Applications Private Service Edge and the requested application.
The Private Applications Public Service Edge or Private Applications Private Service Edge cannot fill assistant groups due to a configuration error when processing the data request.
Ask the user to validate configuration. If the error persists, contact Zscaler Support.
The Private Applications Public Service Edge or Private Applications Private Service Edge cannot retrieve customer information due to a configuration error when processing the data connection request.
Ask the user to reauthenticate. If the error persists, contact Zscaler Support.
A valid policy cannot be matched to an application access request. There is a missing or mismatched configuration in policy settings, SAML/SCIM attributes, Posture Profiles, Trusted Networks, Client Types, Cloud Connector Groups, or Machine Groups. The application request is also blocked when an App Segment or App Group Segment is disabled.
- Update the policy to allow the user.
- Ensure all SAML attributes are present in the SAML assertion and restart the Zscaler Client Connector.
- Ensure all SCIM attributes or SCIM groups are present.
- Modify policies to match the user's client type.
- Enable the App Segment or Segment Group.
The probe might have failed to reach the Private Applications destination.
Report the error to Zscaler Support.
The probe might have encountered a Private Applications internal error.
Report the error to Zscaler Support.
1
to
10
of
11
Page
1
of
2