Experience Center
Evaluating the Cloud Path
The Cloud Path provides a path visualization of metrics between hop points of traffic. It can capture a direct traffic path, as in the case of Zscaler Client Connector to Egress to destination, or tunneling through an Internet & SaaS Public Service Edge (from Zscaler Client Connector to Egress to Internet & SaaS Public Service Edge to destination). The Cloud Path has the following views:
- A graph that shows latency or packet loss for a particular time period.
- A Hop View and Command Line View that detail the path from the user's device to the application or destination.
Monitoring Latency and Packet Loss
Select either Latency or Packet Loss in the drop-down menu to view the graph. Click a point in the graph to see the time period and either the latency in milliseconds or the packet loss percentage. In the Latency graph, metrics over the different legs display in the tooltip, and you can also select the metrics from the checkbox options below the graph. If an error is present, that is also displayed in the tooltip. Select a point to update the path tracked from the device to the application.
Monitoring the Hop View and Command Line View
The Hop View and Command Line View each reflect the path from the user's device to the application.
Hop View
Hover over different sections of the path to see more information. You can also use the arrows on either side to expand this view. Depending on the part of the path you hover over, details such as device information, the service provider, latency details, packet loss, hop count, etc. are displayed.
- Maximum Latency
Differential latency is shown over the different legs of the Cloud Path, and the leg with the highest latency displays in orange. The latency shown on top of the Internet & SaaS Public Service Edge represents the network latency between the Internet & SaaS Public Service Edge and the first router in the Zscaler Data Center. This might indicate Internet & SaaS Public Service Edge congestion. Click the magnifying glass icon to expand the Hop View and to see the individual values. To learn more about Service Edges, see About Internet & SaaS Public Service Edges, Understanding Service Edges, and About Private Service Edges for Private Applications.
Close - Tunnels
You can see the flow of traffic through the applicable tunnels as per the configured policies. For GRE tunnels, the Hop View displays underlay hops in the routing path to provide more accurate metrics for latency and packet loss. In cases where the Internet & SaaS Private Service Edge is on a private network (such as a VPN) with a private IP address, the Hop View provides a path from the client to the Internet & SaaS Private Service Edge. To learn more about tunnels in the Cloud Path, see About Tunnel Information in the Cloud Path.
Close - VPN Concentrator
When Citrix is the network interface for TCP or UDP probes, Digital Experience Monitoring displays the path to the VPN Concentrator. Digital Experience Monitoring also supports the topology where traffic from the VPN Concentrator flows to the Internet & SaaS Public Service Edge via a GRE/IPSec tunnel.
Close - External Proxy
When an External Proxy is detected in the path, the Cloud Path supports several proxy topologies within the Hop View. Two examples are represented here.
The following scenario shows a third-party proxy forwarding traffic to the destination:
The following scenario shows the External Proxy forwarding traffic to the Zscaler Service Edge through a GRE tunnel:
Close
- Cloud Path Icons
If there are any errors, icons are displayed on the Cloud Path. Click the icon to display the error message. To learn more, see Cloud Path Errors.
Network interface types that are neither Wi-Fi nor Ethernet are indicated with one of the following icons above the client icon (
) in the Hop View:- Cellular (SIM card) (
) network type - Bluetooth (
) network type - USB (
) network type
If the network type cannot be detected, the icon for an unknown network type (
Close
) is displayed. - Cellular (SIM card) (
- Device Location
Geolocation information and the Zscaler location are displayed for the device, and geolocation information is also displayed for the Zscaler node in both the Hop View and the Command Line View.
A device location icon confirms that a device's location was determined by latitude and longitude coordinates. If no icon is displayed, the device was located by its IP address.
Close - Public Service Edges
When accessing an internet application, you can see the path from Zscaler Client Connector to the application, and if there is an Internet & SaaS Public Service Edge or a Private Applications Public Service Edge in the path, that is also displayed. If a private application is accessed, you can view the path from Zscaler Client Connector to the Private Applications Public Service Edge or Private Applications Private Service Edge. In case you have configured a path for traffic through the Internet & SaaS Public Service Edge, both the Internet & SaaS Public Service Edge and the Private Applications Public Service Edge or the Private Applications Private Service Edge are seen in the Cloud Path. This is displayed in the Hop View and the Command Line View. To learn more about Service Edges, see About Internet & SaaS Public Service Edges, Understanding Service Edges, and About Private Service Edges for Private Applications.
The following image shows both the Internet & SaaS Public Service Edge and Private Applications Public Service Edge in the Hop view. The Private Applications Public Service Edge sends packets to the App Connector in the path to the application. To learn more, see About App Connectors, About Internet & SaaS Public Service Edges, and Understanding Service Edges.
Both views display a 4-digit number for the Internet & SaaS Public Service Edge or Private Applications Public Service Edge. This internal hash value helps Zscaler Support quickly locate and troubleshoot any issues. To learn more, see About Public Service Edges and About Service Edges.
Close - Cloud Path Protocols
Both views display the protocol used over the different legs of the Cloud Path. If ICMP, TCP, or UDP was selected, it is displayed in the Cloud Path. If Adaptive mode was selected, the protocol used for the different legs of the Cloud Path is displayed.
Adaptive mode is not supported for internal applications through Private Applications. Only ICMP, TCP, and UDP are supported.
For Adaptive probes, legs that are grouped according to tunnel type also show their corresponding protocol. The following image shows the grouping of Z-Tunnel 2.0 and ICMP protocol within the Hop View:
To learn how Adaptive mode works, see Using Adaptive Mode. To learn more about setting probes for the Cloud Path, see Configuring a Probe.
Close
Command Line View
Click the Command Line View tab to view further details about the Cloud Path, including the Hop Direction (probe direction, from the client to your egress IP ↓, from Internet & SaaS Public Service Edge or Internet & SaaS Private Service Edge, or Private Applications Public Service Edge or Private Applications Private Service Edge to your egress IP ↑, and from Service Edges to destination ↓), Region and Geolocation, Packet Loss (%) and Packets Failed, as well as Latency metrics. If there are any errors, they are indicated by an icon next to the IP address. Click the icon to display the error message. To learn more, see Cloud Path Errors, About Internet & SaaS Public Service Edges, Understanding Internet & SaaS Private Service Edge, Understanding Service Edges, and About Private Service Edges for Private Applications.
