Below are best practices to follow if your users are running the Zscaler App in conjunction with a corporate VPN client.
If your users have a corporate VPN client installed on their devices in addition to the Zscaler App, Zscaler recommends you select Tunnel with Local Proxy as the forwarding profile action for all networks in your forwarding profile. This ensures maximum interoperability between the VPN client and the Zscaler App.
At the least, Zscaler recommends you do not select Tunnel as the forwarding profile action for VPN Trusted Network. Zscaler advises this because VPN clients work at the network (IP) layer, which is the same layer the App works in if you select Tunnel mode. Both the VPN and the Zscaler App working at the same layer increases the likelihood of interoperability problems.
Zscaler recommends selecting Tunnel with Local Proxy as the forwarding profile action because in this mode, the Zscaler App works at the application layer. Users don't experience interoperability issues because the App is not competing with the VPN client at the IP layer. Instead, the App allows the VPN to take traffic as needed, but sets proxy settings to ensures that all user traffic is still protected by Zscaler. Note that if you are using Zscaler App version 1.1.1 or later, you are not required to add a custom PAC file when selecting Tunnel with Local Proxy. See more details about the different forwarding profile actions Zscaler App can use.
If your users have a corporate VPN, and you still decide to use the Tunnel mode as your forwarding profile action, you must take some key steps to ensure that users do not experience connectivity issues. See D. Steps to Take if Selecting Tunnel for Forwarding Profile Action, below.
The Zscaler App can work either at the Network (IP) layer, or the Application layer. You can specify which layer the App uses to tunnel traffic (or whether the App tunnels traffic at all) with the forwarding profile action you choose for forwarding profiles.
Even if you select Tunnel with Local Proxy as the forwarding profile action for VPN Trusted Network, you must ensure that the VPN client is not configured to change proxy settings on user devices. If VPN clients tamper with proxy settings in any way, the Zscaler App does not forward traffic properly.
Again, for ease of configuration, Zscaler recommends you select Tunnel with Local Proxy mode in this scenario. However, if you choose to run the Zscaler App in Tunnel mode, and your VPN client is running in split-tunnel mode, you must take some steps to ensure the App interoperates with your VPN client. See the first item under D. Steps to Take if Selecting Tunnel for Forwarding Profile Action, below.
If you select Tunnel mode as the forwarding profile action, and your VPN clients run in split-tunnel mode, the Zscaler App can only forward traffic properly if you allow traffic destined for the VPN gateway to bypass the Zscaler App.
You can do this in the Hostname/IP Address bypass for VPN Gateway field when configuring your App Profiles. Specify in that field the hostnames or IP addresses for all your VPN gateways. The Zscaler App sets the routing table to exclude any traffic destined for the VPN gateway, ensuring that this traffic is allowed to bypass the App tunnel and properly go to the VPN. To ensure against connectivity issues, it is critical that you include all VPN hostnames, or all IP addresses to which these hostnames might resolve.
On Windows devices, when the Zscaler App runs in Tunnel mode, the Zscaler App sets DNS on the interface to point to 100.64.0.3, 100.64.0.4, and 100.64.0.5. When a user launches a VPN connection, the Zscaler App detects this network change and responds accordingly.
Upon launch, the VPN client sets its own DNS on the interface to make it the prioritized DNS for resolving internal domains. The Zscaler App detects this change and reverts it, so that 100.64.0.3 (Zscaler's DNS) is again the prioritized DNS for the user device. However, the Zscaler App redirects any DNS query that comes to 100.64.0.3 to the original prioritized DNS (the VPN client DNS).
At this point, if the DNS query is for an external domain, and the original VPN DNS is configured only to resolve internal domains, the DNS query should continue to be redirected to the DNS server next in the priority list, until it finds a DNS server that can resolve the requested external domain.
However, some Windows programs do not redirect DNS queries to DNS servers that are next in the priority list. In this scenario, the DNS query remains unable to find a DNS server to resolve the requested external domain, and the user is left unable to reach the external domain.
To prevent this, ensure that all VPN clients set DNS servers that can resolve both internal and external domains.
To detect whether a network is a trusted, untrusted, or VPN-trusted network, the Zscaler App examines the network interface properties. Zscaler recommends selecting DNS Server and DNS Search Domains for trusted network criteria because they are static properties on the network interface.
Hostname and IP resolution, in contrast, is a dynamic property, because the Zscaler App must take the step of resolving a hostname to see if it resolves to the IP address specified in the Trusted Network Criteria. There is a chance that a resolution might fail because of network transition processes, or if a VPN connection is unstable. If a resolution fails, then the Zscaler App can incorrectly determine the network is an untrusted one, in which case it applies the wrong forwarding profile action.
When a user launches a VPN connection, the Zscaler App detects this network change and responds accordingly. If the VPN client runs in full-tunnel mode the App removes all of its own DNS settings to allow all traffic to properly go to the VPN. If the VPN client runs in split-tunnel mode, the App reconfigures DNS settings so it can properly apply the forwarding profile action for Off Trusted Network.
While that is the ultimate expected outcome, the user may experience some temporary network instability. When the Zscaler App removes its own DNS settings, this is detected as a network change by the VPN client. In response, the VPN client may disconnect and attempt to reestablish the connection. The user may experience some connectivity issues until this process is complete and the Zscaler App and VPN client reach equilibrium.