- Secure Private Access (ZPA) Help
- Dashboard & Diagnostics
- Applications and Users Monitoring
- Understanding ZPA Session Status Codes
Secure Private Access (ZPA)
Understanding ZPA Session Status Codes
ZPA session status codes appear in the User Activity Diagnostics page. Each table has its own search field and can be sorted by column.
Status codes are prefixed by the related ZPA component:
- AC: The App Connector component.
- CA: The Central Authority component.
- CLT: The Zscaler Client Connector component.
- SE: The ZPA Public Service Edge or ZPA Private Service Edge component.
- ZPA BA: The Browser Access service.
The types of session status codes available are:
- Error Codes
The following is a list of Error status codes:
CloseSession Status 1Internal ReasonDescriptionResolutionAC: App Connector in paused state for upgradeThe App Connector is in a paused state for upgrade. The App Connector will return to a normal state after the upgrade completes.No action required.AC: Application Segment not configuredThe App Connector cannot set up a connection to the server because it cannot find the application in the configuration database.Ask the user to reauthenticate. If the error persists, contact Zscaler Support.AC: Application’s Microtunnel request failed due to exceeding the rate limit.The App Connector rejected the application’s Microtunnel request because the rate limit threshold for the specific domain was exceeded. To learn more, see Ranges & Limitations.Try again later. If the problem persists, contact Zscaler Support.AC: Cannot open connection to serverThe App Connector encountered an error when setting up a data connection to the server.Ensure that the App Connector can reach the application.AC: Cannot open connection to Service EdgeThe App Connector encountered an error when opening a connection to the ZPA Public Service Edge or ZPA Private Service Edge.Ensure that the App Connector can reach the ZPA Public Service Edge or ZPA Private Service Edge.AC: Cannot setup connection to Service EdgeThe App Connector encountered an error when setting up a connection to the ZPA Public Service Edge or ZPA Private Service Edge.Ensure that the App Connector can reach the ZPA Public Service Edge or ZPA Private Service Edge, and then ask the user to request the application. If the error persists, contact Zscaler Support.AC: Connection between server and App Connector was closedDuring data connection setup, the connection from the server to the App Connector was closed.Verify if the application is reachable from the App Connector, and check the available server capacityAC: Connection database is fullThe App Connector cannot set up a connection to the server because the connection database is full.Ask the user to reauthenticate. If the error persists, contact Zscaler Support.AC: Connection request timed outThe App Connector timed out while setting up a connection.Ensure that the App Connector can reach the application.AC: Connection request to server timed outThe App Connector timed out while waiting for a connection response from the ServerEnsure that the App Connector can reach the application.AC: Connection request to Service Edge timed outThe App Connector cannot set up a data connection to a the ZPA Public Service Edge or ZPA Private Service Edge.Ensure that the App Connector is able to reach the ZPA Public Service Edge or ZPA Private Service Edge.to ofPage of - Info Codes
The following is a list of Info status codes:
CloseSession Status 1Internal ReasonDescriptionResolutionAC: Connection closed successfullyThe connection to the App Connector was terminated without issue.No action required.SE: App Connector disconnected to ZPA Private Service EdgeThe ZPA Private Service Edge connection to the App Connector was disconnected.Ensure that the App Connector is able to reach the ZPA Private Service Edge.SE: App Connector TLS session not presentThe connection from the App Connector to the ZPA Public Service Edge or ZPA Private Service Edge was terminated, resulting in the ZPA Public Service Edge or ZPA Private Service Edge terminating all application sessions for that App Connector.No action required.SE: Callback for Server Name Indication maxed outThe ZPA Public Service Edge or ZPA Private Service Edge connection closed because the maximum number of Server Name Indication (SNI) callbacks was reached.No action required.SE: Callback for Server Name Indication timed outThe ZPA Public Service Edge or ZPA Private Service Edge connection is closed because the wait time for Server Name Indication (SNI) callbacks has expired.No action required.SE: Client Connector TLS session not presentThe connection from the Zscaler Client Connector to ZPA Public Service Edge or ZPA Private Service Edge was terminated, resulting in the ZPA Public Service Edge or ZPA Private Service Edge terminating all application sessions for that Zscaler Client Connector.No action required.SE: Connection closed by App ConnectorThe App Connector closed the application Microtunnel (M-Tunnel) as a result of the application server terminating the TCP session with a TCP FIN.No action required.SE: Connection closed by Client ConnectorThe connection from the App Connector to the ZPA Public Service Edge or ZPA Private Service Edge was terminated, resulting in the ZPA Public Service Edge or ZPA Private Service Edge terminating all application sessions for that App Connector.No action required.SE: Connection closed by serverThe application server terminated the connection with TCP RST.No action required.SE: Connection closed by Service EdgeThe ZPA Public Service Edge or ZPA Private Service Edge closed the application tunnel connection. This is part of the Service Edge’s regular process at the end of an application request.No action required.to ofPage of - Policy Block Codes
The following is a list of Policy Block status codes:
CloseSession Status 1Internal ReasonDescriptionResolutionSE: Application policy blocked accessThe ZPA service blocked the application request because the user isn't allowed to access the requested application.Update the policy to allow the user.SE: Policy is not configured for accessThe ZPA service blocked the application request because a policy isn't configured for the requested application. The application request is also blocked when an App Segment or App Group Segment is disabled.Update the policy to allow the user. Enable the App Segment and App Group Segment.to ofPage of
Was this article helpful? Click an icon below to submit feedback.
Related Articles
Viewing the Applications DashboardAbout the Users DashboardAbout the Health DashboardViewing the Source IP Anchoring DashboardAccessing User Activity DiagnosticsAccessing User Status DiagnosticsUnderstanding ZPA Session Status CodesViewing the Extranet DashboardAbout Usage InsightsViewing Quarterly Business Review Reports