What is the difference between the ZCC Forwarding Profile and App Profile?

The Forwarding Profile controls how ZCC handles user traffic in different network environments and steers traffic to or away from the Client Connector within the OS stack. The App Profile makes routing decisions for traffic received by ZCC, steering it towards or away from the Zero Trust Exchange.

Why is the packet-filter-based driver recommended for Windows devices?

The packet-filter-based driver offers improved throughput, operates transparently so users cannot uninstall or tamper with routing, and has better interoperability with VPN clients while avoiding split DNS problems entirely since it doesn't create IP routes or DNS server configurations.

ZCC Forwarding Profile Configuration & Best Practices

Name: ZCC Forwarding Profile Configuration & Best Practices
Uploaded: 2026-05-26T19:56:52-04:00
Duration: 3 min 13 s
Description: In this video, you will learn about: - The differences between the ZCC Forwarding Profile and App Profile - The different settings that can be configured in the Forwarding Profile 0:00 Introduction 0:15 Forwarding Profile vs. App Profile 2:13 Forwardin...

Zscaler

05/26/2026

0 (0%)

Report Like Favorite

Transcript

In this series of short videos, we'll be taking a look at recommendations for forwarding your traffic to the Zero Trust Exchange. This is Part 3 on the Client Connector Forwarding Profile. Regardless of the forwarding method chosen, Zscaler Client Connector has two profiles that must be configured, a forwarding profile and an app profile. At a high level, the forwarding profile controls how Zcc handles user traffic when in different network environments, and steers traffic to or away from the Client Connector itself within the OS stack. The app profile then makes routing decisions for traffic received by Zcc, steering it towards or away from the Zero Trust Exchange. As an example, the forwarding profile is where you would define trusted network criteria, which Zcc will use to determine whether or not it is on a trusted network, and where it will make the decision of which forwarding method to use. Let's start by taking a deeper look at the forwarding profile. One of the decisions you will need to make as part of the forwarding profile configuration is which driver type to use on Windows devices when forwarding traffic to the Zero Trust Exchange via Z-Tunnel 1 or 2. For non-Windows devices, the driver use will be a route-based driver, with Zcc creating a virtual network adapter and using OS routing to forward traffic via this interface. However, for Windows devices, you also have the option to use a packet-filter-based driver instead. This is recommended as the Windows packet-filter-based driver has several advantages over the route-based driver for this OS. First, it has improved throughput. Secondly, it's transparent and hidden, which means users cannot uninstall it or tamper with its routing. Since there are no IP routes or DNS server configurations created on the system, this driver also has better interoperability with VPN clients and avoids split DNS problems entirely. Note that as of Zcc version 4.8, which released in 2026, the packet-filter-based driver will always be used, and the route-based driver will no longer be selectable. The forwarding profile is also where you'll configure what traffic shouldn't be routed to Zcc in the first place. An example of this is if you want to use a third-party proxy to secure a portion of your traffic. The forwarding profile allows you to bypass this traffic before it reaches Zcc, so it can be routed to the appropriate third-party proxy. Note that for older versions of Zcc, prior to 2026, the forwarding profile is also where bypasses would be configured. This is no longer the case with current Zcc versions, which use the app profile instead. This will be discussed in the next video in this series. Finally, the forwarding profile is also where you can configure the Zcc behavior for web traffic on non-standard ports. This allows you to route this traffic through Zcc so that it is forwarded to the Zero Trust Exchange, even with ZTunnel1, to avoid attempts to evade ZIA security controls. That's it for this video. Thank you for watching!

TL;DR

ZCC uses two distinct profiles: the Forwarding Profile controls traffic handling at the OS level and determines forwarding methods, while the App Profile makes routing decisions for traffic received by ZCC.
For Windows devices, the packet-filter-based driver is recommended over route-based drivers due to superior throughput, tamper resistance, and better interoperability with VPN clients and DNS configurations.
The Forwarding Profile enables configuration of trusted network criteria, third-party proxy bypasses, and handling of web traffic on non-standard ports to prevent security control evasion.

Summary

This technical tutorial explains the Zscaler Client Connector (ZCC) Forwarding Profile configuration, which controls how client traffic is handled across different network environments and steered to the Zero Trust Exchange. The video distinguishes between the Forwarding Profile and App Profile, clarifying that the Forwarding Profile manages traffic handling at the OS stack level and determines forwarding methods based on network context, while the App Profile makes routing decisions for traffic received by ZCC. Key configuration areas covered include driver type selection for Windows devices, trusted network criteria definition, third-party proxy bypass configuration, and handling of web traffic on non-standard ports. The presenter emphasizes the advantages of the Windows packet-filter-based driver over route-based alternatives, noting improved throughput, tamper resistance, and better VPN interoperability. A significant update is highlighted: as of ZCC version 4.8 released in 2026, the packet-filter-based driver becomes mandatory for Windows deployments, eliminating the route-based option entirely.

Chapters

0:00 - Introduction to ZCC Forwarding Profile
0:15 - Forwarding Profile vs App Profile
1:03 - Windows Driver Type Selection
2:12 - Third-Party Proxy Bypass Configuration
2:49 - Non-Standard Port Traffic Handling

Key Quotes

0:24 "At a high level, the forwarding profile controls how Zcc handles user traffic when in different network environments, and steers traffic to or away from the Client Connector itself within the OS stack."
1:38 "First, it has improved throughput. Secondly, it's transparent and hidden, which means users cannot uninstall it or tamper with its routing."
2:00 "Note that as of Zcc version 4.8, which released in 2026, the packet-filter-based driver will always be used, and the route-based driver will no longer be selectable."

Categories:

Tags:

Show more Show less

Browse videos

Upcoming Webinar Calendar

10/13/2026

01:00 PM

10/13/2026

Transitioning from CJIS to FERPA: Essential Audit Evidence for Compliance

https://www.truthinit.com/index.php/channel/2159/transitioning-from-cjis-to-ferpa-essential-audit-evidence-for-compliance/
10/15/2026

11:00 AM

10/15/2026

Risk in Real Time Demo Series: Virtual Patching: Protection at the Speed of Exploitation

https://www.truthinit.com/index.php/channel/1372/risk-in-real-time-demo-series-the-autonomous-era-orchestrating-a-resilient-enterprise/
10/20/2026

11:00 AM

10/20/2026

Harnessing Data Governance for AI with Cyera and Snowflake

https://www.truthinit.com/index.php/channel/2137/harnessing-data-governance-for-ai-with-cyera-and-snowflake/
10/27/2026

11:00 AM

10/27/2026

Maximize Security, Value, and Returns on Your Microsoft Investment

https://www.truthinit.com/index.php/channel/2178/maximize-security-value-and-returns-on-your-microsoft-investment/
10/27/2026

01:00 PM

10/27/2026

The HUMAN Experience: Real-Time Insights into Page Intelligence

https://www.truthinit.com/index.php/channel/2139/the-human-experience-real-time-insights-into-page-intelligence/
10/28/2026

01:00 AM

10/28/2026

[APAC:] Secure AI Everywhere: Visibility, governance and protection for the agentic era

https://www.truthinit.com/index.php/channel/2125/apac-ensuring-comprehensive-security-for-ai-applications/
10/28/2026

06:00 AM

10/28/2026

[EMEA:] Secure AI Everywhere: Visibility, governance and protection for the agentic era

https://www.truthinit.com/index.php/channel/2127/emea-ensuring-ai-security-across-all-platforms/
10/28/2026

01:00 PM

10/28/2026

[AMERICAS:] Secure AI Everywhere: Visibility, governance and protection for the agentic era

https://www.truthinit.com/index.php/channel/2126/securing-ai-across-the-americas-strategies-and-insights/
10/28/2026

01:00 PM

10/28/2026

EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure

https://www.truthinit.com/index.php/channel/2179/envzero-near-zero-time-to-resolution-live-agentic-remediation-for-failed-and-drifted-infrastructure/
11/04/2026

11:00 AM

11/04/2026

Leveraging CISA’s Zero Trust Maturity Model in an AI-Driven Landscape

https://www.truthinit.com/index.php/channel/2149/leveraging-cisas-zero-trust-maturity-model-in-an-ai-driven-landscape/
11/04/2026

11:00 AM

11/04/2026

Aligning Agentic Intent: Understanding Your Agents' Purpose vs. Their Actions

https://www.truthinit.com/index.php/channel/2158/aligning-agentic-intent-understanding-your-agents-purpose-vs-their-actions/
11/05/2026

02:00 PM

11/05/2026

HUMAN Dialogue: Embracing the Rise of the Agentic Consumer in AI

https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-rise-of-the-agentic-consumer-in-ai/
11/05/2026

02:00 PM

11/05/2026

Reclaim Your Evenings: Leverage Data Intelligence to Minimize Risk and Boost AI Adoption

https://www.truthinit.com/index.php/channel/2172/reclaim-your-evenings-leverage-data-intelligence-to-minimize-risk-and-boost-ai-adoption/
11/19/2026

01:00 PM

11/19/2026

360View: Govern, Secure & Recover Your Microsoft 365 Environment

https://www.truthinit.com/index.php/channel/2076/360view-govern-secure-recover-your-microsoft-365-environment/