Zscaler: Secure Private Application Access in China with Z-Connector

Name: Zscaler: Secure Private Application Access in China with Z-Connector
Uploaded: 2026-06-30T11:12:15-04:00
Duration: 3 min 15 s
Description: Granting secure access to private applications in China is no longer a challenge with Zscaler's Zero Trust Network Access (ZTNA) solution. In this video, Henry, Principal Solution Consultant at Zscaler, introduces the Z-connector, a key component desi...

Zscaler

06/30/2026

0 (0%)

Report Like Favorite

Transcript

We just discussed how we solve the internet access issue for the users in China. Now let's dive a little bit deeper into how we can allow the user to access applications that you are hosting. The applications can be hosted inside your China data centers. It can also be hosted in the data centers outside of China. For resolving that, we are going to introduce a component called Z-Connector. The Z-Connector can be a piece of software, can be a virtual machine, can be hardware or a docker container. You need to place it inside a data center and that connector will have the access to your private applications. They will report the reachability of those applications to the Zscaler nodes, the Zscaler data center, so that once the user is trying to access a private application, the Zscaler nodes will know which app connector should be serving this user, this particular user. And that chosen app connector will be sending out the traffic, outbound only traffic, towards the Zscaler Zero Trust Exchange to serve the user. Basically, that connection will happen at the Zscaler Zero Trust Exchange closer to the user. One thing to note is that this outbound only connectivity is bringing you the following benefits. First, you don't have to have the VPN anymore. And by doing that, you are also eliminating the attack surface here. That also means for China particularly, you are avoiding the ICP filing and public IP exposure of the China internet. And for the global situation, it's similar. You're going to have another Zconnector in the global data center, which have the access to the applications. The only thing special here is that, as I mentioned earlier, the Zconnector always needs to connect to the service edge closer to the user to serve the user. So that situation will be the Zconnector outside of China will reach out to this special link that we are building in order to reach the Zscaler nodes inside China to serve the user. And now by looking at this, your user here will have access to everything that they need, internet, private application. That's about it. And once you have it, you want to extend that same connectivity also to the users inside, on site. It could be in the branches. It could be in the factories to have them having a direct connectivity from the branches to the Zero Trust Exchange. With that in place, it helps you to simplify or isolate your user traffic from the branches as well. That also means on the SD-WAN side, you will see a dramatic drop of amount of traffic going through your SD-WAN because the user here only requires a normal internet, just like they are at home, to access the Zscaler nodes to access the application that they need. That's basically how we solve it for the users for all the private access and internet access.

TL;DR

Z-Connector deploys inside data centers as software, VM, hardware, or container to broker secure access to private applications without exposing them to the internet.
Outbound-only connectivity eliminates VPN requirements, removes attack surfaces, and avoids China-specific ICP filing and public IP exposure obligations.
Cross-border application access uses a special link allowing Z-Connectors outside China to reach Zscaler nodes inside China to serve local users.

Summary

This technical walkthrough demonstrates how Zscaler's Z-Connector enables secure access to private applications for users operating in China. The Z-Connector, deployable as software, virtual machine, hardware appliance, or Docker container, establishes outbound-only connections to the Zscaler Zero Trust Exchange, eliminating the need for traditional VPN infrastructure and removing external attack surfaces. For applications hosted outside China, the Z-Connector leverages a special cross-border link to reach Zscaler nodes within China, ensuring users can access global resources seamlessly. The architecture extends beyond individual users to branch offices and factories, allowing site-based connectivity that dramatically reduces SD-WAN traffic by routing user requests through standard domestic internet to the Zero Trust Exchange. This approach specifically addresses China's regulatory requirements by avoiding ICP filing obligations and public IP exposure while maintaining secure, compliant access to both local and global private applications.

Chapters

0:00 - Introduction and Context
0:29 - Z-Connector Overview
1:24 - Security Benefits
2:25 - Branch and Factory Extension

Key Quotes

1:29 "First, you don't have to have the VPN anymore. And by doing that, you are also eliminating the attack surface here."
2:52 "You will see a dramatic drop of amount of traffic going through your SD-WAN because the user here only requires a normal internet, just like they are at home, to access the Zscaler nodes."

FAQ

What deployment options are available for the Z-Connector?

The Z-Connector can be deployed as a piece of software, a virtual machine, a hardware appliance, or a Docker container, providing flexibility to match existing infrastructure and operational preferences within your data centers.

How does this solution address China's ICP filing requirements?

Because the Z-Connector uses outbound-only connections and doesn't require public IP addresses or inbound internet exposure in China, organizations can avoid the ICP filing process that would otherwise be required for hosting internet-facing services.

Categories:

Tags:

Show more Show less

Browse videos

Upcoming Webinar Calendar

11/18/2026

08:00 AM

11/18/2026

Hands-On Workshop: Connecting On-Prem Data to Databricks with MinIO AIStor (International)

https://www.truthinit.com/index.php/channel/2194/hands-on-workshop-connecting-on-prem-data-to-databricks-with-minio-aistor-international/
11/19/2026

01:00 PM

11/19/2026

Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection

https://www.truthinit.com/index.php/channel/2076/securing-the-microsoft-enterprise-strengthening-configuration-management-identity-security-and-data-protection/
11/19/2026

01:00 PM

11/19/2026

Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents

https://www.truthinit.com/index.php/channel/2181/zendesk-deep-dive-get-the-work-done-faster-with-employee-service-ai-agents/
11/19/2026

01:00 PM

11/19/2026

AI Agent Showdown: Discover What Muse, Dots, and Duet Bring to Your Website

https://www.truthinit.com/index.php/channel/2228/ai-agent-showdown-discover-what-muse-dots-and-duet-bring-to-your-website/
12/02/2026

04:00 AM

12/02/2026

Skylight en acción: salvaguardando la IA más allá del usuario.

https://www.truthinit.com/index.php/channel/2147/skylight-en-acción-salvaguardando-la-ia-más-allá-del-usuario/
12/03/2026

01:00 PM

12/03/2026

CISO Insights: Steering Cybersecurity Strategies in an AI-Driven Era

https://www.truthinit.com/index.php/channel/2231/ciso-insights-steering-cybersecurity-strategies-in-an-ai-driven-era/
01/19/2027

04:00 AM

01/19/2027

Skylight in Aktion: Gewährleisten Sie KI-Schutz über den Benutzer hinaus

https://www.truthinit.com/index.php/channel/2176/skylight-in-aktion-gewährleisten-sie-ki-schutz-über-den-benutzer-hinaus/
01/19/2027

02:00 PM

01/19/2027

HUMAN Dialogue: Embracing the Rise of the Empowered AI Consumer.

https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-rise-of-the-empowered-ai-consumer/
03/18/2027

01:00 PM

03/18/2027

Securing Access for People, Partners and AI Agents

https://www.truthinit.com/index.php/channel/2251/securing-access-for-people-partners-and-ai-agents/
06/17/2027

01:00 PM

06/17/2027

Stop the Leak: Data Loss Prevention for the AI Era

https://www.truthinit.com/index.php/channel/955/360view-stop-the-leak-data-loss-prevention-for-the-ai-era/
08/19/2027

01:00 PM

08/19/2027

Who Has Access to What...and Should They?

https://www.truthinit.com/index.php/channel/2252/who-has-access-to-what-and-should-they/
10/21/2027

01:00 PM

10/21/2027

After VMware: Building the Private Cloud You Actually Want

https://www.truthinit.com/index.php/channel/2253/after-vmware-building-the-private-cloud-you-actually-want/
11/18/2027

01:00 PM

11/18/2027

Assume Breach, Prove Recovery

https://www.truthinit.com/index.php/channel/2254/assume-breach-prove-recovery/
12/16/2027

01:00 PM

12/16/2027

The Self-Running Service Desk

https://www.truthinit.com/index.php/channel/2255/the-self-running-service-desk/