Forwarding Corporate Location Traffic to Zscaler ZIA

Name: Forwarding Corporate Location Traffic to Zscaler ZIA
Uploaded: 2026-08-03T08:05:21-04:00
Duration: 3 min 7 s
Description: In this video, you will learn about: - How to forward traffic from your corporate locations to ZIA - How to configure to your network to allow your users to keep using ZCC on the corporate network 0:00 Introduction 0:14 Forwarding location traffic 1:50...

Zscaler

08/03/2026

0 (0%)

Report Like Favorite

Transcript

In this series of short videos, we'll be taking a look at recommendations for forwarding your traffic to the Zero Trust Exchange. This is part 5, forwarding traffic from locations. For known locations where you have deployed enterprise-grade internet gateways, you have the ability to build GRE or IPsec tunnels to the Zero Trust Exchange. The choice between the two will largely depend on two factors. First, tunnels can normally be built from gateway routers or SD-WAN boxes. Depending on the type and model of equipment, these will support one or both tunnel types. Secondly, GRE tunnels require a static IP address at the site. Whenever possible, Zscaler recommends using GRE rather than IPsec tunnels, as GRE has greater throughput and has the least amount of overhead. We also recommend that customers forward traffic via GRE without a NAT device between users and the ZIA service edge, with surrogate IP and authentication enabled in the ZIA location settings. This will ensure that traffic is properly load-balanced and that user-identity-based policies are applied to all traffic. Finally, we require two tunnels be configured to two different public service edges for each location, in an active, standby configuration. We strongly recommend setting up monitoring and automated tunnel failover for these tunnels as a best practice. Finally, as a reminder, Zscaler recommends installing ZCC on all user devices. However, remember that using Ztunnel2 on trusted network when traffic is also routed through a GRE or IPsec tunnel is not recommended, as this would double-encapsulate non-web traffic and slow down the processing of your user traffic. To address this, Zscaler recommends using policy-based routes to route all Ztunnel2 traffic directly to the internet. Note that the full list of Zscaler IPs is published online on our website within the config.zscaler.com pages. It's recommended that you subscribe to the trust portal notifications for your Zscaler cloud to receive updates whenever these change, as routes will need to be configured on each device where a GRE or IPsec tunnel is built, to bypass Ztunnel2 traffic from being forwarded inside said tunnel. If policy-based routing is not possible, then an alternative option is to use the ClientConnector Trusted Network Detection settings and configure ZCC to use Ztunnel1 when it detects that it is on the corporate network. Note that this method requires enforcing authentication and IP surrogacy at the location level to maintain user attribution on non-web traffic. You can then configure sublocations in the ZIA admin portal for each type of non-user traffic, such as traffic from IoT devices or guest Wi-Fi traffic, in order to disable authentication and attribution for that non-user traffic. That's it for this video. Thanks for watching!

TL;DR

Zscaler recommends GRE tunnels over IPsec for forwarding corporate location traffic to ZIA due to greater throughput and lower overhead, though tunnel type choice depends on gateway equipment support and static IP availability.
Deploy two tunnels per location to different public service edges in active-standby configuration with automated failover monitoring, and forward traffic without NAT devices while enabling surrogate IP and authentication for proper load balancing.
When using ZCC on corporate networks with location tunnels, implement policy-based routing to send Ztunnel2 traffic directly to the internet, or configure trusted network detection to switch ZCC to Ztunnel1 mode to prevent double-encapsulation.

Summary

This technical tutorial demonstrates how to forward traffic from corporate locations to Zscaler Internet Access (ZIA) using GRE or IPsec tunnels. The video covers tunnel selection criteria based on gateway equipment capabilities and static IP availability, with Zscaler recommending GRE tunnels for superior throughput and lower overhead. Key configuration guidance includes deploying tunnels without NAT devices, enabling surrogate IP and authentication for proper load balancing and user-identity policies, and establishing active-standby tunnel pairs to different public service edges with automated failover monitoring. The session also addresses the challenge of running Zscaler Client Connector (ZCC) on corporate networks where location-based tunnels are already deployed, explaining how to prevent double-encapsulation of non-web traffic through policy-based routing or trusted network detection settings. Additional configuration options for handling IoT devices and guest Wi-Fi traffic through sublocations are covered to maintain proper traffic attribution while accommodating different device types on the corporate network.

Chapters

0:00 - Introduction
0:14 - Forwarding Location Traffic
0:43 - GRE vs IPsec Tunnels
1:50 - ZCC on Trusted Networks

Key Quotes

0:43 "Whenever possible, Zscaler recommends using GRE rather than IPsec tunnels, as GRE has greater throughput and has the least amount of overhead."
0:53 "We also recommend that customers forward traffic via GRE without a NAT device between users and the ZIA service edge, with surrogate IP and authentication enabled in the ZIA location settings."
1:33 "Using Ztunnel2 on trusted network when traffic is also routed through a GRE or IPsec tunnel is not recommended, as this would double-encapsulate non-web traffic and slow down the processing of your user traffic."

FAQ

Why does Zscaler recommend GRE tunnels over IPsec for forwarding location traffic?

GRE tunnels provide greater throughput and have the least amount of overhead compared to IPsec tunnels. However, the choice between the two depends on what your gateway equipment supports and whether you have a static IP address at the site, as GRE requires a static IP.

How should I configure ZCC when users are on the corporate network that already has GRE or IPsec tunnels to ZIA?

Use policy-based routes to send all Ztunnel2 traffic directly to the internet to avoid double-encapsulation. If policy-based routing isn't possible, configure ZCC's Trusted Network Detection to use Ztunnel1 when on the corporate network, and enable authentication and IP surrogacy at the location level to maintain user attribution.

Categories:

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Discover DLP Memories: The ever-evolving triage agent enhancing efficiency each shift.

Safeguarding Sensitive Data in the Age of AI Platforms

AI Agents Revolutionizing Identity Attacks: Same Tactics, Enhanced Speed