Skip to content

Zscaler — Architecture Overview

Summary

Zscaler provides cloud-delivered internet security (ZIA) and secure private application access (ZPA) without a traditional site-to-site or client VPN. Traffic is routed through Zscaler's cloud regardless of whether a user is on-premises or remote, enforcing consistent policy everywhere.

Architecture Diagram

flowchart LR
    user[User Device] --> zcc[Zscaler Client<br/>Connector]
    zcc --> zia[Zscaler Internet<br/>Access - ZIA]
    zcc --> zpa[Zscaler Private<br/>Access - ZPA]

    zia --> internet[Public Internet]
    zpa --> connector[App Connector]
    connector --> internal[Internal Apps<br/>on-prem / cloud]

    zcc <--> okta[Okta SSO]

Components

Component Role
Zscaler Client Connector Lightweight agent on endpoint, routes traffic to the Zscaler cloud
ZIA (Internet Access) Inspects and filters general internet-bound traffic
ZPA (Private Access) Brokers zero-trust access to internal apps without exposing the network
App Connector Lightweight connector deployed near internal apps, establishes outbound-only tunnel to ZPA
Okta Identity provider for authentication before access is granted

Traffic Flow

  1. User's device runs Client Connector, which authenticates via Okta SSO.
  2. General web traffic routes through ZIA for inspection and policy enforcement.
  3. Requests for internal apps route through ZPA instead.
  4. ZPA matches the request to an App Connector near the target app — no inbound firewall ports are opened.
  5. Access is granted per-app, per-policy — not network-wide, unlike a traditional VPN.