Client Connector forwarding profile determines how we want to forward the traffic to the Zscaler Cloud. Assuming we have configured tunnels (GRE or IPSEC) from locations, what is the recommended combination for on-trusted and off-trusted options?
A.
Tunnel v2.0 for on-trusted and tunnel v2.0 for off-trusted
B.
None for on-trusted and none for off-trusted
C.
None for on-trusted and tunnel v2.0 for off-trusted
D.
Tunnel v2.0 for on-trusted and none for off-trusted
When trusted corporate locations already forward traffic through GRE or IPSec tunnels, Client Connector should not create a second tunnel on top of the location tunnel while the device is on the trusted network. Off trusted network, however, the client must create its own Tunnel 2.0 path to the Zero Trust Exchange. Option C (None for on-trusted and tunnel v2.0 for off-trusted) is correct because the recommended combination is None on trusted and Tunnel 2.0 off trusted.
Why the other options are incorrect:
A. Tunnel v2.0 for on-trusted and tunnel v2.0 for off-trusted: Tunnel v2.0 on a trusted network would duplicate forwarding when GRE/IPSec tunnels already steer location traffic to Zscaler. On trusted networks, the client should not build another tunnel.
B. None for on-trusted and none for off-trusted: None/None leaves Client Connector without tunnel forwarding on both trusted and untrusted networks. That defeats the intended traffic steering design.
D. Tunnel v2.0 for on-trusted and none for off-trusted: Tunnel v2.0 on trusted and none off trusted reverses the desired behavior. Remote/off-trusted users need Client Connector tunneling; trusted locations already use GRE/IPSec.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit