Amar Jeer

Running Zscaler in 2026: The Admin's Day-2 Guide

November 14, 2026

MIN READ

Running Zscaler in 2026: The Admin's Day-2 Guide

Quick answer: Day one with Zscaler is a rollout project. Day two is everything after: checking whether Zscaler is down when users complain, keeping IP allowlists current, fixing miscategorized sites, chasing certificate errors in developer tools, troubleshooting Client Connector, and answering "why is the internet slow?" This guide covers each task, links to a deep dive on each one, and shows how the same job looks when the secure web gateway runs on the device instead of in a cloud proxy.

Nobody demos day two. The sales cycle is about architecture diagrams and dashboards. The renewal conversation is about everything your team actually spent its time on. If you run Zscaler today, this is the honest list of what that time goes to, and what you can do about each item.

Last updated: November 2026

The day-2 workload at a glance

Six recurring tasks eat most of the operational time on a cloud-proxy SWG. Here's each one, where to go deeper, and how the same work changes with an on-device SWG like dope.security.

Day-2 task	Why it comes up with a cloud proxy	Deep dive	On an on-device SWG
Checking service status	Every web request depends on the vendor's cloud being healthy	Is Zscaler down?	Inspection runs locally; fallback mode keeps cached policies enforcing
Maintaining IP allowlists	SaaS apps and partners see the proxy's addresses, not yours	Zscaler IP ranges	Traffic goes straight from the device to its destination
Fixing miscategorized sites	A wrong category blocks real work until it's corrected	Zscaler Site Review	Custom categories and per-group overrides, live on every endpoint in under a minute
Certificate errors in apps and dev tools	SSL inspection breaks tools that pin certificates or keep their own trust store	Zscaler root certificate	SSL error notifications surface the breakage; bypass in a few clicks
Client Connector problems	The forwarding agent has to stay healthy on every laptop	Client Connector troubleshooting	One lightweight agent, under 100 MB of RAM, Mac and Windows
"The internet is slow" tickets	Traffic detours through a vendor data center	Zscaler speed test	No backhaul; up to 4x faster than legacy proxy SWGs

1. Knowing when Zscaler is the problem

When every web request flows through a cloud, the first question in any incident is whether that cloud is healthy. Zscaler publishes service health, uptime status, and planned maintenance on its Trust Portal. The hard part isn't finding the page. It's telling a cloud problem apart from a client problem, a local network problem, or a single misbehaving site, fast enough that the helpdesk queue doesn't fill up first.

Our runbook, Is Zscaler down? How to check status and keep users working, walks through the triage order, fail-open decisions, and a user comms template. For the longer architectural argument, see Zscaler outage history.

On an on-device SWG: SSL inspection and policy enforcement happen on the laptop. dope.security also includes a fallback mode with cached policies, so a cloud hiccup doesn't have to become a user-facing outage.

2. Keeping IP allowlists current

A cloud proxy changes where your traffic appears to come from. SaaS apps with IP restrictions, partner portals, and geo checks all see the proxy's addresses. That means someone on your team owns the job of keeping those ranges current everywhere they're referenced, and fielding the tickets when one drifts.

Go deeper in Zscaler IP ranges: how to find, allowlist, and maintain them.

On an on-device SWG: with Fly Direct, traffic is inspected on the device and goes straight to its destination. There's no vendor data center in the path.

3. Fixing miscategorized sites

URL categories are only as good as their last update. When a vendor tool, a new SaaS app, or a customer's site lands in the wrong category, users get blocked from real work. Admins then have to check the category, request a change, and set up a workaround while they wait.

Go deeper in Zscaler Site Review: how URL categorization works and how to fix a miscategorized site.

On an on-device SWG: dope.security lets you set allow, warn, or block per category, create custom categories, and override policy per group. Policy lands on every endpoint in under a minute.

4. Certificate errors in apps and developer tools

SSL inspection works by re-signing traffic, and some apps refuse to accept that. Tools that pin certificates or keep their own trust store (package managers, Git clients, container tooling) start throwing errors until someone installs the right root certificate or adds a bypass.

Go deeper in Zscaler root certificate: why developer tools break and how to fix them. For how inspection itself works, see Zscaler ZIA SSL inspection.

On an on-device SWG: dope.security's SSL error notification surfaces broken traffic from certificate pinning, so admins can create a bypass in a few clicks instead of waiting for tickets.

5. Client Connector problems

The forwarding agent is a moving part on every device. When it fails to connect, gets stuck behind a captive portal, or conflicts with a VPN, the user's web access breaks with it. Our Client Connector troubleshooting guide covers the eight errors admins hit most.

On an on-device SWG: the dope.security agent runs in under 100 MB of RAM on Mac and Windows and deploys silently through your MDM. A Fortune 100 company scaled it from 900 to more than 18,000 devices in weeks.

6. "The internet is slow" tickets

Backhaul adds distance, and distance adds latency. Users who are far from a point of presence feel it first. Before you chase it, know what Zscaler's speed test does and doesn't measure: Zscaler speed test explained.

On an on-device SWG: there's no stopover. dope.security delivers up to 4x the performance of legacy proxy SWGs because traffic flies direct.

Frequently asked questions

What does Zscaler administration involve after deployment?

Mostly recurring operations: monitoring service status, maintaining IP allowlists, handling URL miscategorizations, fixing certificate errors from SSL inspection, troubleshooting Client Connector, and investigating performance complaints.

Where do I check if Zscaler is having an outage?

Zscaler publishes service health and planned maintenance on its Trust Portal at trust.zscaler.com. Our status runbook covers how to triage from there.

Does an on-device SWG remove day-2 work entirely?

No. You still set policy, review analytics, and handle exceptions. What changes is that the cloud-proxy tasks (backhaul latency, proxy IP allowlists, dependence on a remote data center for every request) drop out of the list.