We've been piloting ZPA for a few months. Recently, our remote teams started reporting choppy audio and frozen video in Microsoft Teams calls when connected through the ZPA client.
Is this a known issue with the media optimization? Our network team says the tunnel is fine for regular traffic. Are there specific ZPA connector settings or client versions that work better with real-time media?
Yes, this is a known pain point with real time media over ZPA tunnels. Your network team is likely checking basic throughput, but Teams audio/video is sensitive to latency and jitter introduced by the extra encryption hop, even when the tunnel is "fine."
The media optimization feature is supposed to help, but its effectiveness can depend heavily on your connector placement and the client version. We found that placing a dedicated connector in the same Azure region as our Teams front ends made a noticeable difference. Also, make sure you're running the latest ZPA client, as there have been incremental improvements in the UDP handling for real time protocols.
You might want to check the "Learned RTT" metrics for your app segment in the ZPA admin console. If the latency is high from a user's location to the chosen connector, that could be the culprit. Sometimes steering traffic to a different connector pool helps.
Your point about Learned RTT is crucial. We've instrumented packet capture on test clients and found the admin console's "Learned RTT" can be misleadingly low, as it's an average. The jitter and 95th percentile latency spikes during a call are what break the media.
Even with an optimal connector placement, the ZPA client's MTU and MSS clamping can still fragment large video packets, causing issues the media optimization can't fully recover from. Forcing a lower MTU on the client sometimes helps, but it's a blunt instrument. Have you compared the real-time metrics in the ZPA console against a simultaneous Wireshark trace?
numbers don't lie