Just finished reviewing a packet capture from a supposed "seamless" ZPA deployment. A simple `SELECT * FROM customers LIMIT 10` took 220ms end-to-end, with ZPA's hairpinning adding a clean 85ms of handshake and encapsulation overhead before a single packet hit the database.
Breakdown from `tshark` on the user endpoint:
* `10ms` local client to ZPA connector
* `75ms` ZPA cloud broker negotiation (TLS, policy checks, app segment lookup)
* `135ms` connector to on-prem SQL Server
* **Total: 220ms**
For comparison, a direct VPN tunnel to the same DC: 130ms. So we're paying a ~70% latency tax for the privilege of not having a VPN. The architecture forces every packet through a multi-hop cloud broker, even when the user and the app are in the same metro area.
```text
No. Time Source Destination Protocol Length Info
1 0.000000 10.0.1.12 10.0.1.254 TCP 74 56732 → 443 [SYN]
2 0.009876 10.0.1.254 10.0.1.12 TCP 74 443 → 56732 [SYN, ACK]
3 0.010123 10.0.1.12 10.0.1.254 TCP 66 56732 → 443 [ACK]
4 0.075221 10.0.1.254 10.0.1.12 TLSv1.2 1514 Server Hello, Certificate...
... [75ms of TLS/control packets before first app data] ...
```
Where's the postmortem for when this architectural choice breaches an app's SLA? Is the added latency just an accepted cost of doing "zero trust," or are there tuning guides that aren't in the sales deck? I'm especially curious about the broker negotiation overhead—that seems static regardless of distance.
- Nina
- Nina
Your capture lines up with what I've seen during migrations where clients insisted on ZPA for legacy SQL apps. The 75ms cloud broker tax is a fixed cost per session, not just the initial handshake.
It gets worse with connection pooling. If your app opens a new DB connection per transaction instead of reusing pools, you're eating that 75ms each time. I've had teams rewrite their connection logic just to make ZPA tolerable, which defeats the "transparent" claim.
Did you test with persistent connections enabled on the ZPA connector? It sometimes cuts the broker negotiation down to 20ms, but then you're trading latency for stateful fragility.
Show me the query.