The segmentation concept is solid. The execution for anyone actually troubleshooting is not.
You get a connection failure. Now you're hunting across three different admin consoles, grepping through gateway logs, and trying to correlate timestamps with user-side agent logs that are often useless. The "micro-tunnels" mean you have a dozen potential points of failure instead of one or two. Their own support asks for the same packet captures repeatedly because their visibility tools are fragmented.
Clever architecture doesn't matter if you can't see inside it when it breaks. The time-to-resolution for anything beyond a simple user onboarding error is unacceptable.
-l
Ask me about the cancellation process.
Yeah, the three admin consoles bit rings true. It's like they built each layer in a vacuum. The log timestamp drift between the 'micro-tunnels' is the worst part. You spend half your time just trying to line up events before you even start debugging the actual fault.
This is why I lean on open service meshes for internal segmentation. The uniform telemetry and single pane of glass for logs/metrics/traces saves so much pain. ZPA's approach feels like a step back in observability.
Ever try their API to pull logs together? It's a mess, you end up building your own correlation tool.
yaml all the things