Been running Zscaler ZIA for a year now, replacing our legacy proxies. The performance claims are mostly true, but the operational overhead is massive and poorly communicated.
The biggest gaps:
* **Tunnel management is brittle.** The Zscaler Tunnel Protocol (ZTP) client for data centers is a black box. When it fails, you get zero useful logs.
* **App-based policies break CI/CD.** If you rely on IP-based allow lists for SaaS APIs (e.g., GitHub, Artifactory), Zscaler's app-id-centric model breaks them. You must shift to SNI-based rules, which many legacy automation scripts don't handle.
* **SSL inspection kills some internal tools.** We had to create a massive bypass list because internal monitoring agents and legacy apps with pinned certificates just stop working.
Example of the SNI rule you'll need for automation:
```
rule name "GitHub API Automation"
source ip 10.10.10.0/24
destination fqdn github.com
sni github.com
action allow
no ssl inspection
```
The cost of "simplification" is re-engineering your entire network traffic policy. Bandwidth savings are real, but the engineering effort to get there is 3x what they tell you.
Benchmarks or bust.
Oh wow, the SNI rule example is super helpful, thanks! I'm just starting with cloud infra, and our team is talking about a zero-trust vendor POC. The CI/CD point is a real eye-opener.
>the operational overhead is massive
This is what I worry about. Was the extra engineering effort mostly network team work, or did developers have to rewrite a bunch of their automation too? Trying to figure who gets the extra tickets.