### Install App Connector with Helm (Example) Source: https://help.zscaler.com/zpa/app-connector-deployment-guide-openshift Example command for installing the App Connector with a specific release name. This command assumes you are in the correct directory or have the Helm chart available. ```bash helm install app-connector-multi-demo ``` -------------------------------- ### Example Helm Chart Installation Source: https://help.zscaler.com/zpa/app-connector-deployment-guide-openshift An example of a successful Helm Chart installation for the ZPA App Connector, including the release name and provisioning key. ```bash helm install zpa-connector --set zsglobal.provisionkey.value="1|api.private.zscaler.com|68F0AOEgpcG8McLmwdborq2m6v2A5oNEpSztJ/68F0AOEgpcG8McLmwdborq2m6v2 A5oNEpSztJ/68F0AOEgpcG8McLmwdborq2m6v2A5oNEpSztJ/68F0AOEgpcG8McLmwdborq2m6v2A5oNEpSztJ/68F0 AOEgpcG8McLmwdborq2m6v2A5oNEpSztJ/68F0AOEgpcG8McLmwdborq2m6v2A5oNEpSztJ/68F0AOEgpcG8McLmwdb orq2m6v2A5oNEpSztJ/68F0AOEgpcG8McLmwdborq2m6v2A5oNEpSztJ/68F0AOEgpcG8McLmwdborq2m6v2A5oNEpS ztJ/68F0AOEgpcG8McLmwdborq2m6v2A5oNEpSztJ==" zpa-helm-repo/zpa-app-connector NAME: zpa-connector LAST DEPLOYED: Wed Jan 14 16:21:02 2026 NAMESPACE: default STATUS: deployed REVISION: 1 TEST SUITE: None NOTES: Thank you for installing zpa-app-connector. To learn more about the release, try: $ helm status zpa-connector $ helm get all zpa-connector ``` -------------------------------- ### Enable and Start Systemd Service Source: https://help.zscaler.com/zpa/network-connector-deployment-prerequisites These commands enable the network-connector-firewall service to start on boot and then start the service immediately. ```bash $ sudo systemctl enable network-connector-firewall $ sudo systemctl start network-connector-firewall ``` -------------------------------- ### YUM Transaction Check Output Example Source: https://help.zscaler.com/zpa/network-connector-deployment-guide-linux Example output from the 'yum install np-connector' command showing dependency resolution and package installation details. ```text [admin@np-connector ~]$ sudo yum install np-connector Loaded plugins: fastestmirror, langpacks Determining fastest mirrors * base: mirror.keystealth.org * epel: mirrors.kernel.org * extras: mirror.lug.udel.edu * updates: mirrors.cat.pdx.edu Resolving Dependencies --> Running transaction check ---> Package np-connector.x86_64 0:26.53.4-1.el9 will be installed --> Finished Dependency Resolution Dependencies Resolved ================================================================================ Package Arch Version Repository Size ================================================================================ Installing: ``` -------------------------------- ### Install Google Cloud SDK and ZPA Connector Source: https://help.zscaler.com/zpa/app-connector-deployment-guide-google-cloud-platform Installs the Google Cloud SDK, then installs and configures the ZPA Connector. Ensure you wait for system initialization and stop the service before fetching secrets. ```bash sleep 15 curl -O https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-linux-x86_64.tar.gz tar -xf google-cloud-cli-linux-x86_64.tar.gz export PATH=$PATH:$PWD sudo ./google-cloud-sdk/install.sh # Install App Connector packages yum install -y zpa-connector # Stop the App Connector service which was auto-started at boot time systemctl stop zpa-connector ``` -------------------------------- ### Automate ZPA Service Edge Deployment and Enrollment in GCP Source: https://help.zscaler.com/zpa/private-service-edge-deployment-guide-google-cloud-platform This script automates the setup of a GCP instance, installs the Google Cloud SDK and ZPA Service Edge, fetches a provisioning key from Secret Manager, and enrolls the Service Edge. It includes steps to stop and start the service to ensure proper initialization and updates. ```bash #!/usr/bin/bash # Sleep to allow the system to initialize sleep 15 curl -O https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-linux-x86_64.tar.gz tar -xf google-cloud-cli-linux-x86_64.tar.gz export PATH=$PATH:$PWD sudo ./google-cloud-sdk/install.sh # Install Private Service Edge packages yum install -y zpa-service-edge # Stop the Private Service edge service which was auto-started at boot time systemctl stop zpa-service-edge # Fetch the secret from Secret Manager SECRET_NAME="Provision_key" SECRET_VALUE=$(gcloud secrets versions access latest --secret="$SECRET_NAME") # Use the secret in your application or script echo "The secret value is: $SECRET_VALUE" # Example: Export the secret as an environment variable export MY_SECRET="$SECRET_VALUE" # Create a file from the Private service edge provisioning key created in the Zscaler Admin Console # Make sure that the provisioning key is between double quotes echo "$SECRET_VALUE" > /opt/zscaler/var/service-edge/provision_key chmod 644 /opt/zscaler/var/service-edge/provision_key # Start the private service edge service to enroll it in the Private Access cloud systemctl start zpa-service-edge # Wait for the private service edge to download the latest build sleep 60 # Stop and then start the private servic eedge for the latest build systemctl stop zpa-service-edge systemctl start zpa-service-edge sleep 20 ``` -------------------------------- ### Start App Connector Service Source: https://help.zscaler.com/zpa/managing-deployed-connectors Use `systemctl start` to initiate the App Connector service. This command requires sudo privileges. ```bash $ sudo systemctl start zpa-connector ``` -------------------------------- ### Reload Systemd and Start App Connector Source: https://help.zscaler.com/zpa/connector-deployment-guide-vmware-platforms Reload the systemd manager configuration and start the App Connector service. This is a final step after initial setup. ```bash [admin@zpa-connector ~]$ systemctl daemon-reload ``` ```bash [admin@zpa-connector ~]$ systemctl start zpa-connector ``` -------------------------------- ### Enable and Start Unbound Server Source: https://help.zscaler.com/zpa/configuring-split-dns-zone-connectors Commands to enable the Unbound service to start on boot and then start the service immediately. Also includes a command to check the server's status. ```bash sudo systemctl enable unbound sudo service unbound start ``` ```bash service unbound status ``` -------------------------------- ### Example Certificate Chain File Structure Source: https://help.zscaler.com/zpa/about-uploadingEnrollmentCertificate This example shows the required format for a certificate chain file, including intermediate and root certificates in PEM format. Ensure certificates are ordered correctly, starting with the intermediate certificate. ```text -----BEGIN CERTIFICATE----- MIICujCCAaICAQAwdTEQMA4GA1UEChMHWnNjYWxlcjEXMBUGA1UECxMOUHJpdmF0 ZSBBY2Nlc3MxSDBGBgNVBAMTP21vY2tjb21wYW55LmNvbS9Nb2NrIENvbXBhbnkg wMFowgYcxCzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDESMBAwMFowgYc MDEyMDAwMFowgYcxCzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNYXJ5bGFuZDESMBAG v+PMGxmcJcqnBrJT3yOyzxIZow== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIClDCCAXwCAQAwTzEQMA4GA1UEChMHWnNjYWxlcjEXMBUGA1UECxMOUHJpdmF0 ZSBBY2Nlc3MxIjAgBgNVBAMTGW15LW1vY2tjb21wYW55LmNvbS9hZHNkc2QwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2meeeh24wzQQ48o2lcbhBFYhi slXkLGtB8L5cRspKKaBIXiDSRf8F3jSvcEuBOeLKB1d8tjHcISnivpcOd5AUUUDh v+PMGxmcJcqnBrJT3yOyzxIZow== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIICtzCCAZ8CAQAwcjEQMA4GA1UEChMHWnNjYWxlcjEXMBUGA1UECxMOUHJpdmF0 ZSBBY2Nlc3MxRTBDBgNVBAMTPG1vY2tjb21wYW55LmNvbS9Nb2NrIENvbXBhbnkg Q2xpZW50IFByb3Zpc2lvbmluZyBDZXJ0aWZpY2F0ZTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBAK0vUQx3UYZ1Krlxk2uPfntu8HSDnn+Jwnj7WLkanyvJ YHIHKHFYNs9mHRL2JsMgV3FxOuVMde7y0cdEXOovDsIVF9y/DHNh4cDVN4fKqfcy CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4= -----END CERTIFICATE----- ``` -------------------------------- ### App Connector IP Configuration Example Source: https://help.zscaler.com/zpa/connector-deployment-guide-vmware-platforms Example output from the 'ip addr show' command, illustrating the network configuration for an App Connector. This includes details for loopback and primary network interfaces. ```text 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 100 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: ens192: mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 00:50:56:9b:f4:6d brd ff:ff:ff:ff:ff:ff altname enp11s0 inet 10.66.13.249/24 brd 10.66.13.255 scope global dynamic noprefixroute ens192 valid_lft 690049sec preferred_lft 690049sec inet6 2605:4300:fe00:420d:c724:58a4:2cea:c0fc/64 scope global dynamic noprefixroute valid_lft 2591936sec preferred_lft 604736sec inet6 fe80::fbe0:b0a6:5347:62dc/64 scope link noprefixroute valid_lft 2591936sec preferred_lft 302368sec ``` -------------------------------- ### Automate App Connector Setup on GCP Source: https://help.zscaler.com/zpa/app-connector-deployment-guide-google-cloud-platform This script automates the installation and enrollment of the ZPA App Connector on a GCP instance. It installs the Google Cloud SDK, the App Connector package, fetches a provisioning key from Google Secret Manager, and configures the App Connector service. ```bash #!/usr/bin/bash # Sleep to allow the system to initialize sleep 15 curl -O https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-linux-x86_64.tar.gz tar -xf google-cloud-cli-linux-x86_64.tar.gz export PATH=$PATH:$PWD ./google-cloud-sdk/install.sh # Install App Connector packages yum install -y zpa-connector # Stop the App Connector service which was auto-started at boot time systemctl stop zpa-connector # Fetch the secret from Secret Manager SECRET_NAME="Provision_key" SECRET_VALUE=$(gcloud secrets versions access latest --secret="$SECRET_NAME") # Use the secret in your application or script echo "The secret value is: $SECRET_VALUE" # Example: Export the secret as an environment variable export MY_SECRET="$SECRET_VALUE" # Create a file from the App Connector provisioning key created in the Zscaler Admin Console # Make sure that the provisioning key is between double quotes echo "$SECRET_VALUE" > /opt/zscaler/var/provision_key chmod 644 /opt/zscaler/var/provision_key # Start the App Connector service to enroll it in the ZPA cloud systemctl start zpa-connector # Wait for the App Connector to download the latest build sleep 60 # Stop and then start the App Connector for the latest build systemctl stop zpa-connector systemctl start zpa-connector ``` -------------------------------- ### Create Provisioning Key File Source: https://help.zscaler.com/zpa/service-edge-deployment-guide-centos-oracle-and-redhat Create the provisioning key file with 644 permissions at the specified path. ```bash $ sudo touch /opt/zscaler/var/service-edge/provision_key $ sudo chmod 644 /opt/zscaler/var/service-edge/provision_key ``` -------------------------------- ### Valid and Invalid Base Tokens for Zscaler Regex Source: https://help.zscaler.com/zpa/defining-regular-expression-values Examples demonstrating the requirements for the initial 'base token' in Zscaler regex values, focusing on valid starting sequences. ```regex (1-)?\d{3}-\d{3}-\d{4} ``` ```regex (CA)-\d{6} ``` ```regex 1-\d{3}-\d{3}-\d{4} ``` ```regex \d{3}-\d{3}-\d{4} ``` ```regex [0-9.]{7,15} ``` ```regex \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} ``` ```regex \d{3}-?\d{3}-?\d{4} ``` ```regex \d{10} ``` ```regex \d{3}-\d{3}-\d{4} ``` ```regex [A-Za-z]\d{7} ``` -------------------------------- ### ZPA Private Service Edge OS Update Failure Log Source: https://help.zscaler.com/zpa/zpa-private-service-edge-release-summary-2025 This log shows an example of operating system update failure messages from the ZPA Private Service Edge, indicating issues with package installation and status updates. ```log sarge log Aug 27 22:34:54 acme-544ca.lab.dev zpa-service-edge[1692]: zscaler-update: Using sarge upgrade timeout to 300000 msec Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: zscaler-update: Installing rpm zpa-service-edge-25.46.3214-1.el9.aarch64 failed - Gravitational Teleport packages 3.6 kB/s | 833 B 00:00 No package zpa-service-edge-25.46.3214-1.el9.aarch64 available. Error: No packages marked for downgrade. Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully written upgrade time to JSON file written sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set os_upgrade_fail as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set sarge_upgrade_fail as 13 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set os_upgrade_success as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set sarge_upgrade_success as 4 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set os_upgrade_timeout as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set sarge_os_cfg_read_fail as 9 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set sudo_path_fail as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set package_manager_path_fail as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set yum_utils_install_fail as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set sarge_upgrade_fail_bad_arg as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set sarge_upgrade_fail_timeout as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set sarge_upgrade_fail_no_memory as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set sarge_upgrade_fail_spawn_fail as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set sarge_upgrade_fail_fcntl_err as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set sarge_upgrade_fail_read_sock_err as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set sarge_upgrade_fail_mismatch as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set sarge_upgrade_fail_failed as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set sarge_upgrade_fail_unclean_exit as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set backup_sarge_rollback_success as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set backup_sarge_rollback_fail as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set backup_sarge_rollback_read_fail as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set os_upgrade_skipped as 8 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set sarge_cfg_json_not_found as 0 in sarge_os_upgrade_status.json Aug 27 22:34:56 acme-544ca.lab.dev zpa-service-edge[1692]: Successfully set sarge_cfg_json_read_success as 8 in sarge_os_upgrade_status.json ``` -------------------------------- ### Example Machine Provisioning Key Source: https://help.zscaler.com/zpa/about-machine-provisioning-keys This is an example of a machine provisioning key. Treat this key as a secret and protect it. ```text 3|api.private.zscaler.com|ITfVkU6RBiV8X9fboO3kV3rbBUz5nYBQYfRV03/E0ghCaLgJg5/LmJnjYqF1s53xqClW3/OZXgFTbeAMrPy4utlB6fV5t36wRedYYSgr4I2gXBftPPk5PPOQJ5b5+w178hlWrJeIU8WbdjjF5f5iJPlUBileIqieEUskqwNgzehZ+3B37DitvAjS8RvVxRQwDR31mfcxAzMxCGuDW31eCz3b50NisU1ujGCGyuna+0hFMx02NJ76HogurPr4VZI1MMQcocW5xk6CMyBP8cPJ9Ja7MqrB2/wTSzk7ctGb2t72/EIdr2+7eyCGDO8/AkZRUfqyUPGGXvipsmG51QysnCO/6xvSMNBjcR/3qrZ9A9Ec8GuoiQHkzOfGvhCbbQ+v ```