Chapter 2: Understanding the Modular Zscaler Architecture

In this chapter, we will introduce the modular and highly available architecture of Zscaler. Both Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) use the same core Zscaler infrastructure, the only difference being the interaction of the various components for their specific purpose. The focus here will be the ZIA architecture, but the ZPA architecture is covered in detail in Chapter 7, Introducing ZTNA with Zscaler Private Access (ZPA).

Zscaler has several clouds and has been adding more, as dictated by customer demand. Each Zscaler cloud consists of the Central Authority (CA); Zscaler Public Service Edges (PSEs), previously called Zscaler Enforcement Nodes (or ZENs); and Nanolog clusters. We will also mention Zscaler's Single-Scan Multi-Action (SSMA) technology that makes it so efficient and offers superior performance.

In this chapter, we are going to cover the following main topics:

• Introducing...

Introducing the Zscaler cloud architecture

Let's get started with an overview of how the Zscaler cloud is architected to be modular and highly available, which is nowadays a bare-minimum necessity for enterprises.

When an enterprise is provisioned on a Zscaler cloud, they get an instance on that Zscaler cloud. The enterprise administrator then proceeds to customize and configure their security policies and controls in the assigned cloud instance. This configuration includes users, groups, departments, and a collection of management policies and settings. This information is used by the Zscaler component to act on the user traffic and enforce the policies.

The aforementioned configuration resides in the Zscaler cloud CA, which is the core that has the intelligence to manage the entire cloud. It is also the same engine that supplies the necessary information to other Zscaler cloud components to perform their functions. The CA is not just one server somewhere in the cloud;...

Understanding the CA – where the core resides

As mentioned earlier, the CA is where an entire company's data will be stored, relating to users, groups, and departments; configuration such as access policies detailing who will be allowed access to what and when; where and how logging will be performed.

When a new customer is provisioned on a Zscaler cloud after a contract signature, the main contact on the contract is given a Super Admin credential (username and password) into the cloud instance that is created for that customer. The main customer contact can then use those credentials and log in to the Zscaler administration portal for their cloud instance. The customer will then have to decide how to translate their company security policy and configure the Zscaler administration portal that resides in the CA.

After the customer completes this configuration portion, the CA never uses customer information such as username, location, and company name as it is. Instead...

Using Zscaler PSEs – where the policies are applied and enforced

The next important component of the Zscaler cloud is the PSE. Recall that Zscaler sits between the end user and the web destination; so, when the end user is trying to go out to the internet, their first stop is the PSE. The user web traffic directly hits the nearest PSE or the PSE configured by the company administrator.

The PSE being in the data plane, its task is to perform high-speed data-packet inspection and company policy enforcement. When the PSE encounters a new packet for which it does not know the company or user details, it performs a lookup to the CA and asks the CA for details about that packet. It extracts that randomized identifier we talked about in the previous section and uses it to query the CA. The CA returns the identity and the policy information for that identifier in less than a second.

For all subsequent data packets that are part of this traffic session, the PSE remembers this user...

Monitoring user and application activity using Nanolog clusters

The third component of the Zscaler cloud is the Nanolog, which deals with analytics and reporting. This component is important from both a customer and Zscaler perspective. The customer would like to know what kind of data is flowing through their enterprise systems, such as which internet applications are being used, which locations are using the most bandwidth, and if that bandwidth is being spent on productive applications supporting the company's bottom line.

From a Zscaler perspective, it gives information about where the threats are coming from and what types of threats are evolving, and helps Zscaler plan for future growth by adding more capacity to its cloud locations. Of course, it can also be used for advertising and marketing purposes.

Each request from a user appears to be a simple request for a web page on the internet, but the dynamic nature of today's web pages means that this does not just...

Protecting enterprise users and infrastructure with Sandbox

When a malicious piece of software is identified, its signature is usually added to a database. The next time the same signature is observed, it can quickly be flagged after comparing it with a signature already in the database. But how can we identify the signature the first time?

Understanding the need for a sandbox

Enter the sandbox as the solution. In the cloud, it is very easy to provision a sandbox environment, often using automated scripts, then the new piece of code that needs to be tested is executed (a.k.a. detonated) in that environment. From the resulting data, attention is focused on the adverse effects of that code on the environment. Once this is recorded, it is added to the database and propagated to the entire cloud very quickly.

Why do we prefer a cloud sandbox? Consider doing this in an on-premises solution. You need to first provision the hardware necessary and then set up your environment such...

Summary

In summary, we saw that the three major components of the Zscaler cloud—namely, CA, PSE, and Nanolog—are architected in a decoupled manner. This means that each component can be scaled up or down based on its dynamic needs, and the other components will not miss a beat. Each component is also designed to be highly available at every level (component level, data center level, and so on).

It is very important to understand the planes in which each of these components operate and what their individual role is in the entire end-to-end transaction that occurs between the end user and the destination website or web application. This understanding is critical to avoid frequent confusion, moving forward.

We also saw how SSL inspection works and why it is important as more and more web traffic (and bad actors!) continue to use encryption. The use cases for VSEs and sandbox and its various configuration options to suit enterprise needs were also covered. In the next...

Questions

As we conclude, here is a list of questions for you to test your knowledge regarding this chapter's material. You will find the answers in the Assessments section of the Appendix:

1. What are the four components of the Zscaler cloud?
2. Where is the configuration for the enterprise stored in the Zscaler cloud?

   a. CA

   b. PSE

   c. Nanolog cluster

   d. Sandbox

3. The PSE processes the packet in disk memory using a service chain.

   a. True

   b. False

4. SSL inspection is not considered necessary as part of a strong security posture.

   a. True

   b. False

5. By default, the Nanolog clusters store logs for up to:

   a. 3 months

   b. 6 months

   c. 9 months

   d. 12 months

6. A sandbox detonates an unknown piece of code in a safe environment.

   a. True

   b. False

Further reading

• Configuring SAML for ZIA: https://help.zscaler.com/zia/configuring-saml