ZIA
URL filtering, IPSec credentials, and locations run against the FedRAMP High cloud zscalerten.net. An administrator signs in on the ZIA page; the cloud service API key stays in this account.
ZPA
The ZPA console will hold private application access, connector groups, and the policy areas you choose next.
GovCloud host
The site is built for Ubuntu and nginx in AWS GovCloud. URL filtering calls the ZIA API for zscalerten.net. ZPA stays off until that cloud and its workflows are provided.
- Status
- Loading
- Account
- Loading (Loading)
- Region
- Loading
- VPC
- Loading
- Private subnet
- Loading
- NAT subnet
- Loading
- NAT Elastic IP
- Loading
- Public name
- Loading
- Web server
- Loading with Loading
- Health
- Checking
- Address
- Not assigned
Network
The web host is in private subnet 172.16.0.0/24. Its outbound traffic goes through a NAT gateway. Visitors reach nginx through a load balancer in the public subnet. Administration is through Systems Manager, so SSH is not open.
- VPC
- 172.16.0.0/16, DNS hostnames enabled
- Private subnet
- 172.16.0.0/24, default route to the NAT gateway
- Public subnet
- 172.16.1.0/24, default route to the internet gateway
- NAT gateway
- In the public subnet, with the Elastic IP
- Ingress
- TCP 80 and 443 on the load balancer, forwarded to nginx
Still needed
- ZPA cloud name.
- A ZIA administrator username and password. The password is entered on the ZIA page and is not stored. The cloud service API key is in Parameter Store.
- The first ZPA workflows to put in the console.
- Source addresses that should be allowed to reach the site, if ports 80 and 443 should not stay open.