Does round robin work with Zscaler?

Hi Zscaler members,

Let me ask about the Zscaler traffic forwarding method.

One of our customers has 1gbps circuit in their office connected to Zscaler. In order to perform 1gbps traffic bandwidth, they’d like to use the Round-robin algorithm in load balancing with 4 IP addresses, rather than using any supported tunnels such as GRE or IPSec (technically Zscaler supports up to 300mbps throughput per IP with no tunnels)

We’re afraid if this scenario would work as intended. My question is, has Zscaler tech team practiced this scenario before?

Thanks!

As a rule and best practice we prefer a tunnel as we can then glance/hash based on the original source IP, achieving better distribution among all notes in the cluster.

This said, are the clients using Zscaler App or PAC?

  • If using PAC then a tunnel will do much more than optimise the lb paths, it will also associate the user/IP combo, as well as allow traffic to firewall (if PAC+ Tunnel/routing). Deploying with tunnelling is strongly recommended in this scenario.
  • Zscaler App opens some other options as it may natively load-balance in a better manner.

Thank you for responding.

Customer hasn’t decided which forwarding method they’ll use yet. Anyway I understood that Zscaler strongly recommends tunnels when forwarding large-sized traffic to Zscaler. However, customer’s CPE router doesn’t support GRE/IPsec at this time so they want to try to use round robin algorithm with several IPs to achieve 1gbps traffic performance. Do you have any technical advice in this scenario?

Thanks,

To evenly distribute the PAC forwarded traffic among several healthy virtual IPs in a data center, Zscaler enables the PAC server to leverage the {GATEWAY_FX} and {GATEWAY_Fn} variables in the PAC file for Z App and non-Z App users respectively.

For more information you can refer to the following sections of the Writing a PAC File article in our help portal:
https://help.zscaler.com/zia/writing-pac-file#subc-gateway-index-tokens
https://help.zscaler.com/zia/writing-pac-file#subc-dynamic-gateway-tokens

There is an article underway to detail this feature. I will provide the link to the article once it is published in our help portal. Stay tuned!

Understood. Thank you Zscaler members for helping me out!