Zscaler Client Connector needs to be able to reach the Zscaler Cloud service to update the application, policy, etc. This can be a challenge in an environment without a Default-Route out to the Internet.
A new ZCC feature allows you to configure an explicit proxy (such as ZIA) for this traffic.
This video walks you through how to set this up.
Video - Tunnel ZCC Traffic