Hello Zscaler Community,
I would like to check with the community if anyone has experienced an issue during the deployment as we did and how did you manage to overcome such an problem?
Summary:
We bought the ZIA for all of our users where we in process of deployment but we are having a big blocker during this process as we experiencing some quite weird issue with Yellow triangle or Globe icon
(depending on a Windows 10 build version) this problem is not appearing when we are off the VPN (Cisco Anyconnect) But as soon as we connect there is a yellow triangle appearing and causing all O365 application not to work, on other hand there is a internet connectivity all normal but it seems that WIndows NCSI process is failing to do it’s job.
What we have in our setup is ZAPP 2.1.2.81, we have on prem VZEN deployed our LB and having dual arm setup, VZEN is only handling local web traffic and some public websites that are allowing only our public IP so we are anchoring that thru VZEN.
Configuration wise we have APP profile with default PAC file that is responsible for internet traffic and routing everything thru Ztunnel 1.0, nothing fancy there except couple of bypasses for URL’s or routing something to go via on prem VZEN,
next to that we have forwarding profile with Packet Filer + tunnel mode and we are enforcing PAC file to the users by the ZAPP. In that PAC file we have have routing based on SRC and DST ip’s for certain countries to go via their own VZEN’s.
In the begining this issue with NCSI was present on all WIndows 10 Machines as soon as they connect on VPN, but later on we add line in PAC file that i will share below that we belived fixed the issue.
/MS if (shExpMatch(host, "activation.sls.microsoft.com") || shExpMatch(host, "officecdn.microsoft.com") || shExpMatch(host, "*.msftconnecttest.com") || shExpMatch(host, "*.msftncsi.com") || shExpMatch(host, "*.msedge.net") || shExpMatch(host, "*.c-msedge.net") || shExpMatch(host, "msftncsi.com")) { return "PROXY ${GATEWAY_FX}:443; PROXY ${SECONDARY_GATEWAY_FX}:443; DIRECT;" }
So once we added this in the Forwarding profile PAC file this fixed the issue so far for Windows 10 build 1909, but as majority of build version is 1809 this still remains unresolved for them.
From our firewall perspective there is no any kind of blocking toward MS domains or IP’s that are used for testing if there is internet or not (NCSI Probes)
One interesting finding was that if we disable automatic probing in registry and restart the Network Location Awareness service, the yellow triangle is gone even when you are connected on VPN, but this is not a solution since even if you dont have internet it will show normal icon as you would have it.
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator |NoActiveProbe = 0|
So am curious if there is anyone in community that experienced such an issue, and how did you guys fix it?