Zscaler App compatibility issue with Cisco ISE agent

Hello! We are currently deploying Zscaler App to customer and having compatibility issue with Cisco AnyConnect Secure Mobility Client. The agent is only for Network access control.
We found that the issue happen when user switch from wired network to wireless network. Both network are also connected to the same corporate network internally. When user switch network, the Cisco AnyConnect Secure Mobility Client will act as NAC solution and check for 3 things before allow the user connect to internal corporate network:

  1. Check if the PC is domain-joined
  2. Check the Antivirus is installed
  3. Check the Virus signature is up-to-date
    After all checking are compliant, user will be allowed to access the internal corporate network.

After installed Zscaler App, we found on Zscaler App that when switch between network, the ZApp will show message that indicate not able to reach internet. This is normal since Cisco agent need to complete the checking before allow the network. However after the Cisco agent completed the checking and show compliant, the ZApp still showing the same error message. We observed the symptom on the affected PC as below:

  • Not able to access any internal website
  • Not able to access internet
  • not able to resolve DNS with internal DNS server
    The issue remain the same when we try to restart the checking on Cisco agent.
    The issue is Intermittent and it does NOT happen every time when switch between network.
    It could only be resumed when user restart the PC.

May I know if there is any previous experience sharing that install Zscaler App to Cisco ISE agent environment, or any other NAC solution?

To add-on, Zscaler support case 984708 is already created.
After several troubleshooting with Zscaler support, we found that the Cisco agent is trying to obtain the loopback address 127.0.0.1 with random port for its services. At the same time, the Zscaler App is also trying to obtain this loopback address for its tunnel to Zscaler cloud (Both tunnel and tunnel with local proxy). However, Zscaler App only requires 127.0.0.1 with 9000 port for its service.

Hence, we found that during the issue happen, we checked the netstat and tasklist that this two agent is conflicting with each other.

Please advise if there is any experience of similar cases?