Which Protocols Does Zscaler Support for Secure Network Connections
When teams ask which protocols does zscaler support for secure network connections, the answer is TCP and UDP. It routes web, SSH, and database traffic over TLS tunnels without a full network VPN. Security teams use this model to replace legacy network perimeters. Users and automated workloads reach private internal apps through outbound encrypted tunnels. The service checks identity rules before it opens a path to the host. How which protocols does zscaler support for secure network connecti
Emergency Access Protocols + VNC Secure Access: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
When teams ask which protocols does zscaler support for secure network connections, the answer is TCP and UDP. It routes web, SSH, and database traffic over TLS tunnels without a full network VPN.
Security teams use this model to replace legacy network perimeters. Users and automated workloads reach private internal apps through outbound encrypted tunnels. The service checks identity rules before it opens a path to the host.
How which protocols does zscaler support for secure network connections works in practice
A local client app runs on the developer laptop or workload host. A lightweight connector also runs inside the private cloud or data center. Both pieces make outbound TLS connections to the vendor cloud edge.
When an engineer opens an SSH session or database tool, the local client intercepts the request. It wraps TCP or UDP packets inside the encrypted tunnel. The cloud edge checks the user identity and device status against team rules.
If the policy allows the request, the cloud edge stitches the two tunnels together. The internal connector then forwards the raw TCP or UDP traffic to the private server. The server never exposes an open inbound port to the public internet.
Browser access works without a local client for standard HTTP and HTTPS web apps. For non-web ports like Postgres, MySQL, or Kubernetes APIs, engineers need the local client installed. AI agents and CI runners also need a tunnel client or connector on their host.
Security and operational tradeoffs inside an active session
Transport tunnels solve the network reachability problem well. They stop attackers from scanning private ports from the public internet. They also verify user identity before the TCP handshake finishes.
Still, a TCP or UDP tunnel operates at the network transport layer. Once the tunnel connects to a Postgres database or SSH server, the transport layer steps back. The user or AI agent still needs a database password, SSH key, or API token.
Emergency Access Protocols + VNC Secure Access: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Teams often distribute static credentials or broad role keys so developers can log in. If an engineer runs a destructive SQL command, the TCP tunnel cannot read or block that query. The tunnel only sees raw bytes moving over an approved port.
The same blindness applies to sensitive data returning from a database query. If a query returns customer emails, phone numbers, or card numbers, the TCP tunnel passes them through. Network transport logs record connection times and byte counts, not the exact SQL statements or shell commands.
AI agents make this gap wider during automated tasks. An agent with a valid network path and a broad database role can query any table. Transport rules alone cannot pause a single risky query or rewrite sensitive fields in results.
Where transport tunnels stop and command controls begin
Network tools focus on moving packets from a verified device to an internal IP address and port. That layer is vital for hiding private subnets and replacing old network VPNs. Yet engineering teams also need control over what happens inside the database or shell session.
Relying only on network port rules forces teams to build separate secret workflows and audit pipelines. Combining private network routing with command-level checks closes that visibility gap.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Does Zscaler Private Access support both TCP and UDP traffic?
Yes, it supports unicast TCP and UDP traffic for private internal apps. The local client and internal connector wrap those packets inside encrypted TLS tunnels.
Can Zscaler inspect SQL queries or shell commands inside a private tunnel?
No, private app access works as a transport tunnel for TCP and UDP ports. It verifies identity and routes packets, but it does not parse database queries or SSH commands.
Do engineers still need database passwords or SSH keys over the tunnel?
Yes, the network tunnel only opens the transport path to the host port. The target database or server still asks the client for its own login credentials.