curious if anyone has had some real world experience with what kind of performance impacts/quirks when a customer insists on sticking Zscaler in between the user (on prem) and their (also on prem, but in an isolated network) vdi desktops - i've found a plethora of anecdotal reasons not to do this, and a few official docs flat out saying bypass it (from citrix at least), and obviously from a protocol standpoint it doesn't make sense, but I'm looking at that possibility with a horizon project i'm working on..

I have been forced to use it for some locations. It can kill performance if you don't exclude the Citrix traffic from it.

yeah that's what i've seen talked about across the board - can't imagine why, i mean encapsulating an encapsulated protocol and routing on prem traffic to the internet - i can't imagine why that'd affect performance 😄

most of these (Microsoft with W365/AVD, Citrix, etc.) have specific statements on not supporting doing inspection on the traffic we need for the cloud services, brokering, etc.

We recommend bypassing it. , Zscaler won't be able to understand anything about Blast-over-UDP traffic beyond the source and destination IP+port in the UDP header. Even with TCP I'm not sure they will gather much either especially with the content carried in it.

chris, i don't suppose there's any official documentation on that yes there? i haven't been able to dig any up yet or get any of the AIs to 🙂

It's an absolute clusterfuck, do not do it. I tried to get it working a few years ago and it breaks beacons and callback and optimal gateway routing and pretty much everything that relies on the fact that you normally cannot resolve internal and external endpoints at the same time.

yup - in theory we should be getting a kb article from omnissa talking about not forcing the protocols through sd-wan/sase solutions

I'll see if I can find something, there used to be something on techzone in the uag article about bypassing inspection for blast.. but i cant find it.

we did end up getting an email from one of the product mgmt directors reiterating it was not recommended and certainly not a best practice that has provided some umph to the discussion - supposedly a KB is going to follow, which i think is a real key since the others have public things to point to .. what really gets me is that ultimately all it's doing is moving the DMZ to someone else's datacentre.. and if the connection to the cloud gets interrupted you're done, even if you're using one of their private edge devices to keep traffic local, it still has to authenticate to the cloud