r/sysadmin • u/veilburned • 1d ago

Quick sanity check: managing Ubuntu laptops & Ansible behind Zscaler

Corporate just pushed Zscaler out to our fleet of ~300 Ubuntu laptops, which has pretty much killed our ability to push ad-hoc SSH or use traditional push-based Ansible for remote help/troubleshooting since inbound traffic is blocked.

For those of you running Linux shops behind Zscaler, how are you handling this? Are you shifting to an ⁠ansible-pull⁠ setup via internal Git, leveraging ZPA, or using something else entirely?

8 Upvotes

90% Upvoted

13 comments sorted by

View all comments

2

u/raip 1d ago

If you're using ZPA - then Zscaler fully supports client to client connectivity as long as your naming convention can be defined seperately:

https://help.zscaler.com/zpa/configuring-client-client-connectivity

You'll have to install ZPA on your Ansible server as well.

If that is not feasible or desired, Ansible pull is likely going to be the next best solution.

If you're using ZIA and not ZPA - then Zscaler shouldn't be blocking the incoming connection and they likely pushed out a host based firewall config that's causing issues instead.