How are you managing Ubuntu laptops with Ansible behind Zscaler?

The cleanest model is usually to have the laptops connect outward instead of trying to connect into them. Run ansible-pull from a systemd timer, pull from an internal Git repository over HTTPS, and use RandomizedDelaySec so all 300 machines don’t check in at once. Make sure the Git service is reachable through your proxy or published through ZPA, and monitor devices whose last successful pull is more than a day old. For interactive support, use an agent that establishes an outbound session over 443, and coordinate any required SSL-inspection bypasses with the network team. If the playbooks manage packages, test carefully alongside unattended-upgrades.

If you’re using ZPA, client-to-client connectivity can work. You’d install ZPA on the Ansible server as well and create an application policy that allows the server to reach the laptops. You’ll need a naming scheme that lets you define the client group separately. If ZPA isn’t an option, ansible-pull is probably the next best approach. Also, if you’re using ZIA rather than ZPA, check whether the real problem is a host firewall policy that was deployed alongside the client, since ZIA alone generally shouldn’t block inbound SSH.

It’s worth working with the proxy and endpoint-security teams before redesigning everything. They may be able to permit traffic from the Ansible server or adjust the laptop firewall policy. Be cautious about proprietary connector options, though—some are expensive and may not even support Linux yet—so an outbound pull model can be more practical.