Our company recently deployed Zscaler across roughly 300 Ubuntu laptops. Since inbound traffic is now blocked, we can no longer rely on ad-hoc SSH or traditional push-based Ansible for remote troubleshooting and management. For teams running Linux fleets in a similar setup, what approach has worked best? Are you using ansible-pull through an internal Git service, ZPA client-to-client connectivity, or another outbound-management solution?
3 Answers
First confirm whether the problem is actually Zscaler Internet Access. If the laptops are using ZIA rather than ZPA, it generally shouldn’t block inbound SSH by itself. A host firewall policy pushed alongside the client may be what changed. It’s worth checking that before redesigning the entire management workflow.
If ZPA isn’t practical, ansible-pull is probably the next best fit. Have each laptop pull its configuration from internal Git over HTTPS on a systemd timer, with a randomized delay so all 300 machines don’t check in at once. Track the last successful pull and alert when a device has gone stale. For interactive support, use an agent-based tool that establishes outbound sessions over 443.
If you’re using ZPA, client-to-client connectivity may be the cleanest option. Install the ZPA client on the Ansible controller as well, then create an application policy that allows the controller to reach the laptops. You’ll need a predictable naming or segmentation scheme for the endpoints.
That makes sense. The security team has also mentioned a separate connector product, but it isn’t currently available for Linux and is treated as an expensive legacy option, so it may not be realistic for this fleet.