How are you managing Ubuntu laptops with Ansible behind Zscaler?
Asked by
MellowCedar42
Our company recently deployed Zscaler across roughly 300 Ubuntu laptops. Since inbound traffic is now blocked, we can no longer rely on ad-hoc SSH or traditional push-based Ansible for remote troubleshooting and management. For teams running Linux fleets in a similar setup, what approach has worked best? Are you using ansible-pull through an internal Git service, ZPA client-to-client connectivity, or another outbound-management solution?
Answers
If you’re using ZPA, client-to-client connectivity may be the cleanest option. Install the ZPA client on the Ansible controller as well, then create an application policy that allows the controller to reach the laptops. You’ll need a predictable naming or segmentation scheme for the endpoints.
Reply to this answer
If ZPA isn’t practical, ansible-pull is probably the next best fit. Have each laptop pull its configuration from internal Git over HTTPS on a systemd timer, with a randomized delay so all 300 machines don’t check in at once. Track the last successful pull and alert when a device has gone stale. For interactive support, use an agent-based tool that establishes outbound sessions over 443.
Reply to this answer
First confirm whether the problem is actually Zscaler Internet Access. If the laptops are using ZIA rather than ZPA, it generally shouldn’t block inbound SSH by itself. A host firewall policy pushed alongside the client may be what changed. It’s worth checking that before redesigning the entire management workflow.
Reply to this answer
Add your answer
Answers are reviewed before publication.
VividMaple31: That makes sense. The security team has also mentioned a separate connector product, but it isn’t currently available for Linux and is treated as an expensive legacy option, so it may not be realistic for this fleet.