10.4 Disaster Recovery, Business Continuity & Sub-clouds
Key Takeaways
- Zscaler Sub-clouds provide logically or physically dedicated cloud proxy infrastructure to satisfy strict data sovereignty, regional regulatory compliance, or custom IP egress requirements.
- The Zero Trust Exchange is architected for continuous high availability using Anycast BGP routing across over 150 global data centers with hitless rolling updates.
- Disaster Recovery (DR) in Zscaler Client Connector and ZPA ensures business continuity during extreme disruption by falling back to secondary cloud fabrics or local App Connector caching.
- Enterprises must evaluate the risk trade-offs between Fail-Open policies (prioritizing user internet availability) and Fail-Close policies (prioritizing strict security inspection and data exfiltration prevention).
- The Zscaler Trust Portal (trust.zscaler.com) provides real-time cloud health status, operational telemetry, planned maintenance schedules, and automated incident notifications.
10.4 Disaster Recovery, Business Continuity & Sub-clouds
Quick Answer: Enterprise cloud operations require continuous resilience and regulatory compliance. Zscaler Sub-clouds partition Public Service Edge infrastructure to enforce strict data sovereignty (e.g., EU-only routing or FedRAMP High) and provide dedicated egress IP addresses. Disaster Recovery (DR) Mode in ZCC and ZPA guarantees mission-critical application connectivity if primary cloud paths degrade. Network architects must configure Fail-Open vs. Fail-Close policies to balance availability against security, while continuously monitoring operational status and maintenance windows via the Zscaler Trust Portal (
trust.zscaler.com).
1. Zscaler Sub-clouds & Dedicated Proxy Infrastructure
While the Zscaler Zero Trust Exchange is fundamentally a multi-tenant global cloud, certain enterprise, government, and regulatory mandates require specialized physical or logical infrastructure isolation. A Sub-cloud is a designated collection of Zscaler Public Service Edges configured to process traffic exclusively for an authorized subset of organizations.
+-----------------------------------------------------------------------------+
| ZSCALER SUB-CLOUD ARCHITECTURE |
+-----------------------------------------------------------------------------+
+-----------------------------------------------+
| GLOBAL ZERO TRUST EXCHANGE CLOUD |
+-----------------------------------------------+
/ \
/ \
+----------------------------+ +----------------------------+
| STANDARD MULTI-TENANT | | DEDICATED SUB-CLOUD |
| PUBLIC SERVICE EDGES | | (SOVEREIGN / COMPLIANCE) |
+----------------------------+ +----------------------------+
| * Globally Shared Anycast | | * Restricted Data Boundary |
| * 150+ Data Centers | | * Dedicated IP Egress Pools|
| * Dynamic Geo-Routing | | * Custom Maintenance Cycle |
+----------------------------+ +----------------------------+
^ ^
| |
[Standard Enterprise] [Sovereign Bank / Gov]
Primary Use Cases for Sub-clouds:
- Data Sovereignty & Jurisdictional Compliance:
- Legal frameworks (such as GDPR in the European Union, Swiss Banking secrecy laws, or Australian Privacy Principles) may dictate that enterprise traffic, SSL inspection payloads, and user logs must never leave specified geopolitical boundaries.
- An EU-Only Sub-cloud guarantees that user traffic is processed strictly across Public Service Edges located within EU member states (e.g., Frankfurt, Amsterdam, Paris).
- Government & Defense Certifications:
- Sovereign clouds (e.g., Zscaler for Government / FedRAMP High, DoD Impact Level 5 [IL5]) operate on physically separated, US-soil-only data centers staffed exclusively by screened US citizens.
- Dedicated Egress IP Addresses (Custom VIPs):
- Many third-party SaaS providers and legacy financial partners enforce IP-allowlisting for API access or B2B data exchange. Because standard Zscaler Public Service Edges share egress IP pools among tenants, a dedicated Sub-cloud or Dedicated Egress IP allocation ensures an enterprise has exclusive, predictable public source IPs worldwide.
2. High Availability & Anycast Cloud Architecture
The Zscaler platform eliminates single points of failure across all architectural planes through automated, multi-layered resilience mechanisms:
+-----------------------------------------------------------------------------+
| MULTI-LAYER CLOUD RESILIENCY |
+-----------------------------------------------------------------------------+
1. BGP ANYCAST ROUTING
* Single Virtual IP (VIP) announced from 150+ global data centers.
* If Data Center A fails, upstream Tier-1 ISPs automatically reroute
BGP prefixes to Data Center B in under 3 seconds.
2. CENTRAL AUTHORITY HIGH AVAILABILITY
* Active-Active geo-distributed Central Authority clusters.
* Continuous real-time database replication.
3. HITLESS ROLLING UPDATES
* Edge nodes within a data center are updated sequentially in clusters.
* Active user sessions complete naturally while new sessions route to
updated nodes—zero downtime during weekly maintenance windows.
3. Disaster Recovery (DR) in ZIA & ZPA
Even in a carrier-grade cloud network, extreme force majeure events (such as undersea cable cuts or global Tier-1 ISP routing collapse) necessitate a formal Disaster Recovery (DR) framework.
+-----------------------------------------------------------------------------+
| ZSCALER CLIENT CONNECTOR DR WORKFLOW |
+-----------------------------------------------------------------------------+
[ZCC Endpoint] ---> 1. Primary Public Service Edge (DC 1)
|
x (Unreachable / Keepalive Timeout)
|
[ZCC Endpoint] ---> 2. Automatic Failover to Secondary Edge (DC 2)
|
x (Regional Transit Collapse)
|
[ZCC Endpoint] ---> 3. DR Mode Triggered (Admin-Defined Policy):
|
+-------------+-------------+
| |
v v
[FAIL-OPEN OPTION] [FAIL-CLOSE OPTION]
Bypass Tunnel -> Direct Drop All Outbound Packets
Local ISP Egress Prevent Uninspected Leaks
ZPA Disaster Recovery Architecture:
In ZPA, Disaster Recovery guarantees private application access even if the central cloud management plane becomes temporarily unavailable:
- App Connector & Private Service Edge Local Caching: App Connectors and ZPA Private Service Edges cache active authentication tokens, public keys, and application segment routing tables locally.
- Disaster Recovery App Segments: Critical business applications (e.g., Emergency Payroll, Hospital EHR, SCADA control systems) are tagged as DR Application Segments. During an active DR event, Zscaler Client Connector and App Connectors maintain direct micro-tunnel connectivity without requiring live validation from the central authority.
4. Fail-Open vs. Fail-Close Policy Designs
When designing traffic forwarding profiles in Zscaler Client Connector or configuring branch GRE/IPsec tunnels on SD-WAN edge routers, administrators must explicitly decide whether the network should Fail-Open or Fail-Close if the Zscaler security cloud becomes completely unreachable.
+-----------------------------------------------------------------------------+
| FAIL-OPEN vs. FAIL-CLOSE COMPARISON |
+-----------------------------------------------------------------------------+
FAIL-OPEN (Availability-First):
[User] ===(Cloud Down)===> [Local ISP Direct] ===> [Internet / SaaS]
* Pros: Zero business interruption; users continue browsing and working.
* Cons: Total loss of security inspection, DLP, and threat filtering.
FAIL-CLOSE (Security-First):
[User] ===(Cloud Down)===> [FIREWALL DROP: X ] [Internet / SaaS]
* Pros: Zero uninspected data egress; prevents exfiltration and malware.
* Cons: Complete internet outage for employees until cloud path restores.
| Operational Factor | Fail-Open Configuration | Fail-Close Configuration |
|---|---|---|
| Primary Architectural Priority | Business Availability & Productivity | Strict Data Protection & Compliance |
| Behavior on Tunnel Failure | Traffic bypasses tunnel and routes direct-to-internet via local ISP. | Traffic is dropped; all outbound packets are blocked. |
| Security Posture During Outage | Zero inline inspection; SSL, DLP, and IPS are bypassed. | 100% secure against leaks; no uninspected packets escape. |
| Typical Industry Adoption | Retail, Hospitality, General Commercial Enterprises, Higher Education. | Defense Contractors, Banking/Financial Trading, Healthcare, Intelligence Agencies. |
| Configuration Location | ZCC Forwarding Profile (Bypass ZPA/ZIA) / Router IP SLA route tracking. | ZCC Forwarding Profile (Block All Traffic) / SD-WAN blackhole route. |
5. Zscaler Trust Portal & Operational Change Management
Enterprise administrators manage platform health and maintenance schedules through the official Zscaler Trust Portal at https://trust.zscaler.com.
+-----------------------------------------------------------------------------+
| ZSCALER TRUST PORTAL SERVICES |
+-----------------------------------------------------------------------------+
+-------------------------------------------------------------------------+
| https://trust.zscaler.com |
+-------------------------------------------------------------------------+
| | |
v v v
+---------------+ +---------------+ +--------------+
| LIVE CLOUD | | PLANNED | | INCIDENT |
| STATUS | | MAINTENANCE | | NOTIFICATION |
+---------------+ +---------------+ +--------------+
| * Data Center | | * Rolling OS | | * Automated |
| Health Grid | | Updates | | Email/SMS |
| * Latency & | | * 7-14 Day | | * Webhook to |
| Packet Loss | | Advance Not.| | PagerDuty |
| * Node Status | | * Cloud Range | | * RSS Feeds |
+---------------+ +---------------+ +--------------+
Core Capabilities of the Trust Portal:
- Cloud Instance Selection: Enterprises monitor their specific cloud instance (e.g.,
zscaler.net,zscalerone.net,zscalertwo.net,zscalerthree.net,zscloud.net,zscalerbeta.net, or government clouds). - Active Incident Telemetry: Real-time visibility into degraded data centers, intermediate Tier-1 ISP fiber cuts, or regional routing anomalies.
- Planned Maintenance & Upgrade Notifications: Zscaler publishes maintenance windows well in advance (typically 7 to 14 days prior). Because the cloud uses hitless rolling updates, standard upgrades require zero action from customers.
- Automated Alert Subscriptions: Administrators subscribe to automated notifications via email, SMS, RSS, or webhook integrations into enterprise ITSM tools (such as ServiceNow, Jira, or PagerDuty).
6. Exam Tips & High-Yield Distinctions
[!TIP] Sub-cloud vs. Private Service Edge: Do not confuse a Sub-cloud with a Private Service Edge (PSE):
- Sub-cloud: Dedicated public cloud data centers managed by Zscaler for specific compliance/regulatory partitions.
- Private Service Edge (PSEA / PSE): Dedicated on-premises virtual or physical appliances deployed inside a customer's private data center to process local traffic.
[!IMPORTANT] Identifying Your Cloud Domain: The Zscaler cloud domain on which an enterprise resides (e.g.,
zscalerthree.net) is determined during initial tenant provisioning and never changes. When monitoring health ontrust.zscaler.comor configuring SAML SSO entity IDs, you must select the exact matching cloud name.
What is the primary architectural purpose of deploying a Zscaler Sub-cloud for an enterprise organization?
A financial trading institution mandates that under no circumstances may uninspected employee traffic leave the network, even if the primary and secondary cloud security nodes experience an unprecedented total outage. Which traffic forwarding failure policy must be configured?
How does Zscaler Private Access (ZPA) maintain business continuity for mission-critical applications during a Disaster Recovery scenario where the central management plane is temporarily unreachable?
Where should a Zscaler administrator go to inspect real-time cloud operational status, subscribe to incident notifications for their specific cloud instance (e.g., zscalerthree.net), and review upcoming planned maintenance windows?
You've completed this section
Continue exploring other exams