Does the Cloud Firewall detect evasion techniques that would allow applications to communicate over non-standard ports to bypass its controls?

Zscaler Cloud Firewall incorporates advanced Deep Packet Inspection (DPI) alongside signature-based and behavioral analysis to identify applications regardless of port, protocol, or evasion attempt. When an application attempts to evade security controls by communicating over non-standard ports (such as SSH running over port 80 or HTTP over non-standard high ports), the Cloud Firewall's DPI engine inspects payload headers and characteristics. Upon identifying the true application layer protocol, it dynamically categorizes the traffic and routes it to the corresponding policy and inspection engines, such as the ZIA proxy engine or Cloud IPS, ensuring full control and preventing evasion.

B. Endpoint firewalls and ZCC route traffic, but detection of network protocol evasion on active traffic flows is handled centrally by Zscaler Cloud Firewall's DPI.

C. On-premise firewalls do not normalize or correct traffic protocols for cloud forwarding; Zscaler inspects all arriving traffic independently in the cloud.

D. The Cloud Firewall does not blindly block all non-standard traffic via IPS; it inspects and routes identified traffic to specific policy engines for handling.

1. Zscaler Help Portal: "About Cloud Firewall", Section "Deep Packet Inspection and Application Identification", https://help.zscaler.com/zia/about-cloud-firewall

2. Zscaler Technical Reference: "Zscaler Internet Access Architecture: Firewall and IPS Engines", Section "Protocol Evasion Detection", https://help.zscaler.com/zia/firewall-control