What transport mechanism will Zscaler Client Connector use to forward traffic to the Zero Trust Exchange when configured for Tunnel 2.0?

Zscaler Client Connector Tunnel 2.0 is designed to forward all user traffic securely to the Zero Trust Exchange using DTLS or TLS transport encapsulation. By default, Tunnel 2.0 establishes a primary DTLS (Datagram Transport Layer Security) tunnel to achieve optimal performance for real-time traffic such as voice and video, avoiding TCP-in-TCP head-of-line blocking. If DTLS traffic is blocked or degraded by network firewalls, Client Connector automatically falls back to a standard TLS (Transport Layer Security) tunnel over TCP port 443. This dual-tunneling transport mechanism guarantees resilient connectivity and complete IP-layer encapsulation for enterprise applications without relying on legacy GRE or IPSec client-to-cloud mechanisms.

A. Tunnel 2.0 utilizes client-initiated DTLS/TLS encapsulation, whereas GRE is used for router-based or edge-location network forwarding.

B. IPSec is an edge/router site-to-site tunneling protocol, not the transport layer protocol leveraged by Client Connector Tunnel 2.0.

D. HTTP Connect tunnels are utilized in Tunnel 1.0 architecture, whereas Tunnel 2.0 relies exclusively on DTLS/TLS encapsulation.

- Zscaler Documentation: "About Zscaler Tunnel 1.0 and Tunnel 2.0", Zscaler Client Connector Help, Section: "Tunnel 2.0 Transport Protocols". https://help.zscaler.com/client-connector/about-zscaler-tunnel-1.0-and-tunnel-2.0

- Zscaler Documentation: "Choosing the Best Traffic Forwarding Method", Zscaler Architecture Series, Section: "Client Connector Forwarding Modes". https://help.zscaler.com/zia/choosing-traffic-forwarding-option