A customer requires 2 Gbps of throughput through the GRE tunnels to Zscaler. Which is the ideal architecture?

To achieve 2 Gbps of throughput, multiple GRE tunnels are required, as a single tunnel is typically limited to 1 Gbps. The best practice is to configure two primary tunnels for load balancing and performance, along with backup tunnels for redundancy. These tunnels should originate from border routers to avoid internal traffic hair-pinning. Crucially, NAT must be disabled for traffic sent into the tunnels to preserve the original source IP address, which is essential for Zscaler to apply user-based policies and perform accurate logging.

A. Tunnels from internal routers cause inefficient traffic routing, and enabling NAT breaks user-based policy enforcement and reporting within Zscaler.

C. Tunnels should originate from border routers, not internal routers, to ensure the most direct path to the Zscaler cloud and avoid hair-pinning.

D. Enabling NAT is incorrect as it obscures the original user IP address, which is required by Zscaler for user identification and policy application.

1. Zscaler. (2024). About Generic Routing Encapsulation (GRE). Zscaler Help Portal. "A single GRE tunnel has a maximum capacity of 1 Gbps... To send more than 1 Gbps of traffic, you can configure multiple GRE tunnels".

2. Zscaler. (2024). GRE Deployment Scenarios. Zscaler Help Portal. "Zscaler recommends that you configure the GRE tunnels from your organization's edge or border routers."

3. Zscaler. (2024). Configuring GRE Tunnels. Zscaler Help Portal. "Ensure that you do not have Network Address Translation (NAT) enabled for the traffic that you forward to the Zscaler service."