The only way to deploy inspection is to inspect all traffic. Technically speaking, at an architectural level, there is no way to have exceptions…

Zscaler’s architecture allows very granular SSL inspection and traffic-forwarding policies. Administrators can create explicit “bypass” rules for specific web sites, destination categories, URL patterns, application types, user groups, or even certificate attributes. Therefore, it is technically possible—and fully supported—to exempt selected traffic from inspection; inspecting all traffic is not the only deployment model.

The statement assumes that inspection is an all-or-nothing capability. In reality, the Zscaler proxy architecture was designed for selective inspection based on policy objects, so the premise is incorrect.

1. Zscaler Internet Access Admin Guide, Release 6.1, “SSL Inspection > Creating SSL Inspection Exemptions,” pp. 527-531.

2. Zscaler White Paper, “Best Practices for SSL Inspection,” version 2.0, §3 “Granular Bypass Policies,” p. 7.

3. Zscaler Zero Trust Exchange Architecture Guide, v4, “Traffic Steering and Policy Engine,” p. 12.