Zscaler Integration

Zscaler Integration

Before you begin

• Your unique Lumia CA Certificate (.pem)
• Your Lumia Proxy URL

Prerequisite: Block HTTP/3 (QUIC)

• Ensure your Zscaler deployment is using Tunnel 2.0 (required to identify and block QUIC traffic).
• Follow Zscaler’s documentation to disable and block QUIC. If QUIC is not blocked, AI interactions may bypass Lumia, resulting in a loss of visibility.

Installation Steps

Step 1: Trust Lumia’s CA Certificate

1. Login to the Zscaler Admin Console (admin.zscaler.net).
2. Click Administration, then Root Certificates.

3. Click on Add Root Certificate.

4. Fill in the following fields:
• Name: Enter Lumia Forward CA.
• Type: Select Proxy Chaining.

5. Click Choose File and select the Lumia provided certificate file (.pem), then click on Save.

Step 2: Configure a Forwarding Proxy

1. Open the Administration menu again, and click Proxies & Gateways.

2. Click Add Proxy.

3. Configure the following:
• Proxy Name: Enter Lumia Forward Proxy.
• IP Address / FQDN: Enter your unique Lumia Proxy URL.
• Port: 8080.
• Proxy’s Root Certificate: Select the Lumia Forward CA you created in Step 1.

4. Enable Insert X-Authenticated-User and Enable Base 64 Encoding for X-Authenticated-User.
5. Click Save.

6. Switch to the Proxy Gateways tab.

7. Click Add Gateway for Proxies.

8. Configure the following:
• Gateway Name: Enter Lumia Forward Gateway.
• Fail Close: Disable (This ensures that if the Lumia proxy is unreachable, user internet access will not be interrupted).
• Primary Proxy: Select the Lumia Forward Proxy you just created.

9. Click Save.

Step 3: Create a URL Category

💡

Important: In this step, you will create a Lumia URL category. Please pay close attention to entering the domains specifically in the URLs Retaining Parent Category field. Entering them here, rather than in the standard URL field, ensures the domains stay in your existing categories while being added to Lumia. This keeps your current security policies fully active while adding Lumia’s protection.

If you have any concerns, please contact us.

1. Click Administration in the left main menu.
2. Select URL Categories.

3. Click Add URL Category.

4. Configure the following settings:
• Name: Enter Lumia Forward Category.
• URLs Retaining Parent Category: Enter the following domains:
• chatgpt.com
• claude.ai
💡
Note: To ensure a smooth integration, start with these two domains only. Once the technical setup is verified, Lumia will provide you with the complete list of AI domains to be added.
5. Click Save.

Step 5: Create a Lumia Forwarding Policy

1. In the left menu, Click Policy, then click Forwarding Control.

2. Click Add Forwarding Rule.

3. Enter the Rule Name: Lumia Forwarding Rule.
4. In the Forwarding Method field, select Proxy Chaining.

5. Click the Destination tab, then select URL Category.

6. Select the Lumia Forward Category you previously created.

7. In the Forward to Proxy Gateway field, select the Lumia Forward Gateway you previously created.

8. Click Save.

Step 6: Exempt Lumia Domains from SSL Inspection (For PAC File Setups Only)

⚠️

Note: This step is required only if your tenant uses both Zscaler forwarding and PAC forwarding together.
If Lumia hasn’t specifically requested this exception, there’s no need to add it.

A. Create a Destination Group:

1. Go to Administration then click Destination IPv4 Groups.
2. Click Add Destination IPv4 Group.

3. Configure the following settings:
• Name: Enter Lumia FQDN Wildcard.
• Type: Select Wildcard FQDN.
• Wildcard FQDN: Enter *.lumiasecurity.com.
4. Click Save.

B. Create the Bypass Rule:

⚠️

Important: We will now create a Bypass rule (”Do Not Inspect”) for the Lumia URLs. Since Zscaler evaluates rules from top to bottom, this new rule must be placed before the inspection rule created in Step 4 to ensure the bypass takes effect.

1. Go to Policy, then click SSL Inspection.
2. Click Add SSL Inspection Rule.
3. Configure the following settings:
• Rule Name: Enter Bypass Lumia FQDN Wildcard.
• Rule Order: Set it so that it applies before the inspection rule.
• Destination Groups: Select Lumia FQDN Wildcard.

4. In the Action field, select Do Not Inspect, then select Bypass Other Policies.
5. Click Save.

Next Step