> For the complete documentation index, see [llms.txt](https://help.verkada.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.verkada.com/verkada-cameras/installation/camera-deployment/troubleshoot-command-display-issues-with-zscaler-internet-access.md).

# Troubleshoot Command Display Issues with Zscaler Internet Access

This article explains how to resolve issues accessing Verkada Command, loading camera thumbnails, or displaying other Command content when using Zscaler Internet Access (ZIA).

***

## 1. Create a hosted PAC file

Create a custom PAC file that bypasses ZIA traffic inspection for Verkada Command and related services.

{% stepper %}
{% step %}
Sign in to the ZIA Experience Center.
{% endstep %}

{% step %}
Navigate to **Infrastructure > Internet & SaaS > Traffic Forwarding > Hosted PAC Files**.

<div align="left" data-with-frame="true"><img src="/files/F4UHdXSg2j7rCUsTwYDX" alt=""></div>
{% endstep %}

{% step %}
Create or edit an existing PAC file and add the following to the FindProxyForURL function:

```javascript
// --- START OF VERKADA BYPASS ---
if (
    // Verkada Core Domains
    dnsDomainIs(host, "verkada.com") || 
    shExpMatch(host, "*.verkada.com") || 
    dnsDomainIs(host, "vkda.co") || 
    shExpMatch(host, "*.vkda.co") || 
    shExpMatch(host, "*.verkada-lan.com") ||

    // LiveKit and Video Streaming Services
    shExpMatch(host, "*.livekit.cloud") ||
    shExpMatch(host, "*.kinesisvideo.*.amazonaws.com") ||
    shExpMatch(host, "verkada-vinter-audio-files-prod1.s3.amazonaws.com") ||
    shExpMatch(host, "*.verkada-vinter-audio-files-prod1.s3.amazonaws.com") ||

    // Mapbox Services
    dnsDomainIs(host, "mapbox.com") ||
    shExpMatch(host, "*.mapbox.com") ||
    shExpMatch(host, "*.tiles.mapbox.com") ||

    // Support and Monitoring Services
    shExpMatch(host, "*.intercomcdn.com") ||
    shExpMatch(host, "*.intercom.io") ||
    shExpMatch(host, "*.browser-intake-datadoghq.com") ||
    shExpMatch(host, "*.twilio.com") ||
    shExpMatch(host, "*.verkada-command.endpoint.csper.io")
) {
    /* If using Z-Tunnel 2.0, replace "DIRECT" with "${ZAPP_TUNNEL2_BYPASS}" */
    return "DIRECT";
}
// --- END OF VERKADA BYPASS ---
```

{% endstep %}

{% step %}
Save the PAC file and apply the configuration.
{% endstep %}

{% step %}
Copy the URL for the PAC file you just edited from the PAC files list. You will need it for a later step.

<div align="left" data-with-frame="true"><img src="/files/aVmDDBP5OWq9B2XKjlSp" alt=""></div>
{% endstep %}
{% endstepper %}

***

## 2. Apply the PAC file to Client Connector profiles

{% stepper %}
{% step %}
Navigate to **Infrastructure > Connectors > Platform Settings > Your operating system**.

The example below uses Windows, but the steps are similar for other operating systems.

<div align="left" data-with-frame="true"><img src="/files/vGYyI71w8durVT2J6o7v" alt=""></div>
{% endstep %}

{% step %}
Add the URL for the PAC file active profile.

1. Under **Traffic Steering**, paste the URL of the hosted PAC file into the **Custom PAC URL** field.

<div align="left" data-with-frame="true"><img src="/files/niUvNbA4CkoIweR3YMqn" alt=""></div>

2. Save the profile.
3. Repeat these steps for additional profiles or operating systems as needed.
   {% endstep %}
   {% endstepper %}

***

## 3. Activate the configuration

{% stepper %}
{% step %}
In the top right corner of the Zscaler Experience Center, click the cloud icon <img src="/files/FpvwK6I5VydS5fIQf4jL" alt="" data-size="line">.
{% endstep %}

{% step %}
Follow the prompts to activate the configuration changes.
{% endstep %}
{% endstepper %}

### Configure Z-Tunnel 2.0

If your deployment uses Z-Tunnel 2.0, complete the additional configuration below.

{% stepper %}
{% step %}
Navigate to **Infrastructure > Connectors > Forwarding Profile for Platforms**.

<div align="left" data-with-frame="true"><img src="/files/bBc9g9IZ9zKP5ycLOZlX" alt=""></div>
{% endstep %}

{% step %}
Edit or clone the forwarding profile used by Verkada administrators.
{% endstep %}

{% step %}
Under **Forwarding Profile Action for ZIA > On-Trusted Network**:

* Set **On-Trusted Network** to **Tunnel**.
* Set **Tunnel Version Selection** to **Z-Tunnel 2.0**.

<div align="left" data-with-frame="true"><img src="/files/rNDYC9FbUL4j6Z5Qq2dq" alt="" height="379" width="495"></div>
{% endstep %}

{% step %}
Expand **Advanced Z-Tunnel 2.0 Configuration**.

1. Enable **Redirect Web Traffic to Zscaler Client Connector Listening Proxy**.
2. Select **Use Z-Tunnel 2.0 for Proxied Web Traffic**.

<div align="left" data-with-frame="true"><img src="/files/uSCQDCo8HwHnjIxkS0D8" alt=""></div>
{% endstep %}

{% step %}
Expand **Configure System Proxy Settings**.

1. Enable **PAC URL Location**.
2. In **Custom PAC URL**, enter the URL of the hosted PAC file created earlier.
   {% endstep %}

{% step %}
Repeat steps 3-5 these steps for:

* **Off-Trusted Network**
* **VPN-Trusted Network** (if applicable)

{% hint style="warning" %}
Alternatively, select **Same as On-Trusted Network**. Review your Zscaler configuration before using this option, as it may affect environment-specific settings. Contact your Zscaler representative or Zscaler Support if you are unsure.
{% endhint %}
{% endstep %}
{% endstepper %}

***

## 4. Verify the configuration

{% stepper %}
{% step %}
Open the Zscaler Client Connector on the workstation experiencing Command display issues.
{% endstep %}

{% step %}
In the left navigation, click **More** (<i class="fa-ellipsis">:ellipsis:</i>).
{% endstep %}

{% step %}
Under **About**, select:

* **Update App**
* **Update Policy**
  {% endstep %}

{% step %}
Reload the browser and verify that Command loads correctly.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
For more information about configuring bypasses with Z-Tunnel 2.0, see the [Zscaler documentation](https://help.zscaler.com/zscaler-client-connector/best-practices-adding-bypasses-z-tunnel-2.0).
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.verkada.com/verkada-cameras/installation/camera-deployment/troubleshoot-command-display-issues-with-zscaler-internet-access.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.