Troubleshoot Command Display Issues with Zscaler Internet Access

This article explains how to resolve issues accessing Verkada Command, loading camera thumbnails, or displaying other Command content when using Zscaler Internet Access (ZIA).

1. Create a hosted PAC file

Create a custom PAC file that bypasses ZIA traffic inspection for Verkada Command and related services.

Navigate to Infrastructure > Internet & SaaS > Traffic Forwarding > Hosted PAC Files.

Create or edit an existing PAC file and add the following to the FindProxyForURL function:

// --- START OF VERKADA BYPASS ---
if (
    // Verkada Core Domains
    dnsDomainIs(host, "verkada.com") || 
    shExpMatch(host, "*.verkada.com") || 
    dnsDomainIs(host, "vkda.co") || 
    shExpMatch(host, "*.vkda.co") || 
    shExpMatch(host, "*.verkada-lan.com") ||

    // LiveKit and Video Streaming Services
    shExpMatch(host, "*.livekit.cloud") ||
    shExpMatch(host, "*.kinesisvideo.*.amazonaws.com") ||
    shExpMatch(host, "verkada-vinter-audio-files-prod1.s3.amazonaws.com") ||
    shExpMatch(host, "*.verkada-vinter-audio-files-prod1.s3.amazonaws.com") ||

    // Mapbox Services
    dnsDomainIs(host, "mapbox.com") ||
    shExpMatch(host, "*.mapbox.com") ||
    shExpMatch(host, "*.tiles.mapbox.com") ||

    // Support and Monitoring Services
    shExpMatch(host, "*.intercomcdn.com") ||
    shExpMatch(host, "*.intercom.io") ||
    shExpMatch(host, "*.browser-intake-datadoghq.com") ||
    shExpMatch(host, "*.twilio.com") ||
    shExpMatch(host, "*.verkada-command.endpoint.csper.io")
) {
    /* If using Z-Tunnel 2.0, replace "DIRECT" with "${ZAPP_TUNNEL2_BYPASS}" */
    return "DIRECT";
}
// --- END OF VERKADA BYPASS ---

Save the PAC file and apply the configuration.

Copy the URL for the PAC file you just edited from the PAC files list. You will need it for a later step.

2. Apply the PAC file to Client Connector profiles

Navigate to Infrastructure > Connectors > Platform Settings > Your operating system.

The example below uses Windows, but the steps are similar for other operating systems.

Add the URL for the PAC file active profile.

Under Traffic Steering, paste the URL of the hosted PAC file into the Custom PAC URL field.

Save the profile.
Repeat these steps for additional profiles or operating systems as needed.

3. Activate the configuration

In the top right corner of the Zscaler Experience Center, click the cloud icon .

Follow the prompts to activate the configuration changes.

Configure Z-Tunnel 2.0

If your deployment uses Z-Tunnel 2.0, complete the additional configuration below.

Navigate to Infrastructure > Connectors > Forwarding Profile for Platforms.

Edit or clone the forwarding profile used by Verkada administrators.

Under Forwarding Profile Action for ZIA > On-Trusted Network:

Set On-Trusted Network to Tunnel.
Set Tunnel Version Selection to Z-Tunnel 2.0.

Expand Advanced Z-Tunnel 2.0 Configuration.

Enable Redirect Web Traffic to Zscaler Client Connector Listening Proxy.
Select Use Z-Tunnel 2.0 for Proxied Web Traffic.

Expand Configure System Proxy Settings.

Enable PAC URL Location.
In Custom PAC URL, enter the URL of the hosted PAC file created earlier.

Repeat steps 3-5 these steps for:

Off-Trusted Network
VPN-Trusted Network (if applicable)

Alternatively, select Same as On-Trusted Network. Review your Zscaler configuration before using this option, as it may affect environment-specific settings. Contact your Zscaler representative or Zscaler Support if you are unsure.

4. Verify the configuration

Open the Zscaler Client Connector on the workstation experiencing Command display issues.

In the left navigation, click More ().

Under About, select:

Update App
Update Policy

Reload the browser and verify that Command loads correctly.

For more information about configuring bypasses with Z-Tunnel 2.0, see the Zscaler documentation.

Last updated 4 days ago

Was this helpful?