A key component of the Zscaler cloud, Service Edges are full-featured secure internet gateways that provide integrated internet security.

ZPA Private Service Edges provide the following benefits and enable you to:

Implement Zero Trust Network Access (ZTNA) for on-premises users. Securely access applications when ZPA Public Service Edges in data centers are not conveniently located between users and the applications they need to reach.

Ensure business continuity and continued access to critical apps during disaster events.

Keep application data traffic local to help meet compliance and regulatory requirements.

Service Edges can be public or private. ZPA Public Service Edges, addressed here, are deployed in Zscaler data centers around the world and can handle hundreds of thousands of concurrent users with millions of concurrent sessions. So, regardless of where your users are physically located, they can access their internal applications from any device. ZPA Public Service Edges enforce access and reauthentication policies based on your organization's corporate best practices. For any given Microtunnel (M-Tunnel), the Control Service Edge is the ZPA Public Service Edge that handles cloud-level system messages to establish the M-Tunnel. ZPA Private Service Edges are fully functional single-tenant brokers that reside within your site or other locations, like cloud services.

Both Zscaler Internet Access (ZIA) and ZPA have Service Edges. The fundamental difference between a Service Edge used for ZIA and one used for ZPA is that:

In ZIA, the Service Edge inspects the data as traffic flows through it. In ZPA, the Service Edge does not inspect the data as traffic flows through it. All Service Edges have significant fault tolerance capabilities. They are deployed in active-active mode to ensure availability and redundancy, and Zscaler monitors and maintains its Service Edges to ensure continuous availability.

User traffic is not passed to any other component within the Zscaler infrastructure, and Service Edges never store any data to disk. Packet data is held in memory for inspection, and is either forwarded or dropped based on policy. Log data generated for every transaction is compressed, tokenized, and exported over secure TLS connections to log routers.

For ZPA Public Service Edges, the log routers direct the information to the Log Streaming Service (LSS), hosted in the appropriate geographical region for each organization.