Zscaler typically recommends that organizations forward traffic to the ZIA Public Service Edges in the Zscaler cloud. However, some organizations might have certain requirements, such as: locations with certain geopolitical requirements and regulations, locations that experience high latency when connecting to Public Service Edge, applications that require an organization's IP address as the source IP address, users who need to see localized content.
If your organization has similar requirements, then with Zscaler's approval, you can extend the Zscaler patented cloud architecture to your organization's premise by licensing and deploying Virtual Service Edge. Virtual Service Edge uses a virtual machine (VM) to function as a full-featured Public Service Edge dedicated to your organization's traffic. Virtual Service Edges perform the same service as the Public Service Edges in the Zscaler cloud, including support for features, such as Firewall, Sandbox, and Data Loss Prevention (DLP).
Virtual Service Edges are part of the Zscaler cloud. They communicate with the Zscaler cloud for user authentication, policy updates, logging, and reporting. Admins define policies only once through the ZIA Admin Portal. Additionally, after users are signed in and authenticated to the Zscaler service, the service always applies their policies, whether they connect to an on-premises Virtual Service Edge or to a Public Service Edge anywhere in the world. Logs are transmitted to and stored on the Zscaler cloud as a central repository for integrated analytics, so you can view and monitor Internet traffic activity on the dashboard and make full use of the real-time logging and interactive reporting capabilities of the service. Your organization has full access to the Virtual Service Edges for monitoring and configuration. Zscaler does not require access to the Virtual Service Edges.
