Before you protect Zscaler data, make sure your environment meets the following requirements for access nodes, network connectivity, and indexing.
-
If you deploy your own access node in your internal network, IP allowlisting is typically not required. Follow the access node deployment documentation, and make sure the Commvault infrastructure can reach your access node.
-
If you use a Commvault-managed access node, allowlist the access node IP address so it can connect to your Zscaler API endpoints. For information about IP allowlisting, see IP Allowlist for Controlling Access to the Command Center.
-
The MediaAgent that runs the Index Server package must be able to communicate with the Command Center over port 443 (HTTPS).
-
Create an active Zscaler OneAPI client with OAuth 2.0 credentials before configuring backups.
-
Assign the required ZIA and ZPA API resources and API roles to the OneAPI client, and synchronize the ZIA role in Zidentity API Resources before assignment.
-
Ensure client access policies permit the Commvault MediaAgent or worker network source.
Required ports
| Source | Destination | Port | Protocol | Purpose |
|---|---|---|---|---|
| Commvault access node | Zscaler OneAPI endpoint | 443 | HTTPS | Zscaler API calls (backup and restore) |
| Commvault access node | Primary Copy MediaAgent | Configured | HTTPS | Backup data transfer to storage |
Note
This workload requires a backup plan whose Primary Copy MediaAgents have the CVS3Service package installed. For details, see Configure and validate backups for Zscaler.