Sold by: Zscaler, Inc.Â
Deployed on AWS
The ZPA Private Service Edges are brokers that are a single-tenant instance that provide the functionality of a ZPA Public Service Edge in an organization's environment. Your organization hosts them either within your site or on a cloud service, but Zscaler manages them. On the other hand, ZPA Public Service Edges are deployed in Zscaler data centers around the world.
As with a ZPA Public Service Edge, a ZPA Private Service Edge manages the connections between Zscaler Client Connector and App Connectors. It registers with the ZPA Cloud. This allows a ZPA Private Service Edge to download the relevant policies and configurations so it can enforce all ZPA policies. It also caches path selection decisions.
ZPA Private Service Edges can be deployed in several forms. Zscaler distributes images for deployment in enterprise data centers and local private cloud environments such as VMware.
4.5
Overview
A key component of the Zscaler cloud, Service Edges are full-featured secure internet gateways that provide integrated internet security.
ZPA Private Service Edges provide the following benefits and enable you to:
Implement Zero Trust Network Access (ZTNA) for on-premises users. Securely access applications when ZPA Public Service Edges in data centers are not conveniently located between users and the applications they need to reach.
Ensure business continuity and continued access to critical apps during disaster events.
Keep application data traffic local to help meet compliance and regulatory requirements.
Service Edges can be public or private. ZPA Public Service Edges, addressed here, are deployed in Zscaler data centers around the world and can handle hundreds of thousands of concurrent users with millions of concurrent sessions. So, regardless of where your users are physically located, they can access their internal applications from any device. ZPA Public Service Edges enforce access and reauthentication policies based on your organization's corporate best practices. For any given Microtunnel (M-Tunnel), the Control Service Edge is the ZPA Public Service Edge that handles cloud-level system messages to establish the M-Tunnel. ZPA Private Service Edges are fully functional single-tenant brokers that reside within your site or other locations, like cloud services.
Both Zscaler Internet Access (ZIA) and ZPA have Service Edges. The fundamental difference between a Service Edge used for ZIA and one used for ZPA is that:
In ZIA, the Service Edge inspects the data as traffic flows through it. In ZPA, the Service Edge does not inspect the data as traffic flows through it. All Service Edges have significant fault tolerance capabilities. They are deployed in active-active mode to ensure availability and redundancy, and Zscaler monitors and maintains its Service Edges to ensure continuous availability.
User traffic is not passed to any other component within the Zscaler infrastructure, and Service Edges never store any data to disk. Packet data is held in memory for inspection, and is either forwarded or dropped based on policy. Log data generated for every transaction is compressed, tokenized, and exported over secure TLS connections to log routers.
For ZPA Public Service Edges, the log routers direct the information to the Log Streaming Service (LSS), hosted in the appropriate geographical region for each organization.
Highlights
- The ZPA Central Authority (CA) can be thought of as the "brain and nervous system" of the ZPA cloud. It monitors the cloud and provides a central location for software and database updates, as well as policy and configuration settings.
- The ZPA Admin Portal is the central point of control for the entire system. This interface enables organizations to configure system elements, including applications, servers, and policies, and provides analytics dashboards for visibility into the system as a whole.
- All Service Edges have significant fault tolerance capabilities. They are deployed in active-active mode to ensure availability and redundancy, and Zscaler monitors and maintains its Service Edges to ensure continuous availability.
Details
Sold by
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Rhel 9
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing and entitlements for this product are managed through an external billing relationship between you and the vendor. You activate the product by supplying a license purchased outside of AWS Marketplace, while AWS provides the infrastructure required to launch the product. AWS Subscriptions have no end date and may be canceled any time. However, the cancellation won't affect the status of the external license.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Vendor refund policy
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA)Â .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Please utilize this link to access Release Notes: https://help.zscaler.com/zpa/zpa-private-service-edge-release-summary-2024Â
Additional details
Usage instructions
In order to acquire a license key for this product, please contact us via our web form here: https://www.zscaler.com/company/contact .
Once complete, you may access the User Interface of the Zscaler Cloud Portal by accessing this link here: https://admin.zscaler.net/Â . If not completed prior, you will be promoted to create an Admin account for your Zscaler Cloud Portal.
Utilizing the login you created, you may now utilize the Zscaler Cloud Portal to access your Zscaler management console where you will be able to manage and deploy new products on AWS, or other locations.
For ZPA Private Serive Edge AWS Deployment see the below:
Update the Security Group associated to the App Connector to temporarily allow inbound access on port 22, then complete the following steps to connect to the instance.
SSH access is required in order to configure the provisioning key for the App Connector. See instructions: https://help.zscaler.com/zpa/private-service-edge-deployment-guide-amazon-web-servicesÂ
Log in to the App Connector console using your AWS Private Key (i.e., a .pem file).
SSH access is enabled by default on AWS App Connectors, so there is no need to enable the service manually.
Using a standard SSH client, enter the following command to connect to the AWS instance: ssh -i <AWS Private Key> admin@<App Connector Public Hostname or IP Address>
For example, the private key for the AWS instance is AWS.pem and the ZPA Private Service Edge IP address is 35.160.130.25: ssh -i AWS.pem admin@35.160.130.25
Resources
Support
Vendor support
Zscaler global support is available around the clock, with dedicated customer support engineers providing personalized assistance to ensure that customers are getting the most value from our products. Our support engineers have significant experience in networking and security, working closely with operations, sales, and engineering teams to ensure rapid response and resolution.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Private Cloud Controllers allow users to continue to access applications during ZPA-related cloud outages or internet service provider (ISP) outages. Business Continuity helps organizations achieve uninterrupted access to applications without any manual intervention.
Private Cloud Controllers can be deployed in several forms. Zscaler distributes a standard virtual machine (VM) image for deployment in enterprise data centers, local private cloud environments such as VMware, or public cloud environments such as Amazon Web Services (AWS), Microsoft Azure Cloud, or Google Cloud Platform. Additionally, Zscaler provides packages that can be installed on supported Linux distributions. Typically, the VM images are deployed on network segments that can access the ZPA cloud and accept inbound connections on port 443 simultaneously, such as in a DMZ. Private Cloud Controllers require inbound 443 and outbound 443 connections to be open.
ZPA Connectors provide the secure authenticated interface between a customer's servers and the Zscaler Private Access cloud.
App Connectors can be deployed in several forms. Zscaler distributes a standard virtual machine (VM) image for deployment in enterprise data centers, local private cloud environments such as VMware, or public cloud environments such as Amazon Web Services (AWS) EC2. Additionally, Zscaler provides packages that can be installed on supported Linux distributions.
Connectors can be co-located with your enterprise applications, or they can be deployed in any location that has connectivity to the applications. Typically, they are deployed on network segments that can access secured applications and the ZPA cloud simultaneously, such as in a DMZ. Connectors only connect outbound; they do not need any inbound open ports to operate correctly.
Discover a comprehensive suite of Zscaler Cloud Security Solutions on AWS Marketplace. Protect your cloud journey with Cloud Connector, Private Access, Internet Access, and more, ensuring secure and compliant access to applications and the internet.
Zscaler Private Access (ZPA) Network Connectors provide a secure authenticated interface between remote network segments and the ZPA cloud, and help enable end-to-end secure remote access. Network Connectors are part of the VPN (for Legacy Apps) solution and build the inside-out tunnel to VPN Service Edges and ZPA Public Brokers. You can deploy Network Connectors in two forms:
A standard virtual machine (VM) image for deployment in datacenter and campus remote sites.
AMI images for Amazon Web Services (AWS) EC2 and VM images for Microsoft Azure.
Additionally, Zscaler provides packages that you can install on RHEL (9.x) Linux distributions. Network Connectors allow seamless connectivity to specific network segments and can be deployed in any location that has connectivity to the ZPA cloud. Like App Connectors, Network Connectors connect outbound only and do not require inbound open ports for operation.
Customer reviews
Automotive
Fast, Safe, and Frictionless Access
Reviewed on Dec 03, 2025
Review provided by G2
What do you like best about the product?
What I appreciate most about Zscaler Private Access is its ability to deliver secure and seamless access to internal applications without the need for traditional VPNs. By adopting a zero-trust approach, it not only reduces the attack surface but also enhances the user experience and streamlines access management.
What do you dislike about the product?
One aspect I find frustrating about Zscaler Private Access is that troubleshooting can be quite difficult at times. Since access is separated from the underlying network, resolving connectivity problems often means working through several layers, including policies, connectors, identity, and application settings.
What problems is the product solving and how is that benefiting you?
Zscaler Private Access addresses the shortcomings of traditional VPNs by offering secure, identity-based access to internal applications without exposing the entire network. By removing the need for full tunnel VPNs, it helps reduce the attack surface and blocks lateral movement within the network. For me, this results in enhanced security, easier access management, and a noticeably faster, more seamless user experience.
Drishti C.
Seamless Zero-Trust Access That Replaces VPNs Effortlessly
Reviewed on Dec 02, 2025
Review provided by G2
What do you like best about the product?
I like that Zscaler Private Access completely removes the need for traditional VPNs. It provides seamless, zero-trust access to internal applications without exposing the network, which significantly reduces attack surfaces. The user experience is smooth, connections are fast, and access policies are easy to manage across distributed teams.
What do you dislike about the product?
I don’t dislike much about ZPA, but when something does go wrong, it’s not always obvious where the issue is whether it’s connectivity, policy, or the Zscaler client. It takes a bit of learning to get comfortable with the troubleshooting flow.
What problems is the product solving and how is that benefiting you?
ZPA has solved a lot of the friction I used to face with VPNs, slow logins, dropped connections, and access issues when working remotely. Now I can securely access internal apps instantly, and everything runs in the background. It’s more secure and way more convenient.
Suren B.
Seamless Zero-Trust Access That Elevates Security and User Experience
Reviewed on Nov 26, 2025
Review provided by G2
What do you like best about the product?
I like that Zscaler Private Access provides seamless, zero-trust access to internal applications without requiring a traditional VPN. It improves security and user experience while reducing dependency on network-based access.
What do you dislike about the product?
Sometimes the troubleshooting process can be challenging because logs and error messages aren’t always clear, and diagnosing connectivity issues often requires multiple tools and steps.
What problems is the product solving and how is that benefiting you?
Zscaler Private Access is solving the challenge of secure remote access without relying on traditional VPN infrastructure. By channelizing traffic at the application level instead of providing full network access, it significantly reduces unnecessary network load and improves performance. This approach not only minimizes network congestion but also enhances security by eliminating lateral movement.
From a user perspective, it provides seamless and reliable connectivity to internal applications while reducing dependency on network routing or multiple access gateways. Overall, it simplifies access, increases efficiency, and delivers a better user experience while strengthening the organization’s Zero Trust security posture.
From a user perspective, it provides seamless and reliable connectivity to internal applications while reducing dependency on network routing or multiple access gateways. Overall, it simplifies access, increases efficiency, and delivers a better user experience while strengthening the organization’s Zero Trust security posture.
Abdallah A.
Secure, Fast, and Seamless Access Without a VPN
Reviewed on Nov 14, 2025
Review provided by G2
What do you like best about the product?
It provides secure, fast, and seamless access to internal applications without using a traditional VPN.
Most secure (Zero Trust)
Much faster than VPN
Only gives access to the specific app, not the whole network
Most secure (Zero Trust)
Much faster than VPN
Only gives access to the specific app, not the whole network
What do you dislike about the product?
It can be expensive and requires skilled setup at the beginning.
Higher cost than normal VPN
Needs proper configuration by IT
Fully depends on internet connectivity
Higher cost than normal VPN
Needs proper configuration by IT
Fully depends on internet connectivity
What problems is the product solving and how is that benefiting you?
Zscaler Private Access solves VPN performance and security problems by giving users fast, secure access only to the specific internal apps they need. It benefits me by providing smoother access, better security, and no VPN hassle.
Zakaria K.
Exceptional Privacy and Support, Pricing a Bit Steep
Reviewed on Nov 14, 2025
Review provided by G2
What do you like best about the product?
I appreciate Zscaler Private Access for its exceptional customer service, which ensures that all my queries and concerns are addressed promptly and efficiently. The sustainability aspect of the product is another major plus, as it aligns with my values and the company's commitment to long-term operational responsibility. Together, these aspects enhance my overall experience with Zscaler Private Access, making it a reliable choice for accessing private applications while maintaining privacy.
What do you dislike about the product?
I think the pricing can be adjusted.
What problems is the product solving and how is that benefiting you?
I use Zscaler Private Access for accessing private apps, and it helps keep privacy intact. I appreciate the excellent customer service and sustainability.