Overview

This integration redirects all public GenAI traffic to F5 Workforce AI Security through Zscaler proxy chaining with Forwarding Control policies. A custom URL category defines the GenAI traffic. Zscaler sends this traffic through its proxy system. The proxy system then forwards it to the Workforce AI Security Proxy before it reaches the final destination. Both Zscaler and Workforce AI Security log the traffic. You can use either platform to troubleshoot or analyze it.

The policy redirects public GenAI access to Workforce AI Security for every user whose traffic matches it. Make sure you understand this redirect before you set up the integration. You must configure the X-Authenticated-User (XAU) header in the proxy settings. Users then see no authentication prompts. Without the XAU header, users must first authenticate with single sign-on (SSO). Only then can they use any GenAI service that Workforce AI Security governs.

For proof-of-concept or pilot deployments, set specific criteria in the Zscaler Forwarding Control policy. This redirects traffic for a subset of users or groups. Zscaler licensing might limit how you can segment users. Before you set up a limited deployment, ask your Zscaler technical representative whether you can segment policy rules by group.

Prerequisites

Before you configure Zscaler, verify the Zscaler environment requirements. Distribute the SurePath AI Root CA to endpoints. Gather the information that you need from the Workforce AI Security platform.

Verify the Zscaler environment requirements

This integration requires Zscaler Tunnel 2.0 on client endpoints. The configuration in this article doesn't work with Tunnel version 1.0.

To verify the tunnel version:

Open the Zscaler client on any endpoint.
Verify that the client interface shows Tunnel 2.0.
If the client shows Tunnel 1.0, see the Zscaler documentation on forwarding policies for upgrade guidance before you proceed.

Distribute the root certificate to endpoints

Workforce AI Security recommends that you distribute the SurePath AI Root CA to all endpoints as a trusted certificate authority (CA). Do this before you begin the Zscaler configuration. The configuration steps also install the certificate in the Zscaler store of trusted CAs. With the certificate installed, Zscaler trusts the TLS inspection of Workforce AI Security. Distribute the certificate directly to endpoints as well, to add protection against certificate trust errors.

To download and distribute the certificate:

In CONFIGURE, go to Organization > Integration.
Select the certificate format for your endpoint operating systems.
Select DOWNLOAD CERTIFICATE.
Distribute the SurePath AI Root CA with your existing certificate deployment tools. Examples are Group Policy, mobile device management (MDM) platforms, and endpoint management tools.

Gather configuration information

Collect three items from the Workforce AI Security platform for the Zscaler steps. The first is the proxy address that Zscaler forwards traffic to. The second is the curated list of GenAI sites. The list defines which domains to redirect. The third is the Workforce AI Security certificate for the Zscaler store of trusted CAs.

Proxy address

The Workforce AI Security proxy address is the hostname that Zscaler uses as the destination for forwarded GenAI traffic.

To copy the proxy address:

In CONFIGURE, go to Organization > Integration.
Copy the proxy URL value and save it for the proxy configuration step in Zscaler. You don't need the port number, because you specify it separately.

Public Services catalog

Workforce AI Security maintains a curated list of GenAI sites on the public internet. The list includes vendor names and associated risk levels. You download it in Zscaler-specific format. Then you import it into Zscaler as a custom URL category.

To download the catalog:

In GOVERN, go to Public Services.
Select DOWNLOAD CATALOG.
In the download format list, select Zscaler Config.
Select DOWNLOAD to save the file.

The downloaded file has a name similar to workforce-ai-security-public-services-zscaler-YYYY-MM-DD.txt. Don't add URLs to this file. If the catalog needs new sites, contact your Workforce AI Security technical representative for guidance.

Certificate

You download the Workforce AI Security certificate now. You install it in the Zscaler store of trusted CAs during the configuration steps. With the certificate installed, Zscaler trusts the TLS inspection of Workforce AI Security. The certificate also prevents warnings when Workforce AI Security decrypts and inspects GenAI traffic.

To download the certificate:

In CONFIGURE, go to Organization > Integration.
Select the PEM format (required for Zscaler).
Select DOWNLOAD CERTIFICATE.

Create the Zscaler connector

Workforce AI Security uses the connector to identify inbound traffic from your Zscaler deployment as trusted. The connector has its own X-Authenticated-User setting. This setting is separate from the X-Authenticated-User setting in the Zscaler admin console, and you turn on both.

To create the connector:

In CONFIGURE, go to Connectors.
Select ADD CONNECTOR.
Enter a name such as Zscaler Connector in the Name box.
Select Zscaler from the Network Ingress section of the Type list.
Turn on Enable X-Authenticated-User Header.
Select SAVE.

Understand the X-Authenticated-User header

The X-Authenticated-User header identifies the end user for Workforce AI Security. The user sees no SSO authentication prompt.

How the X-Authenticated-User header works

When Zscaler forwards traffic to the Workforce AI Security proxy, Zscaler can insert the X-Authenticated-User header into each request. The header contains the username of the end user whose traffic is proxied. Workforce AI Security validates that the traffic comes from a trusted Zscaler connector. You create this connector in Create the Zscaler connector. Workforce AI Security then links the user's identity to their GenAI activity. Users need no additional authentication step.

Header requirements

This integration requires the XAU header. Without XAU, the system sends users to an SSO authentication page the first time they use any GenAI service that Workforce AI Security governs. The system caches this authentication for a period of time. If you turn on XAU, users skip this requirement.

Zscaler configuration steps

Open the Zscaler admin console

Go to Zscaler and log in with your organization's credentials.

Create the custom category for uniform resource locators

The custom URL category holds every hostname and domain from the Workforce AI Security Public Services catalog. It defines which traffic counts as GenAI traffic for the forwarding policy.

To create the custom URL category:

Go to Administration > URL Categories.
Select Add URL Category.
Enter a descriptive name. These instructions use WorkforceAISecurity as the example name throughout.
Select the Custom URLs box.
Open the Workforce AI Security Public Services file that you downloaded earlier (named similar to workforce-ai-security-public-services-zscaler-YYYY-MM-DD.txt).
Select all hosts and lines in the file and paste them into the box (each host on a separate line).
Select Add Items next to the box.
Select Save.

The URL category now appears under User-Defined in the list of URL categories. The file has more lines than the catalog has services. Some GenAI services require multiple hostnames to capture all relevant traffic.

Add the certificate to Zscaler

Install the Workforce AI Security root certificate in the Zscaler store of trusted CAs. With the certificate installed, Zscaler trusts the TLS inspection of Workforce AI Security. The certificate also prevents warnings for end users when Workforce AI Security decrypts and inspects GenAI traffic.

To add the certificate:

Go to Administration > Root Certificates.
Select Add Root Certificate.
Enter a descriptive name, such as WorkforceAISecurity.
Set Type to Proxy Chaining.
Select Done.
Select Choose File.
Select the .pem certificate file that you downloaded from Workforce AI Security.
Select SAVE.

The certificate now appears in the list of Root Certificates.

Create the proxy configuration

The proxy configuration defines the Workforce AI Security proxy as a forwarding destination for Zscaler. The proxy settings include the hostname, the port number, and the root certificate that Zscaler uses when it forwards GenAI traffic. They also include the critical X-Authenticated-User header configuration.

To create the proxy configuration:

Go to Administration > Proxies & Gateways > Proxies.
Select Add Proxy.
Enter a descriptive name, such as WorkforceAISecurity.
In the IP Address / FQDN box, enter the proxy URL value that you copied earlier from the Admin UI.
Unless Workforce AI Security told you to use a different port number, set Port to 8080.
Set Proxy's Root Certificate to the root certificate that you created in the previous step.

Configure the X-Authenticated-User header

This integration requires the XAU header. With it, users don't need to authenticate with SSO. For background, see "Understand the X-Authenticated-User header".

To configure the header:

Turn on Insert X-Authenticated-User. The option turns green when on. Zscaler then inserts the X-Authenticated-User header into every proxy request. The header passes the username of the end user to Workforce AI Security.
Select SAVE.

The proxy now appears in the list of configured proxies.

Create the proxy gateway

The proxy gateway is a container for one or more proxy configurations. The forwarding rule references it. This gateway points to the Workforce AI Security proxy that you created in the previous step.

To create the proxy gateway:

Go to Administration > Proxies & Gateways > Proxy Gateways.
Select Add Gateway for Proxies.
Enter a descriptive name, such as WorkforceAISecurity.
Set Primary Proxy to the proxy that you created in the previous step.
Leave the Secondary Proxy box empty. Multiple Workforce AI Security proxies respond from the hostname for high availability.
Select SAVE.

The proxy gateway now appears in the list of configured gateways.

Create the forwarding rule

The forwarding rule tells Zscaler to redirect traffic that matches the custom URL category to the Workforce AI Security proxy gateway. This rule turns on the integration and starts to redirect GenAI traffic.

To create the forwarding rule:

Go to Policies > Forwarding Control.
Select Add Forwarding Rule.
Enter a descriptive name, such as WorkforceAISecurity.
Adjust Rule Order and Admin Rank to place the rule correctly within your overall policy structure. Position the Workforce AI Security forwarding rule before other AI-related rules, so that Zscaler redirects GenAI traffic before other rules take effect.
Set Forwarding Method to Proxy Chaining.
Under CRITERIA > General, choose the scope:
- For pilot or proof-of-concept deployments, set the value to specific groups of users. This limits the policy to test users or groups.
- For production deployments, leave the value at the default of Any to apply the policy to all users.
Set CRITERIA > Destination > URL Category to your custom URL category.
Set ACTION > Forward to Proxy Gateway to the proxy gateway that you created in the previous step.
Select SAVE.

The forwarding rule now appears in the policy list.

Activate the configuration

To publish the changes and make the integration active:

Select Activation.
Select Activate.

Verification and troubleshooting

After you activate the configuration and deploy it to test users or groups, verify the integration with the Ready tool. Users whose traffic is redirected see successful results for certificate trust and for network configuration. If either test fails, check the URL category and the certificate installation. Check the proxy configuration, proxy gateway, and forwarding rule too. Also confirm that the policy applies to the intended users.

Set up proxy chaining with Zscaler