Best Practices for Using PAC Files with Zscaler Client Connector

By user , 20 January 2026

2026-01-23 Edit

Watch a video on using PAC files with Zscaler Client Connector.

Edit done 2026-01-22

To prevent outages, Zscaler strongly recommends that you roll out all PAC file changes to a small set of users before deploying changes to all users.

A PAC file is a text file used for directing traffic to a proxy server. A PAC file can also be used to bypass traffic or direct traffic to a specific proxy (i.e., traffic splitting). To learn more about PAC files, see Understanding PAC Files.

Zscaler Client Connector uses PAC files in the Forwarding Profile and in the App Profile. The Forwarding Profile PAC file is used to direct system, browser, and application traffic to Zscaler Client Connector. When Zscaler Client Connector receives traffic, the App Profile is used to direct that traffic to the Zscaler cloud. Zscaler Client Connector directs traffic to the closest data center according to the App Profile PAC file by changing the proxy return statement to the IP address of the geographically closest data center.

If the primary and secondary data center from the PAC file both fail, Zscaler Client Connector attempts to connect to gateway.<cloudname>.net, unless the Fallback to gateway domain setting is disabled.

This article provides best practices for using PAC files with Zscaler Client Connector.

  • If you experience slowness when using Zscaler Client Connector:
    • Check if the data center has any issues.
    • Run traceroute to check for possible ISP issues.
    • From the App Profile PAC file, check for and remove the functions dnsResolve(), isResolvable(), and isInNet().
    • Check if any network firewalls or network scanning is interfering with traffic.
    • Check for possible server issues by browsing to a website without a proxy, with the PAC file only, and with Zscaler Client Connector.
    • Check if another process, such as Group Policy Object (GPO), is also applying proxy settings. This can conflict with Zscaler Client Connector and cause performance issues on the device.
    • Ensure that the return statement in your PAC file has double quotes. For example, return "DIRECT";. Missing double quotes can cause errors.
  • Bypass domains by using the shExpMatch function on the host variable. For example:

Bypassing a domain:

if (shExpMatch(host, "safemarch.com")) return "DIRECT";

Bypassing a domain and all of its subdomains:

if (shExpMatch(host, "safemarch.com") || shExpMatch(host, "*.safemarch.com")) return "DIRECT";

  • Apply bypasses in the ZIA Admin Portal by configuring bypasses in the SSL bypass list and in the Authentication Bypass list. If you have traffic that you do not want to reach the Zscaler cloud, and it must be bypassed on the client itself, you must configure bypasses in the PAC files used for Zscaler Client Connector.
  • If you are using Zscaler Client Connector version 1.4 or later, you can configure multiple ZIA Public Service Edge gateway destinations based on the destination the user is trying to access. For example, if you want traffic for internal hosts to go to a specific data center, but all other traffic to go to the geographically closest data center, define two return statements with the respective ZIA Public Service Edge gateway IP addresses. For example:

var InternalHosts = /(remote\.mydomain\.com|mail\.mydomain\.com)/; if (InternalHosts.test(host)) { return "PROXY 104.129.192.43:80; PROXY 104.129.198.34:80; DIRECT"; } return "PROXY ${GATEWAY}; PROXY ${SECONDARY_GATEWAY}:9400; DIRECT"; } 

For optimal performance, do not define more than two return statements that contain Zscaler Client Connector gateway IP addresses.

The following are the best practices for using PAC files with different forwarding methods:

Comments