Zscaler ZDX (Digital Experience) all ports dead: Diagnose & Fix
By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor Last verified: 2026-05-30
| Vendor | Zscaler |
|---|---|
| Operating system | Zscaler Cloud (ZIA / ZPA / ZDX) |
| Category | Hardware Failure |
| Skill level | Intermediate to advanced |
| DIY-able? | Yes with CLI access; some scenarios need Zscaler Support + RMA. |
A Zscaler platform behaving badly is usually one of three things: a thermal/PSU issue caught by `trust.zscaler.com cloud status`, a transceiver problem caught by `Connector Health (App Connector / Client Connector)`, or a boot-loader hang you only see on the console. Zscaler Cloud (ZIA / ZPA / ZDX) surfaces all three differently from competitors, so the diagnostic order matters.
I will be honest, on the ZDX (Digital Experience) family I have seen at least one false-positive from the on-box monitoring per quarter. Always cross-check what `Admin Portal → Activation` and `trust.zscaler.com cloud status` reports against the physical front-panel and a smell test of the chassis.
If this is your first Zscaler hardware issue, the good news is that Zscaler Support is competent and the part-replacement RMA cycle is usually under a week for a covered unit.
What this guide covers
Diagnose and recover from all ports dead on a Zscaler ZDX (Digital Experience).
Step-by-step
- Try the same cable + endpoint on a known-good port to confirm the issue is the device.
- If modular, re-seat the affected line card.
- Check the platform / hardware status command.
- If a single line card is dead, RMA it. If the supervisor or chassis, RMA accordingly.
CLI / commands
# Verify hardware state
Admin Portal → Activation
Admin Portal → Administration → Service Status
trust.zscaler.com cloud status
# Collect for Zscaler Support
Client Connector → Help → Export Logs
When to RMA
- Repeated failure after re-seat and power-cycle
- Visible burn, scorching, or physical damage
- POST or memory diagnostic failure
- Hardware crashinfo without a software workaround
Frequently asked questions
Will this work on my specific Zscaler Cloud (ZIA / ZPA / ZDX) version?
The procedure reflects current Zscaler Cloud (ZIA / ZPA / ZDX) behaviour. Older releases may need minor syntax adjustments: use the CLI help (? or tab-completion) to verify.
Should I open a Zscaler Support case immediately?
Open one if you suspect hardware failure or the symptom persists after a maintenance-window reload. Make sure your support entitlement is active first.
Where can I find the Zscaler official documentation?
https://help.zscaler.com, search the product family + feature name.
Is this procedure safe in production?
Test in a lab or maintenance window first. Capture pre-change state so you can roll back.
Related guides
Related fixes
Related guides worth a look while you sort this one out:
- Zscaler ZDX (Digital Experience) single port dead: Diagnose & Fix
- Zscaler ZDX (Digital Experience) won't boot at all: Diagnose & Fix
- Zscaler Cloud Firewall all ports dead: Diagnose & Fix
- Zscaler ZDX (Digital Experience): How to back up configs nightly to a Git repo
- Zscaler ZDX (Digital Experience): How to deploy with a Python script (paramiko / netmiko / native API)
- Zscaler ZDX (Digital Experience): How to deploy with Ansible
References
- Zscaler support portal: https://help.zscaler.com
- Zscaler knowledge base: https://help.zscaler.com
- Zscaler security advisories: https://trust.zscaler.com
- Open a case: https://help.zscaler.com/submit-ticket
Reference material, not professional advice. Validate against your specific Zscaler Cloud (ZIA / ZPA / ZDX) version and test in a non-production environment before applying.
What changed recently?
Fault diagnosis on a Zscaler device goes faster when you map the symptom to a recent change:
- Did firmware update in the last 7 days?
- Did the network (router, ISP, VPN) change?
- Was the device moved physically?
- Did paired devices (phone, hub, app) update?
- Were any accessories swapped in or out?
The answer narrows the root cause to a manageable subset.
Safety + preconditions
Before any work on a Zscaler device:
- Unplug from mains for any internal-access procedure.
- Discharge stored energy (capacitors in PSUs, residual battery charge) per manufacturer guidance.
- Use ESD-safe handling for boards and modules. no carpet, no wool sleeves.
- Avoid moisture; never apply liquids near vents or connectors.
- If you smell smoke, see scorch marks, or feel uneven heat, stop and escalate.
Quick verification
Before you walk away from a Zscaler device fix, run through:
1. Reproduce the original trigger, does the issue reappear? 2. Check the device's status / health screen for any new alerts. 3. Confirm paired devices (app, hub, controller) reconnected. 4. Save / commit any configuration changes per the device's normal workflow. 5. Note the change in your maintenance log with date + firmware version.
Escalation guide
For a Zscaler device, the right escalation depends on impact:
- Cosmetic / minor: log a ticket via the Zscaler app or web portal. Response 1-3 business days.
- Mid-impact: phone support. Have your serial number ready.
- Critical (production down, safety issue): in-person dealer / TAC visit. Bring proof of purchase.
- Out of warranty: third-party repair shop with manufacturer-certified technicians.
More frequently asked questions
How often should I run preventive checks?
Quarterly for most consumer devices; monthly for production / commercial devices. Set a calendar reminder so the device stays healthy between issues.
Why is this happening on a brand-new unit?
Out-of-box defects do occur. If you've owned the device under 30 days and the symptom persists after a factory reset, escalate to the seller for replacement under DOA terms before opening a manufacturer support case.
Does this affect other devices on my network?
Generally no. The procedure is local to this device. Network-side changes (firmware updates that affect TLS, SMB, or routing) are flagged explicitly in the steps.
What if the fix returns after a reboot?
Persistent fault returns mean either: a hardware fault (escalate), a configuration that's being overwritten by a sync source (check cloud profiles), or a regression in a recent firmware update (rollback).
How long does this fix usually take?
Most users complete the steps in 20-45 minutes the first time, and 5-10 minutes on subsequent runs once the menu paths are familiar.