Skip to content

Information about ZScaler & ZPA in Novo Nordisk

What is ZScaler Private Access?

ZScaler Private Access (ZPA) is a cloud-based security solution that provides secure access to private applications without the need for a VPN. With ZPA, users can access private applications from any device or location, while keeping the applications and data secure from external threats. ZPA uses a zero-trust security model, which means that it verifies the identity and security posture of every user and device before granting access to applications. It also encrypts all traffic between the user and the application, providing an additional layer of security. ZPA can be used to provide access to both cloud based and on-premises applications, making it a versatile solution for organizations with a hybrid infrastructure. It can also be integrated with other ZScaler security solutions to provide a comprehensive security stack.

ZScaler Knowledge Articles

KaaS platform on ZPA

Problem Statement

There are some developers within the organization who work on MacBooks (these are Novo managed devices). These devices do not connect to the CORP network via VPN, instead they rely on the ZScaler client installed on these machines. If a device is running with such a setup, and if it requires to connect to an endpoint that is only accessible via CORP network, then that endpoint needs to be onboarded to ZPA.

Note: This also seems to be an issue with all user laptops that have been upgraded to Windows 11 (this statement needs to be verified).

Recommendation from GITO

A system/platform team, that would like to allow such devices (as described above) to access their CORP accessible endpoints, would have to get their endpoints onboarded to ZPA.

This can be requested via ServiceNow Form : ZTNA - Onboard NN Application

KaaS Config on ZPA

  • KaaS was onboarded to ZPA in Jan 2025, after discussions with FXAS (Subhaan Asid).
  • It should be noted, that ideally applications onboarded to ZPA should have a Novo specific FQDN, however the KaaS platform currently does not have that option, hence our platform endpoints have been onboarded with an exception.
  • The platform has been setup on ZPA with the "Application Segment" name "KAAS-TCP".
  • In case any additions/modifications are required, then the KaaS team should submit a ServiceNow request and mention the application segment name in the request.
  • FQDNs of all Kafka clusters (only Production Org) have been onboarded to ZPA, with port number 443 and 9092. Example : For the Kafka cluster in DEV environment, FQDN "pkc-q07op.eu-central-1.aws.confluent.cloud" has been onboarded for port 443 and 9092.
  • FQDNs for Pre-Prod organization have not been onboarded to ZPA, as the clusters on Pre-Prod are teared down regularly and the FQDNs keep changing. Platform team intends to solve this issue in the long term and it will be prioritized in the future.

ServiceNow request for reference : RITM0819480