What's New

In the ZTA Gateway version 25.1.2.0, support for GCP form factor is included. An updated disk architecture is introduced, so the deployment is achieved only through fresh installation

A ZTA administrator can enable server-initiated connections for each application. Access is established for each client session and automatically removed when the client disconnects. Dynamic Tunnel IP must be enabled for this feature to work. All server-initiated applications must use a single designated ZTA Gateway. For details, see Editing Gateway ConfigurationEdit Gateway Configuration.

Automated monitoring of license expiry ensures efficient license management, timely awareness, and improved operational efficiency. This feature introduces daily tenant lifecycle checks, milestone-based notifications through email and alerts, and a configurable 30-day grace period.

ZTA Controller now includes tenant audit logging capabilities, enabling administrators to track and review tenant-level administrative activities. These enhancements improve operational visibility and support auditing and compliance requirements. For more details, see Checking Tenant Admin Logs.

This release introduces improvements to ESAP package management from the ZTA Controller, providing administrators with greater flexibility and control when managing endpoint assessment packages across their ZTA deployment. For more details, see Working with ESAP Packages

ZTA now supports Dynamic IP Pool functionality for gateways running version 25.1.1.0. To ensure accurate gateway capability detection, the Enable Dynamic IP option becomes available only after the gateway has successfully connected and is recognized as a 25.1.1.0 gateway. The setting is not displayed during the initial gateway configuration process and appears after the gateway is online. For more details, see Using Dynamic IP Addressing to Profile Client Traffic.

Administrators can now monitor the real-time connection status of ISAC endpoints directly from the ZTA Controller. This enhancement improves operational awareness and helps accelerate troubleshooting by providing immediate visibility into endpoint connectivity. For details, see Viewing Currently Enrolled User Devices.

ZTA Controller now supports ZTA Gateway version 25.1.1.0, enabling organizations to manage and monitor the latest gateway platform releases while benefiting from the newest gateway capabilities and enhancements.

This feature lets administrators enforce device trust by validating a machine-level certificate installed on an endpoint. When enabled, only devices presenting a valid, trusted machine certificate can register, authenticate, and access protected applications through ZTA.

For details, see Enable BYOD Using Machine Certificate based Validation.

Application URLs are now displayed across Insights and logging, enabling more precise analysis and faster triage.

You can view and act on URL data in:

For details, see Reviewing Application Usage and Viewing Log Records.

To accelerate troubleshooting and support, ZTA now lets administrators trigger client log uploads directly from the controller using the Active Devices page. As soon as a device establishes a successful ZTA connection and appears in Active Devices, admins can initiate a client log upload without requiring enduser action. This feature is supported with ISAC version 22.8.6 (44527). For more details, see Initiating Client Log Upload.

ISAC Client packages are separately provided for ICS and ZTA Gateways so that these can be managed independently. This provides flexibility to plan for ZTA ISAC releases. For more details, see Working with Client Packages.

This feature enhancement simplifies Gateway troubleshooting, which includes enhanced Debug Log, Node Monitoring, TCP Dump, System Snapshot, and Network Command functionalities. For more details, see Troubleshooting Gateway Issues.

ZTA 25.1.0.0 Gateway is now security hardened with the following security Features..

Limitations

In the Gateway configuration, you can add one or more comma separated domain names, but not beyond 255 characters. For more details, see Editing Gateway Configuration.

The Dynamic IP Pool option is removed from 22.8R2.7 release.

This feature enhances the reliability of user sessions by keeping the NZTA tunnel active for the duration of the session idle timeout specified in Session Settings. If persistent tunnel support is not enabled, the tunnel remains active only for the period defined in the Tunnel Idle Timeout setting (range: 5–120 minutes; default: 15 minutes) when there is no network traffic. Once the tunnel idle timeout elapses, the NZTA tunnel automatically terminates.

Enabling this feature helps ensure uninterrupted connectivity throughout the entire session duration.

For details, see:

To optimize syslog server connectivity and performance, the Syslog Server configuration interface now includes a new dropdown enabling users to explicitly select the Trusted Server CA (Certificate Authority) when setting up secure connections. This enhancement complements the existing client certificate option and addresses latency issues during SSL handshakes.

Key Improvements

Targeted Server CA Selection:

Administrators can now specify which Server CA to use when configuring Syslog servers. Previously, if no Server CA was selected, the system sequentially tested all trusted CAs in the tenant during connection establishment, which increased connection times. This results in a better performance and a better user experience

Reduced Latency and Streamlined Handshakes:

Enhanced the syslog forwarding mechanism to enable real-time log delivery by directly consuming gateway log events.

Improved Security and Accuracy:

By ensuring the correct Server CA is always used, this enhancement minimizes the risk of mismatched certificates and strengthens secure logging communications.

Enhanced User Experience:

The refined UI makes Syslog server setup more intuitive and efficient, speeding up configuration and accelerating message delivery.

For details, see Syslog Forwarding.

Column reordering is newly added in the Users L3 and L4 pages. To move a column, a user can click the header and drag to its new position.

For more details, see Using the Insights Menu to Monitor User Activity and Service Usage.

Drill down support for the Sankey chart is newly added on the consolidated landing page. With each chart, the View All link provides a page with detailed log records for that category. For more details, see Consolidated Landing Page.

All Gateways counter is newly added on ZTA and nSA specific analytics landing page. For more details, see Reviewing Your Network Activity.

Added "Frequently Asked Questions" section. For more details, see Frequently Asked Questions.

A new unified landing page allows tenant admin to examine the shared Analytics tables and charts for nZTA and ICS Gateways. For more details, see Consolidated Landing Page.

Improvements to the admin experience (Modernize the table view for session management and log view). Advanced filter on the page for managed users. For more details, see:

A new Sync Now page allows tenant admin to implement changes made and correct any configuration problems based on the alerts. For more details, see Using the Insights Menu to Monitor User Activity and Service Usage.

Tenant admin can now define MTU size for ZTA gateways depending on their requirements and underlying network infrastructure.

For details, see:

The local authentication server has stronger password restrictions.

For details, see Workflow: Creating a Local Authentication Policy.

To ensure continued compatibility, download the renewed ZTA IDP metadata from the ZTA tenant application configuration page and subsequently apply the updated information to the SaaS SAML SSO configurations.

Ivanti Neurons for MDM provides compliance check and simplified onboarding experience for nZTA end users connecting via mobile. For details, see Integrating Ivanti Neurons for MDM with nZTA.

nZTA Gateway now supports deployment on Oralce Cloud Platform (OCI). For details see Workflow: Creating a Gateway in Oracle Cloud Platform.

In a typical enrollment, upon successful authentication to the Controller, Ivanti Secure Access Client automatically shows the end-user portal applications page through a Windows Edge/Webview2 browser. This feature is supported with ISAC client version 22.6R1. For details. see Enrolling a Windows Device.

The create application page provides an option to upload your own icon, which can be re-used to associate with more than one application. For details. see Working with Applications and Application Groups.

The following list shows the enhancements to L4, Gateway Logs, and Logs Tables.

For details. see Viewing Detailed Logs for a Chart, and Filtering the Logs.

Admin experience is enhanced by simplifying the device rules and policies, and global device preferences. For details, see Creating Device Policies, Setting Global Device Preferences, and Viewing Currently Enrolled User Devices.

Allows Admin to suppress the auto launch of the End User portal. This option is enabled by default and works with ISAC 22.5R1 and later. For details, see Enrolling Ivanti Secure Access Client.

Checks the Admin's device geographic location/network/host checker compliance for admin sign-in policy before providing access to admin login. For details, see Configuring Default Device Policy for Users.

The Anomalies L4 table now includes MAC Address and Source IP Address columns.

The Non-compliances L4 table now includes Acknowledged, Non-compliant Policy Type, Non-compliance Policy reason, MAC Address and Source IP Address columns.

For details, see Using the Active Anomaly, Connected Clients Version, and Non-Compliance Charts.

In any of the L4 pages, export the displayed log as a CSV or JSON text file, or create schedules to set up log export jobs. For details, see Viewing Detailed Logs for a Chart.

For details, see Exporting Logs.

Acknowledge individual non-compliances and remove them from the active total. Filter on acknowledged, unacknowledged (active), or all non-compliances. For details, see Using the Summary Ribbon.

On Create Application page, admin can choose to continue to create one more application. For details, see Working with Applications and Application Groups.

With Role-based access control (RBAC), organizations can easily add admins and assign them specific roles, with differing levels of access to the nSA Admin Portal. In addition to an existing set of default roles, Administrators can now create custom granular roles for specific functions within the nSA admin portal.

For details, see Role-based Access Control for Admin Users

Support Proxy configuration in gateway to connect to nZTA.

For details, see:

Adding a VMware vSphere Gateway

Adding an Amazon Web Services Gateway

Adding an Azure Gateway

Working with Gateways

Adding a GCP Gateway

nZTA Gateway can sometimes be bypassed so that users can connect directly to specific applications. For example, you might want users to bypass nZTA for a specific application if they are connected directly to your trusted corporate network. nZTA Gateway tunnel creation will be bypassed on the endpoint since resource access will go through the physical interface.

For details, see Working with Gateways

nZTA Gateway can now be re-registered in case if the Gateway Registration was not successful and can edit gateway configuration parameters. On registration failures, admin can trigger the registration manually along with the current debugging options such as networking tools, reboot etc. You can also regenerate and download the gateway init config from the controller admin interface as when required. The Admin can also use Registration error report, which provides insight about the registration failure and suggest solutions to overcome it.

Limitation: Azure and KVM does not allow the user to update configuration after the gateway is deployed. So, if any config update is needed in Azure or KVM Gateways (nZTA) ,we need to redeploy the nZTA Gateway.

For details, see Re-registering a VMware vSphere Gateway, Re-registering an Amazon Web Services Gateway and Re-registering a GCP Gateway.

Location/Network policy based enforcement can be applied for any user policy. For details about enforcing the policy on default device, see Configuring Default Device Policy for Users.

For details about creating these policies, see Options for Location Rules and Options for Network Rules.