What's New
12 min
GCP support: In the ZTA Gateway version 25.1.2.0, support for GCP form factor is included. An updated disk architecture is introduced, so the deployment is achieved only through fresh installation.
ZTA server-initiated connection: A ZTA administrator can enable server-initiated connections for each application. Access is established for each client session and automatically removed when the client disconnects. Dynamic Tunnel IP must be enabled for this feature to work.
All server-initiated applications must use a single designated ZTA Gateway. For details, see Editing Gateway ConfigurationEdit Gateway Configuration.
Automated license expiry detection: Automated monitoring of license expiry ensures efficient license management, timely awareness, and improved operational efficiency. This feature introduces daily tenant lifecycle checks, milestone-based notifications through email and alerts, and a configurable 30-day grace period.
Extended Mode Configuration: The Extended Mode feature ensures business continuity during Controller outages by applying last-known policies to active sessions, within an admin-defined grace period. For details, see Extended Mode ConfigurationExtended Mode Configuration.
- Tenant Admin Audit Logging: ZTA Controller now includes tenant audit logging capabilities, enabling administrators to track and review tenant-level administrative activities. These enhancements improve operational visibility and support auditing and compliance requirements. For more details, see Checking Tenant Admin Logs
- Enhanced ESAP Package Management: This release introduces improvements to ESAP package management from the ZTA Controller, providing administrators with greater flexibility and control when managing endpoint assessment packages across their ZTA deployment. For more details, see Working with ESAP Packages.
- Dynamic IP Pool Support for ZTA Gateway 25.1.1.0: ZTA now supports Dynamic IP Pool functionality for gateways running version 25.1.1.0. To ensure accurate gateway capability detection, the Enable Dynamic IP option becomes available only after the gateway has successfully connected and is recognized as a 25.1.1.0 gateway. The setting is not displayed during the initial gateway configuration process and appears after the gateway is online. For more details, see Using Dynamic IP Addressing to Profile Client Traffic.
- Real-Time ISAC Connection Status: Administrators can now monitor the real-time connection status of ISAC endpoints directly from the ZTA Controller. This enhancement improves operational awareness and helps accelerate troubleshooting by providing immediate visibility into endpoint connectivity. For details, see Viewing Currently Enrolled User Devices.
- Support for ZTA Gateway 25.1.1.0: ZTA Controller now supports ZTA Gateway version 25.1.1.0, enabling organizations to manage and monitor the latest gateway platform releases while benefiting from the newest gateway capabilities and enhancements.
Important Updates and Improvements
- Support for ZTA Gateway version 25.1.1.0 and 22.8R2.8
- Critical Service Updates
- Brief service disruption expected during maintenance window for ZTA administrators and ZTA end users
- No disruption for VPN end users running 22.7R2.5 or above.
- BYOD Using Machine Certificate based Validation: This feature lets administrators enforce device trust by validating a machine-level certificate installed on an endpoint. When enabled, only devices presenting a valid, trusted machine certificate can register, authenticate, and access protected applications through ZTA. For details, see Enable BYOD Using Machine Certificate based Validation.
- Logging enhancements for Application URL: Application URLs are now displayed across Insights and logging, enabling more precise analysis and faster triage. You can view and act on URL data in:
- Insights: All Applications, Discovered Applications, and Default Gateway Applications charts
- Access logs: Application URL is available for display, search, and filtering
For details, see Reviewing Application Usage and Viewing Log Records.
- ISAC log upload support with ZTA Custom Sign-in URL: To accelerate troubleshooting and support, ZTA now lets administrators trigger client log uploads directly from the controller using the Active Devices page. As soon as a device establishes a successful ZTA connection and appears in Active Devices, admins can initiate a client log upload without requiring enduser action. This feature is supported with ISAC version 22.8.6 (44527). For more details, see Initiating Client Log Upload.
- Separate ISAC package management between NSA and ZTA: ISAC Client packages are separately provided for ICS and ZTA Gateways so that these can be managed independently. This provides flexibility to plan for ZTA ISAC releases. For more details, see Working with Client Packages.
- Troubleshooting enhancements: This feature enhancement simplifies Gateway troubleshooting, which includes enhanced Debug Log, Node Monitoring, TCP Dump, System Snapshot, and Network Command functionalities. For more details, see Troubleshooting Gateway Issues.
- ZTA Gateway security hardening: 25.1.0.0 ZTA Gateway is now security hardened with the following security features:
- Nginx Support
- SELinux
- Secure Boot
- Secure Factory Reset
- Key Management
- TLS 1.3 Support
- Limitations
- 25.1.0.0 ZTA Gateway - Currently supported platform is VMware ESXi Platform. Other Cloud form factors like GCP, Azure and AWS will be supported in upcoming releases.
- TLS 1.3 Support currently supported and validated only for ISAC Windows and Mac Platforms. For Mobile clients (iOS and Android), support will be planned in the upcoming releases.
- Restricting to 255 characters in DNS Domain settings: In the Gateway configuration, you can add one or more comma separated domain names, but not beyond 255 characters. For more details, see Editing Gateway Configuration.
- Visibility into NAT connections: The Dynamic IP Pool option is removed from 22.8R2.7, 25.1.0.0 release and when creating any new gateway.
Important Updates and Improvements
- Critical Service Updates
Important Updates and Improvements
- Support for ZTA Gateway version 22.8R2.6
- Critical Service Updates
- Enhancement: Syslog Server Configuration: To optimize syslog server connectivity and performance, the Syslog Server configuration interface now includes a new dropdown enabling users to explicitly select the Server CA (Certificate Authority) when setting up secure connections. This enhancement complements the existing client certificate option and addresses latency issues during SSL handshakes.
- Key Improvements:
- Targeted Server CA Selection: Administrators can now specify which Server CA to use when configuring syslog servers. Previously, if no Server CA was selected, the system sequentially tested all trusted CAs in the tenant during connection establishment, which increased connection times. This results in a better performance and a better user experience.
- Reduced Latency and Streamlined Handshakes: Enhanced the syslog forwarding mechanism to enable real-time log delivery by directly consuming gateway log events.
- Improved Security and Accuracy: By ensuring the correct Server CA is always used, this enhancement minimizes the risk of mismatched certificates and strengthens secure logging communications.
- Enhanced User Experience: The refined UI makes syslog server setup more intuitive and efficient, speeding up configuration and accelerating message delivery.
Administrators are encouraged to specify the relevant Server CA when adding or editing syslog server configurations to gain the benefits of this enhancement.
For details, see Syslog Forwarding.
- Persistent tunnel support for NZTA: This feature enhances the reliability of user sessions by keeping the NZTA tunnel active for the duration of the session idle timeout specified in Session Settings. With this feature enabled, the tunnel remains connected until the session idle timeout is reached. If persistent tunnel support is not enabled, the tunnel remains active only for the period defined in the Tunnel Idle Timeout setting (range: 5–120 minutes; default: 15 minutes) when there is no network traffic. Once the tunnel idle timeout elapses, the NZTA tunnel automatically terminates. This new feature helps ensure uninterrupted connectivity throughout the entire session duration.
For details, see:
There are no new features.
This release includes bug fixes. There are no new features.
This release includes bug fixes. There are no new features.
- Admin experience enhancements: "Group by" option is added in the Gateway List page to filter the list based on Gateway Type, Connection status, Version or Region.
- Admin UI user experience enhancements: Column reordering is newly added in the Users L3 and L4 pages. To move a column, a user can click the header and drag to its new position. For more details, see Using the Insights Menu to Monitor User Activity and Service Usage.
- Consolidated landing page: Drill down support for the Sankey chart is newly added on the consolidated landing page. With each chart, the View all link provides a page with detailed log records for that category. For more details, see Consolidated Landing Page, see Consolidated Landing Page.
- All Gateways Counter: - All Gateways counter is newly added on ZTA and nSA specific analytics landing page. For more details, see Reviewing Your Network Activity.
- (Preview) Consolidated landing page: A new unified landing page allows tenant admin to examine the shared Analytics tables and charts for nZTA and ICS Gateways. For more details, see Consolidated Landing Page.
- Admin UI user experience enhancements: Improvements to the admin experience (Modernize the table view for session management and log view). Advanced filter on the page for managed users. For more details, see:
- Sync Now: A new Sync Now page allows the tenant admin to implement changes made and correct any configuration problems based on the alerts. For more details, see Synchronizing the Configuration.
22.7R2 ZTA Gateway version is the security hardened version with CentOS updates.
- Configurable MTU size for gateways: Tenant admin can now define MTU size for ZTA gateways depending on their requirements and underlying network infrastructure.
For details, see:
- Password Strengthening for Local Authentication Server: The local authentication server has stronger password restrictions. For details, see Workflow: Creating a Local Authentication Policy.
- Renewed ZTA IDP metadata in release 22.7R1: To ensure continued compatibility, download the renewed ZTA IDP metadata from the ZTA tenant application configuration page and subsequently apply the updated information to the SaaS SAML SSO configurations.
- Integrating NMDM with ZTA: Ivanti Neurons for MDM provides compliance check and simplified onboarding experience for nZTA end users connecting via mobile. For details, see. For details see Integrating Ivanti Neurons for MDM with nZTA.
- Hardened custom sign-in policies and login URLs: As part of hardening custom sign-in policies and login URLs, the following changes are implemented:
- User Policies: Administrator can see only two policy types: Admin and User. To enhance administrator experience and simplify configuration, all the configured user policies now support enrolment by default. It means, administrator only needs to configure user policies, and this eliminates configuring enrolment policies. With this, end users will always connect to the same URL, eliminating potential complications. New policy allows to choose from all ‘local’ auther server (old and new), but only new flow ‘SAML’ auth servers is created.
- User Groups: Existing user group can choose from older elements, and new user group can only choose from the newer elements. The existing "Enrol" user group can only choose from the older elements.
- SAML server: Same SAML server cannot be used for both Enrollment and Authentication. So, to use a auth server for ‘User’ type policy, it should have ‘Enable Enrollment’ configured.
For details, see:
- Oracle Cloud Platform support for ZTA Gateway: ZTA Gateway now supports deployment on Oralce Cloud Platform. For details see Workflow: Creating a Gateway in Oracle Cloud Platform.
- Launching the Windows Edge/Webview2 browser: In a typical enrollment, upon successful authentication to the Controller, Ivanti Secure Access Client automatically shows the end-user portal applications page through a Windows Edge/Webview2 browser. This feature is supported with ISAC client version 22.6R1. For details. see Enrolling a Windows Device.
- Reusable custom icon to associate with application: The create application page provides an option to upload your own icon, which can be used to associate with more than one application. For details. see Adding Applications to the Controller.
- Enhancements to L4, Gateway Logs, and Logs Tables:
The following list shows the enhancements to L4, Gateway Logs, and Logs Tables.
- Column resizing across ZTA pages
- Cell content copy text from Table
- Pagination across ZTA pages
- Minimum number of columns in all the tables in L4 dashboards
- Enhancement to Advanced Filter
For details. see Viewing Detailed Logs for a Chart and Filtering the Logs.
- Simplifying device rules and policies, and global device preferences: Admin experience is enhanced by simplifying the device rules and policies For details, see Creating Device Policies, Setting Global Device Preferences.
Suppress EUP Auto Launch: Allows Admin to suppress the auto launch of the End User portal. This option is enabled by default and works with ISAC 22.5R1 and later. For details, see Setting Global Device Preferences.
- Admin Access Control based on location, Host Checker, and Network: Checks the Admin's device geographic location/network/host checker compliance for admin sign-in policy before providing access to admin login. For details, see Configuring Default Device Policy for Users.
- Enhancements to Non Compliance and Anomalies L4 Drill Down logs:
- The Anomalies L4 table now includes MAC Address and Source IP Address columns.
- The Non-compliances L4 table now includes Acknowledged, Non-compliant Policy Type, Non-compliance Policy reason, MAC Address and Source IP Address columns.
- For details, see Using the Active Anomaly and Non-Compliance Charts.
- Log export options to the admin from Gateway and L4 (drill down view) logs: In any of the L4 pages, export the displayed log as a CSV or JSON text file, or create schedules to set up log export jobs. For details, see Viewing Detailed Logs for a Chart.
- Exporting logs from L4 (drill down view) logs and Gateway logs. For details see Exporting logs.
- Gateway Creation Config UI Simplification: Create ZTA Gateway and Create ZTA Gateway Group are grouped under Create. For details, see Adding a vSphere Gateway.
- Acknowledge non-compliance in the non-compliance info panel on the Landing page: Acknowledge individual non-compliances and remove them from the active total. Filter on acknowledged, unacknowledged (active), or all non-compliances. For details, see Using the Summary Ribbon.
- Role Based Access Control for Admin Users: With Role-based access control (RBAC), organizations can easily add admins and assign them specific roles, with differing levels of access to the nSA Admin Portal. In addition to an existing set of default roles, Administrators can now create custom granular roles for specific functions within the nSA admin portal. For details, see Role-based Access Control for Admin Users
- HTTP Proxy Support: Support Proxy configuration in gateway to connect to ZTA.
For details, see:
- Applications and Application Groups UI change: Group together multiple applications for which a single secure access policy is required. Adding Applications to the Controller and Adding Application Groups to the Controller.
- ZTA Gateway Connection Control for Trusted Networks: ZTA Gateway can sometimes be bypassed so that users can connect directly to specific applications. For example, you might want users to bypass ZTA for a specific application if they are connected directly to your trusted corporate network. ZTA gateway tunnel creation will be bypassed on the endpoint since resource access will go through the physical interface.
For details, see Configuring a Default Gateway for Application Discovery.
- Gateway Re-registration: ZTA Gateway can now be re-registered in case if the Gateway Registration was not successful and can edit gateway configuration parameters. On registration failures, admin can trigger the registration manually along with the current debugging options such as networking tools, reboot etc. You can also regenerate and download the gateway init config from the controller admin interface as when required. The Admin can also use Registration error report, which provides insight about the registration failure and suggest solutions to overcome it.
For details, see Re-registering a VMware vSphere Gateway, Re-registering an Amazon Web Services Gateway and Re-registering a GCP Gateway.
Limitations : Azure and KVM does not allow the user to update configuration after the gateway is deployed. So, if any config update is needed in Azure or KVM gateways (ZTA) ,we need to redeploy the ZTA gateway.
- Location/Network rule support in default device policy: Location/Network policy based enforcement can be applied for any user policy. For details, see Options for Location Rules and Options for Network Rules.
- Management port support on ZTA Gateway: With this feature, ZTA Gateway can use management interface to communicate with controller and NTP Server.
- Optimal Gateway Selection (OGS)
- End User UX Improvements
- Simplified Configuration Users and Secure Access Policy configurations
- Actionable Insights: Step up Authentication, Subsequent login and Chart Visibility
- Device Risk Assessment: RiskSense integration, Default Device Policy
- Application Visibility Improvements: Secure Access Policy for discovered applications
- Lookout SWG/CASB Forward Proxy integration
- External Browser support
- Minimum Client Version
- Lock Down mode support
- PSAL with Browser Extension