Deployment Advisory Services DAS Service Introduction Ver 4

Deployment Advisory Services (DAS) Service Introduction Ver 4. 1 Zscaler Customer Success Team

DAS Overview 1

DAS Overview • What Is DAS ? • Deployment Advisory Services • A paid service to get customers properly started on their deployment • DAS Goal • Proper design - Design configuration guidance based upon best practices • Speed - Get traffic flowing - ensure immediate security protection from the Zscaler service • DAS Value • Experience –Best practices based upon hundreds of deployments, large or small • Speed – Ensuring quick time to value of the service 2

DAS Entrance + Exit Criteria DAS IS A ONE-TIME SERVICE TO GET YOU LAUNCHED. . . YOU CONTINUE TO DEPLOY FOLLOWING THE BEST PRACTICE GUIDANCE Entrance Criteria Exit Criteria • New Service Start • Design is complete • Customer designates a project lead + technical lead, and executive sponsor • Traffic is flowing or service expires • Customer is ready for fast-paced Deployment 3

DAS Success • Speed to Value Proper Design Success = Get > 25% of user traffic flowing in 90 days • Resiliency • Redundancy • Performance Satisfactio n • 30, 60, 90 day Check-ins 4

Cloud Deployments –A Partnership Best Practice Guidance Configure TRAFFIC FORWARDING Customers –Owns and configures, their routers, firewalls, network infrastructure Zscaler - provides best practice guidance, configures cloud-side configuration AUTHENTICATION CUSTOMER Customers - Own ID management systems, perform Zscaler recommendations Zscaler - Provides best practice guidance for user identification ZSCALER POLICIES Customers –Provide policy requirements, perform Zscaler recommendations Zscaler - Provides best practice guidance and set-up assistance REPORTING / LOGGING Customers –Provide reporting and logging requirements, SIe. M set-up Zscaler - Provides best practice guidance and set-up assistance 5

The 5 Phases Of A Successful Zscaler Roll-out 1) Traffic Flowing Get traffic flowing and get protected, add complexity later ! Set-up primary and secondary GRE tunnesl (with PAC Files) from main egress points 1 2) Authentication 3) Road Warriors 4) SSL Inspection Add Authentication, for granular policy control and reporting Add Road Warriors Add SSL Inspection, if desired 2 3 4 5) Break-Out Local internet break-out of other sites traffic to Zscaler. (remove backhaul) 5 6

DEPLOYMENT FLIGHT PATH TAKE-OFF TO RIGHT DIRECTION, GET TO CRUISING ALTITUDE, MAINTAIN ALTITUTE EXPAND AUDIT, MAINTAIN TAKE-OFF BUILD TEMPLATE BASED UPON BEST PRACTICES, GET TRAFFIC FLOWING DAS –DEPLOYMENT ADVISORY SERVICES ONGOING SUPPORT = DAILY-WEEKLYMONTHLY ENGAGEMENT, MOVE TO 100% TRAFFIC 6 MONTH ARCHITECTURAL REVIEWS, TAM SUPPORT TAM OR ZTAC ONGOING SUPPORT SOLUTION ARCHITECTS. TAM 7

DAS FOCUS 25%+ 0% 100% User Traffic SYSTEM + SECURITY GRADE = B SYSTEM + SECURITY GRADE = A Configuration Traffic Forwarding – Corporate Main sites Traffic Forwarding – Corporate Branch Sites Traffic Forwarding – Some Road Warriors Traffic Forwarding – All Road Warriors Authentication Policies – SSL Inspection Policies - Basic Reporting – CXO Reports DAS TEAM CUSTOMER 8

DAS Package Comparison DAS PACKAGES PROVIDED PER CUSTOMER TOTAL USER SIZE VALUE Up to 1, 000 Users Up To 5, 000 Users Up to 10, 000 Users Up to 25, 000 Users Up to 100, 000 Users DAS PKG 0 DAS PKG 1 DAS PKG 2 DAS PKG 3 DAS PKG 6 10 Hours 5 Days 10 Days 15 Days 30 Days 9 Hours 1 Hour 4 Days 1 Day 8 Days 2 Days 12 Days 3 Days 24 Days 6 Days Report Provided Report Provided ZSCALER ONLINE TRAINING ZCES-EDU-CREDIT 2 Credits 3 Credits 4 Credits 5 Credits 10 Credits Service Expiration from Purchase 90 Days 120 Days 180 Days TOTAL CONSULTING TIME (Remote) DEPLOYMENT ADVISORY ENGINEER DEPLOYMENT ARCHITECT ZSCALER MISSION CRITICAL AUDIT (ZMCA) 9

DAS Project 10

DAS Technical Process Stages DAS designs and launches deployments through best practice guidance, then customers continue to roll-out traffic STAGE 1 - DESIGN HAND-OVER ✓ Hand-over from Sales STAGE 2 - BUILD CONFIGURE GUIDANCE DESIGN ✓ Complete Design + Deployment ✓ ✓ Traffic forwarding Authentication Policy structure Reporting TEST GUIDANCE ✓ Internal IT testing ✓ Test key applications ✓ Test business process STAGE 3 - TRAFFIC ROLL-OUT PILOT ✓Select Users 90 -DAY PRODUCTION HAND-OVER CHECK-IN ✓ Production ✓ Hand-over to CSM ✓ ZTAC Team for ongoing support 11

DAS Key Milestones AREA DAY 1 (Stage- BY DAY 7 BY DAY 15 BY DAY 30 BY DAY 60 BY DAY 90 PILOT ROLLOUT PRODUCTION ROLLOUT TRAFFIC FORWARDING = PILOT USERS +TRAFFIC FORWARDING = MAIN CORPORATE LOCATIONS + TRAFFIC FORWARDING = ROAD WARRIORS AUTHENTICATION = TESTED +AUTHENTICATION = COMPLETED 13) ONBOARDING DESIGN DEPLOYMENT WELCOME EMAIL SENT DAS KICK-OFF CALL COMPLETE 1 st DESIGN CALL HELD DESIGN + DEPLOYMENT PLAN COMPLETE POLICIES = COMPLETED CONSUMPTION PILOT TRAFFIC 10%+ OF PRODUCTION USERS TRAFFIC FLOWING 25%+ OF PRODUCTION USERS TRAFFIC FLOWING 12

Zscaler + Customer Resource Plan SERVICE FUNCTION CUSTOMER RESOURCE NAME ZSCALER RESOURCE NMAE EXECUTIVE SPONSOR Responsible for the overall success of the deployment • Customer Success Manager (CSM) PROJECT MANAGER Responsible for delivery of the overall project management • Technical Project Coordinator (TPC) TECHNICAL CONTACTS • Networks Operations (Traffic forwarding) Primary contacts in specific areas • Authentication Expert (Authentication) • Desktop Operations (Road Warriors) • Deployment Advisory Team (DAS) TECHNICAL SUPPORT Technical support organization • ZTAC, Technical Account Managers (TAM ) POST-DAS SUPPORT • TAM, CSM, ZTAC 13

Zscaler Deployment Resource Plan DAS Deployment Advisory Services TAM Technical Account Manager (If Assigned) ZTAC Zscaler Technical Assistance Center TPC Project Manages DAS Team Advises on deployments In DAS, TAM solves problems Post-DAS TAM continues to assist in roll-out + support 24 x 7 Support for problem solving

DAS Key Technical Guides 15

Design Wizard is completed by the Zscaler Sales team on behalf of customer, to start the design scope 16

Best Practice Design Considerations (BDPC) Information provided to customers in advance of Project Design Call, explaining concepts 17

Design + Deployment Plan Deployment Design and Implementation Plan 18

Zscaler Mission Critical Audit (ZMCA) Scorecard –Sample Configuration best practices audit, to ensure high availability and resiliency Area Traffic Forwarding Resiliency Critical Applications Priority 1 Corporate - Use GRE or Ipsec Tunnels 1 Road Warriors – Use PAC or Zapp 1 NAT - Ensure Tunnel Device Behind NAT 2 Router - Ensure Tunnel Terminates in Router, Not Firewall 1 Failover - Ensure Automatic Tunnel Failover Configured 2 Failover Testing - Ensure automatic tunnel failover testing successful 2 O 365 - Ensure Office 365 one-click is enabled 2 Service Performance 2 2 Service Availability 2 Authentication 1 Account = {{customer}} Audit Date = {{today}} Zscaler Recommended Configuration Network Path Verification - Ensure best Internet peering path is used MTU/MSS optimization - Path MTU configured/MTU size is correct Geo-location verification – Ensure best DC is resolved for PAC/ZAPP only locations (if any) New CA/PAC servers - Ensure firewall rules open to all cloud hub IP’s User Authentication - Configure Frequency Configuration as “Once” or Custom > 7 days Current Customer Configuration To be verified To be verified Score Not Met Not Met To be verified Not Met To be verified Not Met Overall Score (Priority of 1 = Met, Required to Pass) Not Met

Zscaler Cloud Readiness Scorecard - Sample Key checks to ensure you deployment is cloud-ready Area Priority Zscaler Recommended Configuration 2 Traffic gets routed to Internet via branch breakouts 1 Adequate Internet (WAN) bandwidth available at at branches 1 Remote access VPN tunnel configured in “split” tunnel mode 2 SD WAN solution deployed at branches Speed 1 Cloud applications do not require source IP preservation User Experience 1 Use publicly accessible SAML 2. 0 Federation service for user identification Current Customer Configuration Score {{internet traffic routing}} Performance Not Met {{bw at the branches}} Not Met {{vpn mode}} Not Met To be verified Account = {{customer}} Audit Date = {{today}} Not Met {{source IP preservation}} Not Met {{idp vendor}} Not Met Overall Score (Priority of 1 = Met, Required to Pass) Not Met

DAS Exit Hand-Overs 21

DAS Exit • Hand-Over to Customer Success Manager (CSM) • To ensure your continued success, with a single point of contact • Hand-Over to Support • For Ongoing 24 x 7 Support (Zscaler Technical Assistance Center) • See Support Best Practices Guide on help portal on how to engage ZTAC • TAM Support (For TAM Accounts) 22

Escalating A Ticket – All Accounts • 1) Customer Thermometer Button (Recommended) • • Find buttons on your ticket email updates from Zscaler Click Yellow or Red button to escalate Be sure to click a green or gold button a 2 nd time, once issue is solved and you are happy Alerts sent to 24 x 7 support leadership team who with review the support ticket • 2) Web Portal (Recommended) • Click link - https: //help. zscaler. com/escalate-ticket 2 • 3) 24 x 7 Phone: • • USA Toll Free: +1 -800 -953 -3897 Global Direct: +1 -408 -701 -0534 UK : +44 20 3514 2748 France: +33 -1 -7418 -1777 Germany: +49 -2 -21 -8282 -9199 Netherlands: +31 -3 -0808 -0255 Australia: +61 -2 -8417 2939 23

Escalating A Ticket – For TAM Accounts (Premium Plus) • 1) Customer Thermometer Button (Recommended) • • Find buttons on your ticket email updates from Zscaler Click Yellow or Red button to escalate Be sure to click a green or gold button a 2 nd time, once issue is solved and you are happy Alerts sent to 24 x 7 support leadership team who with review the support ticket • 2) Web Portal (Recommended) • Click link - https: //help. zscaler. com/escalate-ticket 2 • 3) Contact Your TAM (Technical Account Manager) • 1 st leverage # 1 or #2 above, to ensure your issue is escalated • Then contact your designated TAM, if available, for strategic guidance 24

Thank you