Zscaler BYOIP Integration Overview
Location
This page outlines the technical and procedural information required for integrating Bring Your Own IP (BYOIP) concepts with Zscaler Internet Access (ZIA) and the Zscaler Zero Trust Exchange. Zscaler does not operate like an IaaS provider that directly hosts customer prefixes on virtual NICs; instead, it offers Dedicated IP and Source IP Anchoring (SIPA) capabilities that allow you to use stable, sometimes customer-owned, public IP addresses for egress traffic. In practice, BYOIP with Zscaler is achieved through two complementary models: (1) Zscaler-managed dedicated IPs — including customer-owned prefixes that Zscaler now originates as Zscaler Managed Dedicated IPs on the Zero Trust Exchange (formal BYOIP feature), and (2) customer-managed dedicated IPs via Source IP Anchoring, where your own network or cloud edge NATs traffic using your IP ranges while still leveraging Zscaler inspection.
Provider Details
| Field | Information |
|---|---|
| Provider Name | Zscaler (Zscaler Internet Access) |
| Website | Announcing the ability to Bring Your Own Dedicated IP (BYOIP) on the Zscaler Zero Trust Exchange | Global Access, Local Control: Breaking Geo Restrictions (Dedicated IPs & BYOIP) | Source IP Anchoring (SIPA) overview | Using Dedicated IP (ZIA) | Self-provisioning Static IPs |
| ASN(s) |
Regional Zscaler cloud ASNs used for BYOIP and dedicated egress: – Americas: AS22616 (ZSCALER, INC.) – EMEA: AS62044 – APAC: AS53813 These ASNs are used by Zscaler to originate customer-owned prefixes (BYOIP) and Zscaler-owned dedicated IP ranges from the Zero Trust Exchange. |
| Regions Supported |
Zscaler Internet Access is delivered from a large, globally distributed cloud (hundreds of data centers worldwide). Dedicated IP and BYOIP features are tied to ZIA public service edges and scoped by region-specific ASNs (Americas, EMEA, APAC). BYOIP deployments are anchored to a chosen region by creating a ROA that authorizes the corresponding Zscaler ASN. Practical use cases include: – Regional egress IPs for SaaS allowlists and geographic compliance (country-based geolocation). – In-country egress and logging for data/content sovereignty. – Keeping a consistent, customer-owned egress identity while leveraging Zero Trust Exchange inspection. |
| Support Contact | Zscaler Help Portal (support tickets & documentation) | Customer Success Center (requires login) | Account team / partner channel for design and commercial enablement. |
| Tech Article & Date |
Announcing the ability to Bring Your Own Dedicated IP (BYOIP) on the Zscaler Zero Trust Exchange — formal announcement of customer-owned Dedicated IPs (BYOIP) on the Zero Trust Exchange, including ROA/x.509 validation model and regional ASNs. Global Access, Local Control: Breaking Geo Restrictions with ZIA — earlier blog introducing Dedicated IPs, Zscaler-managed dedicated IPs, and Bring Your Own IP (BYOIP) as part of geolocation and sovereignty controls. Techzine: Zscaler introduces BYOIP for Zero Trust architectures — independent overview highlighting how BYOIP on the Zero Trust Exchange preserves network identity within a Zero Trust design. Supporting collateral: Transform Source IP-Address-Based Application Access, Professional Services: Source IP Anchoring (SIPA). |
| BYOIP Scope |
Zscaler’s BYOIP capability is focused on dedicated egress addresses for SaaS / internet access, not on attaching prefixes to virtual machines: 1) Zscaler-managed Dedicated IPs (Hosted BYOIP): Dedicated IPs hosted and routed by Zscaler’s cloud, reserved for a single customer. With the BYOIP feature, you can bring an IPv4 prefix you own; Zscaler validates your authorization (via ROA and a signed BYOIP message), then originates that prefix from the designated region and exposes addresses as Zscaler Managed Dedicated IPs for policy and egress. This is the primary provider-announced BYOIP model. 2) Customer-managed Dedicated IPs via Source IP Anchoring (SIPA): Zscaler forwards selected traffic (after inspection) back to your network or cloud edge through ZPA App Connectors; your own firewalls/NAT gateways then egress this traffic using your own public IP addresses. This is functionally BYOIP for IP allowlisting and reputation, while Zscaler remains in-path for security and policy enforcement. |
| Supported Versions | BYOIP and dedicated IPs use public IPv4 addresses today. The BYOIP feature explicitly supports customer-owned IPv4 prefixes (minimum /24) registered with ARIN, RIPE, or APNIC and originated by a regional Zscaler ASN. IPv6 BYOIP is on the roadmap with a minimum /48 prefix size; availability and timelines must be confirmed with Zscaler. Dedicated IPs can be single addresses or small ranges carved from these prefixes, depending on design and licensing. |
| Supported Services |
BYOIP concepts apply to Zscaler Internet Access (ZIA) for outbound web/SaaS traffic running on the Zscaler Zero Trust Exchange. Source IP Anchoring additionally requires Zscaler Private Access (ZPA) and ZPA App Connectors deployed where your own public IP ranges are reachable (on-prem DC, colo, or public cloud). The BYOIP/dedicated IP feature set is used to: – Provide stable, dedicated egress IPs (Zscaler- or customer-owned) for SaaS allowlists and partner networks. – Localize egress (country-based IP geolocation and logging). – Maintain existing IP-based trust relationships and regulatory approvals during migrations to Zero Trust. |
Technical Requirements
| Requirement | Details |
|---|---|
| Prefix Size |
Zscaler formalizes BYOIP at the level of dedicated public IPs backed by customer-owned prefixes: – Zscaler-managed Dedicated IPs with BYOIP: Customer-owned IPv4 prefixes registered with ARIN/RIPE/APNIC, with a minimum size of /24 from a single Zscaler data center. Zscaler originates these prefixes via a regional ASN and exposes selected addresses as Zscaler Managed Dedicated IPs. – Customer-managed Dedicated IPs (SIPA): One or more public IPv4 addresses (or subnets) under your control at your egress point (data center or cloud). For SIPA, Zscaler does not originate your prefix in BGP; your own network/ISP does, so minimum prefix size is governed by your upstream routing policy, not Zscaler. – IPv6 roadmap: IPv6 BYOIP minimum is documented as /48 for planning purposes; check with Zscaler for current availability. |
| ASN Ownership Required |
No customer ASN is required for Zscaler-managed Dedicated IPs or BYOIP. Zscaler uses its own regional ASNs (AS22616, AS62044, AS53813) to originate customer-owned and Zscaler-owned dedicated IP ranges from its cloud. For customer-managed dedicated IPs via SIPA, your network edge is responsible for routing and NATing traffic using your IP ranges. If you egress to the internet using your own ASN, existing ISP/BGP arrangements continue unchanged; Zscaler sits logically in front of that egress as a security and policy layer. |
| IRR / Route Objects |
For BYOIP where Zscaler originates your prefixes: – Your prefix must be correctly registered with a recognized RIR (ARIN, RIPE, APNIC) and have routing/IRR data that is consistent with Zscaler’s origin ASN for the chosen region. – Zscaler relies primarily on RPKI ROAs and RIR records for validation; maintaining accurate IRR route objects remains a best practice for global routing hygiene. For SIPA (customer-managed dedicated IP), Zscaler does not announce your prefixes; your ISP/BGP edge remains authoritative, so existing IRR and RPKI practices stay entirely in your domain. |
| ROA or LOA |
For the formal BYOIP feature (customer-owned Dedicated IPs on the Zero Trust Exchange): – A valid RPKI ROA is required for your prefix in your RIR, authorizing the appropriate regional Zscaler ASN (Americas, EMEA, or APAC) to originate your route. – You must generate an x.509 self-signed certificate pair and use it to sign a short BYOIP validation message that ties your prefix to your organization. Zscaler validates this signed message against public information you publish in your RIR records (for example, netblock remarks). – Zscaler’s routing system performs ROA/RPKI checks before advertising your prefix and monitors ROA validity; if the ROA lapses, announcements may be withdrawn to maintain routing hygiene. Traditional Letters of Authorization (LOA) or contract language may still be requested, but ROA + cryptographic attestation are the primary trust anchors for BYOIP. For SIPA-only scenarios (where Zscaler does not originate your space), ROAs remain your responsibility with your own ASN and ISPs. |
| RIR Limitations |
Customer-owned IP space used for BYOIP/SIPA must be globally routable public IPv4, correctly registered with a recognized RIR. The BYOIP feature is documented for prefixes in ARIN, RIPE, and APNIC. You must be able to: – Prove control over the IPs (via RIR records and ROAs). – Create ROAs that authorize the appropriate Zscaler ASN by region for BYOIP. – Update your routing/IRR data as needed to support your egress design and any migration between regions. |
Step-by-Step BYOIP Process
Estimated Setup Time: Highly dependent on commercial enablement and network design. For most enterprises, expect several weeks from initial design to production rollout, including SaaS allowlist changes, ROA approval/propagation, and testing.
Tested By Us: Not yet
A) Zscaler-managed Dedicated IPs (Hosted Dedicated / BYOIP option)
B) Customer-managed Dedicated IPs via Source IP Anchoring (SIPA)
References: Zscaler blog on customer-owned Dedicated IPs (BYOIP), Global Access, Local Control blog, Source IP Anchoring overview, Source IP access whitepaper, SIPA Professional Services datasheet, Techzine BYOIP article.
Cost and Limitations
| Item | Details |
|---|---|
| Fees |
Zscaler does not publish a granular public price list for Dedicated IPs or BYOIP. In general: – Dedicated IPs (including customer-owned BYOIP variants) are add-on features on top of ZIA subscriptions and are typically priced per IP or per region as part of your commercial agreement. – Source IP Anchoring depends on licensing for both ZIA and ZPA and may involve Professional Services for design and rollout. All commercial terms are negotiated with Zscaler or partners. |
| Bundled or Standalone |
BYOIP in the Zscaler sense is not a standalone routing service; it is embedded within ZIA/ZPA and the Zero Trust Exchange: – Zscaler-managed Dedicated IPs (including BYOIP prefixes): part of the ZIA platform’s egress options, integrated with all normal ZIA security controls. – SIPA (customer-managed dedicated IPs): an advanced routing feature combining ZIA and ZPA to anchor traffic through your own egress infrastructure while keeping Zero Trust inspection in place. |
| Traffic/Peering Restrictions |
– Zscaler egress always traverses the Zscaler security cloud; you cannot simply “host” address space there without security policies. – Zscaler-managed Dedicated IPs (including BYOIP prefixes) are tied to specific regions / public service edges; cross-region behavior and load balancing are controlled by Zscaler and your ROA/ASN choices. – SIPA flows are limited to applications/destinations you select; not all traffic needs to be anchored. Capacity and redundancy of your own egress are your responsibility. |
| Other Limitations |
– BYOIP and SIPA features are typically available only in enterprise/advanced bundles, not entry-level SKUs. – Zscaler-managed Dedicated IPs use Zscaler’s cloud architecture; certain complex routing/geolocation needs may require custom design. – SIPA requires ZPA and App Connectors; it introduces additional paths and dependencies (App Connectors, connectors’ hosting environment, your firewalls/NATs). – Exact technical and contractual limits (number of dedicated IPs, maximum anchored destinations, etc.) are set per-customer. – ROA expiry or misconfiguration can cause withdrawal of BYOIP advertisements; customers must maintain ROAs and RIR data to avoid disruption. |
Automation & Developer Access
Abuse & Reputation Management
Related Resources
Zscaler Homepage
Announcing the ability to Bring Your Own Dedicated IP (BYOIP) on the Zscaler Zero Trust Exchange
Global Access, Local Control: Breaking Geo Restrictions (Dedicated IPs & BYOIP)
Techzine: Zscaler introduces BYOIP for Zero Trust architectures
Source IP Anchoring (SIPA) overview
Using Dedicated IP (ZIA)
Self-provisioning Static IP Addresses
Transform Source IP-Address-Based Application Access (whitepaper)
Zscaler Professional Services: Source IP Anchoring (SIPA)
Zscaler Help Portal
Customer Success Center