Configuring ScreenMeet in Zscaler

Overview

This article lists the Zscaler Internet Access (ZIA) and Zscaler Client Connector (ZCC) policies that typically need configured for ScreenMeet sessions to connect reliably. It is intended for network and security administrators who manage Zscaler for agents, end users, or unattended endpoints.

ScreenMeet uses WebRTC for screen sharing and remote control. Media traffic prefers UDP 443 and falls back to TCP 443. The ScreenMeet client uses certificate pinning, so Zscaler SSL inspection of ScreenMeet traffic causes certificate warnings and prevents Beam unattended sessions from connecting.

Apply these settings to your Zscaler-protected device that participates in a session: the agent's device, the end user's device, and any Beam unattended endpoint.

Prerequisites

• A ZIA administrator account with permission to edit URL Categories, SSL Inspection, URL & Cloud App Control, and Firewall Control policies.

• A Zscaler Client Connector administrator account with permission to edit App Profiles, Forwarding Profiles, and Application Bypass (if you deploy ZCC).

• The ScreenMeet hostnames: *.screenmeet.com and *.scrn.mt.

• The ScreenMeet static IP list from the ScreenMeet Firewall Configuration / Whitelisting article, if you use IP-based rules.

Configuration Summary

Step 1: Create a ScreenMeet Custom URL Category

Create one custom URL category so every ZIA policy references the same ScreenMeet destinations.

1. In the ZIA Admin Portal, go to Administration > URL Categories.

2. Click Add URL Category.

3. Enter ScreenMeet in the Name field.

4. In the Custom URLs field, add the following entries. The leading period matches all subdomains.    

   • .screenmeet.com

   • .scrn.mt

5. Click Save.

Step 2: Exempt ScreenMeet from SSL Inspection

ScreenMeet pins its certificates. Zscaler cannot inspect pinned traffic, and Zscaler recommends exempting pinned applications from SSL inspection.

1. Go to Policy > SSL Inspection.

2. Click Add SSL Inspection Rule.

3. Enter ScreenMeet - Do Not Inspect in the Rule Name field.

4. Set Rule Order so this rule is evaluated before any rule with the Inspect action.

5. Under Criteria, set URL Categories to ScreenMeet. Leave user, group, and location criteria empty so the rule applies to everyone.

6. Under Action, select Do Not Inspect, then select Evaluate Other Policies.

7. Click Save.

Step 3: Allow ScreenMeet in URL and Cloud App Control

Many organizations block the remote access tools category. Confirm that ScreenMeet is not caught by that block.

1. Run a URL lookup for screenmeet.com in the ZIA Admin Portal to see how Zscaler categorizes it.

2. Go to Policy > URL & Cloud App Control > URL Filtering Policy.

3. Click Add URL Filtering Rule.

4. Enter ScreenMeet - Allow in the Rule Name field.

5. Set URL Categories to ScreenMeet and Action to Allow.

6. Set Rule Order above any rule that blocks or cautions remote access tools, uncategorized sites, or file downloads.

7. Click Save.

8. If ScreenMeet appears in the Cloud App Control Policy tab under a category your organization blocks, add an Allow rule for ScreenMeet in that category above the block rule.

Step 4: Allow TCP and UDP 443 in Firewall Filtering

When the ZIA firewall is enabled, the default Firewall Filtering rule blocks traffic that no higher rule allows. Many organizations also block UDP 443 to disable QUIC, which also blocks ScreenMeet's preferred WebRTC media path.

Create a UDP 443 Network Service

1. Go to Administration > Network Services.

2. Click Add Network Service.

3. Enter ScreenMeet-UDP-443 in the Name field.

4. Enter 443 in UDP Destination Ports.

5. Click Save.

Create the Firewall Allow Rule

1. Go to Policy > Firewall Control.

2. Click Add Firewall Filtering Rule.

3. Enter ScreenMeet - Allow 443 in the Rule Name field.

4. Set Rule Order above any rule that blocks QUIC, UDP 443, or non-web traffic.

5. On the Services tab, add HTTPS and ScreenMeet-UDP-443 to Network Services.

6. On the Destination tab, add *.screenmeet.com and *.scrn.mt to IP Address or Wildcard FQDN. If your policy requires IP-based rules, create a destination IP group containing the ScreenMeet static IPs and select it instead.

7. Set Action to Allow.

8. Click Save.

Step 5: Bypass ScreenMeet in Zscaler Client Connector

With Z-Tunnel 2.0, Client Connector tunnels all ports and protocols, including ScreenMeet UDP media, to the Zscaler cloud. Bypassing ScreenMeet sends media directly to ScreenMeet and avoids added latency. Choose the options that match your platforms and forwarding mode.

Option A: Process-Based Bypass (Windows, Recommended)

A process-based bypass follows the ScreenMeet client regardless of which IP addresses it connects to. This applies to the ScreenMeet Remote Support and Beam clients, not to browser-based sessions.

1. In the Client Connector App Profile for Windows, enable Install WFP Driver. Process-based bypass requires this driver.

2. Go to Infrastructure > Common Resources > Application > Process Based.

3. Click Add Application.

4. Enter ScreenMeet in the Name field.

5. In Path, add **\ScreenMeetSupport.exe. Press Enter after the entry.

6. Click Save.

7. Open the Windows App Profile and select ScreenMeet under Process-Based Application Bypass.

8. Click Save.

Option B: Destination Exclusions (Windows and macOS)

1. Open the Client Connector App Profile for the platform.

2. In Destination Exclusions, add each ScreenMeet static IP address. Optionally append :443 to limit the exclusion to port 443.

3. Click Save.

Option C: PAC File Bypass for Web Traffic

If your forwarding profile sends web traffic through the Client Connector listening proxy or uses Z-Tunnel 1.0, add a domain bypass to the App Profile PAC file. Place it before the default return statement.

if (dnsDomainIs(host, ".screenmeet.com") || dnsDomainIs(host, ".scrn.mt")) {
    return "DIRECT";
}

If you use a Z-Tunnel 2.0 forwarding profile PAC file, return the Z-Tunnel 2.0 bypass statement documented by Zscaler, typically PROXY ${ZAPP_TUNNEL2_BYPASS}, for the same domains.

Step 6: Activate Changes

ZIA policy changes do not take effect until they are activated. Click Activate in the ZIA Admin Portal after completing Steps 1 through 4. Client Connector profile changes apply when devices next update their policy.

Verification

1. In the ZIA Admin Portal, open Web Insights logs and filter for screenmeet.com. Confirm the transactions show as not SSL inspected and allowed.

2. Open Firewall Insights logs and confirm UDP 443 traffic to ScreenMeet is allowed, not blocked by a QUIC or default rule.

3. Run the ScreenMeet WebRTC Test Tool. Confirm UDP candidates connect and no certificate or pinning errors appear. A TCP-only result means UDP 443 is still blocked.

4. Start an attended session. The end user must not see an SSL warning when the ScreenMeet window opens.

5. If you use Beam, start an unattended session to a test endpoint and confirm it connects.