Common use case
Monitor private services without exposing them
Check private services without publishing health endpoints or giving every probe broad access to the surrounding network.
Short answer
Use one supervised wzctl pass for each fixed TCP probe. Use the full client when a trusted collector intentionally needs several private destinations.
The problem
External monitoring cannot normally reach private endpoints. Publishing health routes adds public surface, while deploying a full monitoring stack in every network adds operational cost.
Choose and scope the connection model
Choose isolated local ports for fixed probes. For a controlled multi-target collector, use direct private DNS and routes through the full client under the intended group policy.
- 1Deploy a publisher that can reach the monitored service.
- 2For an isolated probe, create a pass for the publisher ID, exact target IP, and TCP port.
- 3Run wzctl under a service or container supervisor and configure the probe for its 127.0.0.1 port.
- 4For several authorized targets, run the full client on a trusted collector and use their private addresses directly.
Example access flow
Process
Monitoring agent with supervised wzctl
Local endpoint
http://127.0.0.1:19100Access-pass target
10.0.8.12:9100 (/32)Authorization boundary
One TCP exporter target per pass
When this pattern fits
- A probe checks one HTTP, HTTPS, exporter, or other TCP endpoint.
- The monitoring environment can supervise one or more wzctl processes.
- A trusted collector needs several destinations and can run the full client.
- Monitoring credentials, TLS validation, and alerting are managed separately.
Security boundary and limitations
- A wzctl pass supports TCP only. It cannot carry UDP checks, ICMP ping, service discovery, or private DNS.
- Several fixed targets require several passes. A full-client collector receives authorized CIDRs unless effective restricted rules narrow them.
- The monitored service still controls authentication, TLS, exposed data, and rate limits.
Frequently asked questions
Can wzctl run as an unattended probe path?+
Yes. Use a service manager or container supervisor to keep the foreground process running and renew it when needed.
Can one pass monitor an entire subnet?+
No. One pass maps one local port to one exact IP and TCP port. Use separate passes or an intentionally authorized full client.
Does WireZTNA provide metrics and alerts?+
No. It provides reachability. Your monitoring platform remains responsible for collection, storage, dashboards, and alerting.