Problem Description

Users attempting to access YouTube through ZTSA Internet Access may repeatedly receive a prompt requesting them to sign in to confirm they are not a bot.
The message persists even after refreshing the page and may block normal YouTube access.

Root Cause

YouTube may trigger bot verification when it detects traffic patterns associated with:

• Cloud proxy services
• VPN usage
• Public or shared IP addresses

This mechanism is designed to prevent abuse, spam, and automated traffic. ZTSA Cloud Proxy traffic may meet these detection criteria.

Resolution / Workaround

Option 1: Sign in with a YouTube Account (Recommended)

Signing in with a valid YouTube or Google account can reduce the likelihood of bot verification prompts when accessing YouTube through ZTSA IA.

Option 2: Scan YouTube Traffic Using an On Premises Gateway

If YouTube traffic inspection is required and no user account is available:

• Deploy a ZTSA On-Premises Gateway within the local network.
• Route YouTube traffic through the on premises gateway instead of the cloud proxy.

This approach reduces exposure to public cloud IP detection.

Refer to the Deploying an Internet Access On-Premises Gateway guide for instructions on how to deploy ZTSA On-Premises Gateway.

Option 3: Redirect YouTube Traffic to a Specific Regional Cloud Proxy

As an alternative, YouTube traffic can be forwarded via PAC file to a designated ZTSA IA proxy deployed in Google Cloud (for example, Taiwan or Qatar regions)

        var youtubeProxy = "PROXY proxy-tw.sg.ztsa-iag.trendmicro.com:80;DIRECT"; //for Taiwan
        var youtubeProxy = "PROXY proxy-qa.mea.ztsa-iag.trendmicro.com:80;DIRECT"; // for Qatar

        // Define the domains that should use the proxy
        var domains = ["*.youtube.com", "*.googlevideo.com","youtube.com"];
    
        // Function to check if the host matches any of the specified domains with wildcards
        function isInDomainList(host, domains) {
            for (var i = 0; i < domains.length; i++) {
                if (shExpMatch(host, domains[i])) {
                    return true;
                }
            }
            return false;
        }

        // Check if the host matches any of the specified domains
        if (isInDomainList(host, domains)) {
            return youtubeProxy;
        }
    

Option 4: Bypass YouTube Traffic from Inspection

If scanning YouTube traffic is not required, add the following domains to the SkipHosts section of the PAC file to allow direct access:

• *.youtube.com
• *.googlevideo.com
• youtube.com

This prevents YouTube traffic from being routed through the ZTSA proxy.

Troubleshooting

If the issue persists after applying the recommended configuration:

1. Use browser Developer Tools to confirm the actual YouTube host being accessed because the YouTube domains may vary by region.
    

   If the actual YouTube host does not match that in the PAC file configuration, please add the actual YouTube host to the corresponding section in the PAC file.
2. Verify that the domain matches the PAC file configuration.
3. If the problem continues, submit a PCT case and include browser HAR files for further analysis.

For support assistance, please contact TrendAI™ Technical Support.