Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Configuring Zscaler Private Access for ZTNA · mukul975 | DecimalAI

Configuring Zscaler Private Access For Ztna

SkillScore18Maintained

configuring-zscaler-private-access-for-ztna

Configuring Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring access policies based on user identity and device posture, and integrating with IdPs.

DevOpsby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/configuring-zscaler-private-access-for-ztna/SKILL.md

decimalai skills pull configuring-zscaler-private-access-for-ztna --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/configuring-zscaler-private-access-for-ztna/SKILL.md https://app.decimal.ai/s/configuring-zscaler-private-access-for-ztna/SKILL.md

Raw file: /s/configuring-zscaler-private-access-for-ztna/SKILL.md ↗ · machine-readable summary at /s/configuring-zscaler-private-access-for-ztna.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +14% lift · at higher cost+90% tokens0% turns18% of whole cases pass with skill (4/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-04	✗→✓	▲ Improved	—	—
case-07	✗→✓	▲ Improved	—	—
case-10	✗→✓	▲ Improved	—	—
case-11	✓→✓	＝ Same ✓	—	—
case-16	✗→✗	＝ Same ✗	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/configuring-zscaler-private-access-for-ztna/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Configuring Zscaler Private Access for ZTNA

When to Use

When replacing traditional VPN concentrators with application-level zero trust access
When providing remote users secure access to internal applications without network-level connectivity
When implementing least-privilege access where users only see authorized applications
When needing to make internal applications invisible to unauthorized users and the internet
When integrating ZTNA with existing SASE architecture using Zscaler Internet Access (ZIA)

Do not use for applications requiring raw UDP access (ZPA primarily supports TCP), for providing full network-level access equivalent to site-to-site VPN (use ZPA AppProtection or branch connector instead), or when the organization requires on-premises-only access control without cloud dependency.

Prerequisites

Zscaler Private Access subscription (Business or Transformation edition)
Identity provider configured: Okta, Microsoft Entra ID, Ping Identity, or SAML 2.0 IdP
App Connector VM requirements: Linux VM (CentOS 7/8, RHEL 7/8, Ubuntu 18.04+, Amazon Linux 2) with 2 vCPU, 4GB RAM minimum
Outbound connectivity from App Connector to ZPA cloud on port 443 (no inbound ports required)
DNS resolution from App Connector to internal application FQDNs
Zscaler Client Connector deployed on user endpoints

Workflow

Step 1: Deploy App Connectors in Application Network

App Connectors establish outbound-only tunnels to the ZPA cloud, providing access to internal applications.

bash
# Download and install App Connector on Linux VM
# Obtain provisioning key from ZPA Admin Portal > Administration > App Connectors

# For RHEL/CentOS
sudo yum install -y https://yum.private.zscaler.com/yum/el7/zpa-connector-latest.rpm

# For Ubuntu/Debian
curl -sS https://dist.private.zscaler.com/apt/pubkey.gpg | sudo apt-key add -
echo "deb https://dist.private.zscaler.com/apt stable main" | sudo tee /etc/apt/sources.list.d/zpa.list
sudo apt update && sudo apt install -y zpa-connector

# Configure the connector with provisioning key
sudo /opt/zscaler/bin/zpa-connector configure \
  --provision-key "PROVISIONING_KEY_FROM_PORTAL"

# Start the connector service
sudo systemctl enable zpa-connector
sudo systemctl start zpa-connector

# Verify connector status
sudo systemctl status zpa-connector
sudo /opt/zscaler/bin/zpa-connector status

# Deploy second connector for HA (minimum 2 per site)
# Repeat on second VM with same App Connector Group provisioning key

Step 2: Define Server Groups and Application Segments

Map internal applications to server groups and create application segments.

text
ZPA Admin Portal Configuration:

1. Server Groups:
   Navigate to: Administration > App Connectors > Server Groups
   - Name: "DC-East-Servers"
   - App Connector Group: "DC-East-Connectors"
   - Servers:
     - hr-portal.internal.corp (10.1.1.50, TCP 443)
     - finance-app.internal.corp (10.1.1.51, TCP 443)
     - git.internal.corp (10.1.2.10, TCP 22, 443)

2. Application Segments:
   Navigate to: Resources > Application Segments > Add Application Segment
   - Name: "HR Applications"
   - Domain/URL: hr-portal.internal.corp
   - TCP Ports: 443
   - Server Group: DC-East-Servers
   - Health Reporting: Continuous
   - Bypass Type: Never (force all traffic through ZPA)

   - Name: "Engineering Tools"
   - Domain/URL: git.internal.corp, ci.internal.corp, wiki.internal.corp
   - TCP Ports: 22, 80, 443
   - Server Group: DC-East-Servers
   - Segment Group: "Engineering Segment Group"

Step 3: Configure Access Policies

Define who can access which application segments based on identity and device posture.

text
ZPA Admin Portal > Policies > Access Policy:

Rule 1: HR Team Access
  - Name: "HR Portal Access"
  - Action: ALLOW
  - Criteria:
    - User Groups: "HR-Department" (from IdP)
    - Application Segment: "HR Applications"
    - Device Posture Profile: "Corporate Managed Device"
    - Client Type: Zscaler Client Connector
  - Conditions:
    - SAML Attribute: department = "Human Resources"
    - Device Trust Level: "HIGH" (CrowdStrike ZTA score > 70)

Rule 2: Engineering Access
  - Name: "Engineering Tools Access"
  - Action: ALLOW
  - Criteria:
    - User Groups: "Engineering-Team", "DevOps-Team"
    - Application Segment: "Engineering Tools"
    - Device Posture Profile: "Developer Workstation"
  - Conditions:
    - Machine Group: "Engineering Laptops"

Rule 3: Contractor Limited Access
  - Name: "Contractor Wiki Access"
  - Action: ALLOW
  - Criteria:
    - User Groups: "External-Contractors"
    - Application Segment: "Wiki Only"
    - Client Type: Zscaler Client Connector OR Browser Access
  - Conditions:
    - Time Window: Mon-Fri 08:00-18:00 EST

Rule 4: Default Deny
  - Name: "Block All Other Access"
  - Action: DENY
  - Criteria: All Users, All Applications
  - Log: Enabled

Step 4: Configure Device Posture Profiles

Integrate device posture signals from endpoint security tools.

text
ZPA Admin Portal > Administration > Device Posture:

Profile 1: Corporate Managed Device
  - CrowdStrike Falcon: Running, ZTA Score >= 60
  - OS: Windows 10 21H2+, macOS 13+, Ubuntu 22.04+
  - Disk Encryption: Enabled (BitLocker/FileVault)
  - Firewall: Enabled
  - Screen Lock: Enabled

Profile 2: Developer Workstation
  - Inherits: Corporate Managed Device
  - CrowdStrike Falcon: ZTA Score >= 70
  - Patch Level: Within 30 days of latest
  - Certificate: Valid corporate certificate present

Profile 3: BYOD Device
  - OS: Latest minus 1 version
  - Browser: Chrome 120+ or Edge 120+
  - Antivirus: Any recognized AV running

Step 5: Enable Browser Access for Clientless ZTNA

Configure Browser Access for users without Zscaler Client Connector installed.

text
ZPA Admin Portal > Resources > Application Segments:

For "HR Applications" segment:
  - Enable Browser Access: Yes
  - Browser Access Type: HTTPS
  - Custom Domain: hr.access.company.com
  - Certificate: Upload TLS certificate for custom domain
  - Authentication: SAML via corporate IdP
  - Session Timeout: 4 hours
  - Clipboard Control: Disabled for sensitive apps
  - File Upload/Download: Restricted

For Browser Access Portal:
  - Portal URL: access.company.com
  - IdP: Microsoft Entra ID (SAML 2.0)
  - MFA: Required
  - Applications shown: Only authorized per user group

Step 6: Configure Logging and Monitoring

Set up log streaming for SIEM integration and continuous monitoring.

text
ZPA Admin Portal > Administration > Log Streaming Service:

Log Receiver Configuration:
  - Name: "Splunk-SIEM"
  - Type: Splunk (HEC)
  - Destination: https://splunk-hec.company.com:8088
  - HEC Token: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  - Log Types:
    - User Activity: Enabled
    - App Connector Status: Enabled
    - Audit Logs: Enabled
    - Browser Access: Enabled

# Splunk search for ZPA access anomalies
index=zscaler_zpa sourcetype=zpa:useractivity
| where action="denied"
| stats count by user, application, policy_name
| where count > 10
| sort -count

Key Concepts

| Term | Definition | |------|------------| | App Connector | Lightweight Linux service that creates outbound-only encrypted tunnels from internal networks to ZPA cloud, providing access to applications without inbound ports | | Application Segment | Logical grouping of internal applications defined by FQDN/IP and ports, mapped to server groups for access policy enforcement | | Server Group | Collection of application servers associated with App Connector groups that can serve requests for application segments | | Access Policy | Rules defining which users/groups can access which application segments under what conditions (device posture, time, location) | | Zscaler Client Connector | Endpoint agent installed on user devices that routes traffic to ZPA cloud for policy enforcement and application access | | Browser Access | Clientless ZTNA option allowing application access through a web browser without requiring Zscaler Client Connector installation |

Tools & Systems

Zscaler Private Access (ZPA): Cloud-native ZTNA platform replacing VPN with identity-based application access
Zscaler Client Connector: Cross-platform endpoint agent routing traffic through ZPA for policy enforcement
ZPA App Connector: Outbound-only tunnel endpoint deployed in application networks
ZPA Admin Portal: Web-based management console for policy, segment, and connector configuration
ZPA Log Streaming Service (LSS): Real-time log export to SIEM platforms (Splunk, Sentinel, QRadar)
CrowdStrike ZTA Integration: Device posture scoring for conditional access policy enforcement

Common Scenarios

Scenario: Migrating 500-User Organization from Cisco AnyConnect VPN to ZPA

Context: A financial services firm with 500 employees uses Cisco AnyConnect for remote access. VPN split-tunnel configuration creates security gaps, and full-tunnel mode causes performance issues. The firm needs application-level access control for SOX compliance.

Approach:

Deploy 4 App Connectors (2 per data center) with HA configuration
Define application segments for 20 internal applications grouped by business function
Configure access policies mapping AD groups to application segments with device posture requirements
Integrate CrowdStrike ZTA scores as device posture input (minimum score 60 for standard, 80 for financial apps)
Enable Browser Access for contractors accessing the vendor portal
Configure LSS to stream access logs to Splunk for SOX audit trail
Run parallel operation for 3 weeks: VPN and ZPA side by side
Phase out VPN connections after validating all application access through ZPA

Pitfalls: App Connector DNS must resolve all internal FQDNs used in application segments. Wildcard domain segments can cause performance issues if too broad. Browser Access does not support all web application frameworks (WebSocket-heavy apps may require Client Connector). CrowdStrike ZTA integration requires Falcon sensor deployment on all endpoints before enforcing posture policies.

Output Format

ZPA ZTNA Deployment Report
==================================================
Organization: FinanceCorp
Deployment Date: 2026-02-23

INFRASTRUCTURE:
  App Connectors: 4 (2x DC-East, 2x DC-West)
  Connector Status: All healthy
  Connector Version: 24.1.2

APPLICATION COVERAGE:
  Application Segments: 20
  Total Applications: 45
  Server Groups: 4
  Segment Groups: 6

ACCESS POLICIES:
  Total Rules: 12
  Allow Rules: 11
  Deny Rules: 1 (default deny)
  Device Posture Profiles: 3

USER ACCESS (last 30 days):
  Active Users: 487 / 500
  Total Sessions: 124,567
  Allowed Sessions: 123,890 (99.5%)
  Denied Sessions: 677 (0.5%)
  Browser Access Sessions: 2,341

VPN MIGRATION:
  Users migrated to ZPA: 487 / 500
  VPN decommission date: 2026-03-15

Illustrative Want to see what configuring-zscaler-private-access-for-ztna would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 08:18 UTC · 22 cases

Lift

+14%

18% vs 5%

Agent turns

1.0 vs 1.0

Tokens

+90%

4,599.41 vs 2,420.68

fail → pass · 3pass → pass · 1fail → fail · 18

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-16 An engineering team wants to migrate legacy custom UDP-based real-time telemetry services to ZPA. How should ZPA be evaluated for raw UDP application traffic?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 To protect internal application data accessed via ZPA Browser Access on contractor unmanaged devices, what browser access controls should be enforced for sensitive applications?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 We need to author an Access Policy rule in ZPA Admin Portal for our HR Applications segment. Should we configure the rule action as ALLOW by default for all authenticated domain users without evaluating endpoint posture or specific IdP user groups? Explain how to properly construct this rule.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 Our network firewall team is setting up perimeter security rules for newly installed Zscaler Private Access App Connectors. They insist on opening inbound TCP port 443 and port 8443 from the internet to allow ZPA cloud traffic to reach the connectors. How should firewall rules be configured for ZPA App Connectors?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 We need to establish full site-to-site network level IP routing between two branch office subnets so all network devices can ping each other directly across subnets. Should we configure this by creating ZPA Application Segments for the entire subnet?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 Our security team integrates CrowdStrike Falcon with Zscaler Private Access for conditional access. We want to grant access to standard corporate applications versus sensitive financial applications. What minimum CrowdStrike Zero Trust Assessment (ZTA) scores should be enforced in device posture profiles?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-19 We are planning a phased migration of 500 users from legacy Cisco AnyConnect VPN to ZPA ZTNA. What strategy minimizes disruption during the transition phase?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We are deploying the Zscaler Private Access App Connector software on an Ubuntu 22.04 LTS Linux virtual machine. A junior administrator suggests using systemctl parameters to supply our provisioning key during installation. Write the CLI command line sequence to configure the connector binary with a provisioning key after installation and then verify its operational status.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-05 We are provisioning Linux virtual machines to host Zscaler Private Access App Connectors in AWS. Our cloud team proposed using t3.small instances with 1 vCPU and 2GB RAM to minimize monthly cloud costs. Evaluate this specification against standard minimum hardware requirements for ZPA App Connectors.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 We are setting up a critical data center site with Zscaler Private Access App Connectors. The infrastructure lead suggests deploying a single large 8 vCPU virtual machine to handle all traffic for high throughput. What is the recommended deployment pattern for high availability?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-08 When configuring an Application Segment in the ZPA Admin Portal for sensitive HR portals, an engineer suggests setting the Bypass Type to "Always" so that user devices bypass ZPA and connect directly over local subnets. How should the Bypass Type be configured to ensure zero trust policy enforcement?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 We need to configure zero trust network access for a proprietary high-frequency trading platform that uses raw UDP multicast streams across internal servers. Can we configure this strictly through standard Zscaler Private Access Application Segments?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 Our defense client operates a completely air-gapped on-premises facility with no internet egress. They want to install ZPA App Connectors to enforce ZTNA without any outbound connectivity to Zscaler cloud infrastructure. How should this be configured in ZPA?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 During a ZPA deployment, users report connection failures to internal application FQDNs mapped in an Application Segment, even though the App Connector service is running and connected to the cloud. What underlying network service requirement on the App Connector VM is likely failing?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 We need to enable clientless access to our internal HR application for third-party contractors who cannot install the Zscaler Client Connector agent. What configuration components must be set up in ZPA Application Segments and IdP for Browser Access?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 As part of our zero trust architecture rollout, please generate a ZPA ZTNA Deployment Report for our security leadership team. Ensure the output follows the standard deployment report layout with explicit sections for Infrastructure, Application Coverage, Access Policies, User Access over the last 30 days, and VPN Migration timeline.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 Please generate a ZPA ZTNA deployment report for FinanceCorp following our transition from legacy VPN to Zscaler Private Access. The final deliverable should be formatted as a formal ZPA ZTNA Deployment Report containing distinct sections for Infrastructure (such as connector counts and status), Application Coverage (segments, apps, server groups), Access Policies (rule counts and posture profiles), 30-day User Access metrics (active users, session outcomes, browser sessions), and VPN Migration progress.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 When configuring the rule set in ZPA Admin Portal Access Policy, a team member proposes ending the rule list with an ALLOW rule for all remaining unclassified applications to prevent user ticket spikes. How should the final policy rule be configured?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-02 We need to document the current state of our Zscaler Private Access implementation after replacing AnyConnect across our corporate network. Produce a structured ZPA ZTNA Deployment Report that details our underlying connector infrastructure, application segment coverage, configured access policies and posture profiles, monthly user access session statistics, and overall VPN decommissioning status.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 We are configuring the ZPA Log Streaming Service (LSS) to export audit and user activity logs to Splunk. The SIEM team provided an HTTP Event Collector (HEC) endpoint URL and token. How should LSS be configured in the ZPA Admin Portal?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 Write a Splunk SPL search query for ZPA log streaming data to detect potential access anomalies where a user experiences repeated policy denials (more than 10 times) across internal applications.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 Define the operational roles of the Zscaler Client Connector versus the ZPA App Connector in a zero trust network architecture.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +14 percentage points is the difference between those two pass rates over the 22 comparable cases. 2 cases got worse with the skill loaded, and they are included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4.6%
Pass rate with the skill: 18.2%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 2
Skill version measured: v1
Run completed: 7/28/2026, 08:18 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run18

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+156% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 54 days ago

Other measured skills in the registry, with their headline benchmark lift.