cloudflare-one-migrations

Export URL filtering, firewall, SSL inspection, DLP, custom categories, and location data from ZIA, then map policies to Cloudflare Gateway traffic policies and lists. Note that ZIA caution/warn behavior and DLP engines have no exact equivalent and require explicit decisions.

ZPA app segments do not map 1:1. Create one Cloudflare Tunnel per connector group, convert app segment IPs to CIDR routes and domains to hostname routes, and attach reusable Access policies. Watch the default 5-hostname-per-app limit for large segments.

Palo Alto rules can map to Cloudflare resources, but one rule often produces multiple objects and App-ID, zones, HIP, and decryption behavior rarely translate exactly. Export address/service objects with rules and mark partial mappings rather than forcing equivalence.

In default-deny Gateway Network environments, broad L4 block rules evaluated before Access can block private app traffic. Add a Network allow rule with the "Self-hosted Access App with Private Address is Present" selector at higher precedence than the block rules.

ZPA bypass rules require manual split-tunnel exclude configuration with no API automation, DLP profiles need manual recreation, and IP-anchored apps require an explicit egress decision. Broad catchall rules should never be auto-created to preserve connectivity.