cloudflare-one-migrations

Export URL filtering, firewall, SSL inspection, DLP, and custom category policies from ZIA, then map them to Cloudflare Gateway traffic policies and lists. Create rules disabled or in audit mode first, pilot with small groups, and compare logs before expanding rollout.

Create one Cloudflare Tunnel per ZPA connector group, map app segment IPs to CIDR routes and domains to hostname routes, then build reusable Access policies before attaching them to applications. Match cloudflared replica count to the connector instance count per group.

Not directly. One Palo Alto rule can produce multiple Cloudflare resources, and App-ID, zones, HIP profiles, and decryption behavior rarely translate exactly. Export address and service objects with the rules and mark partial mappings rather than forcing equivalence.

The default limit is 5 hostnames per Access application. For large ZPA app segments, contact the Cloudflare account team to request an increase up to 50 before implementation, or split segments into multiple apps with identical policies.

In default-deny Gateway Network environments, broad L4 block rules evaluate before Access policies. Add a Network allow rule with the selector for self-hosted Access apps with private addresses at higher precedence than the block rules.

Zscaler caution/warn behavior has no exact Gateway equivalent and must be an explicit customer decision. DLP engines and custom regex require manual Cloudflare DLP profile recreation, and identity-scoped rules need SCIM sync or user/email lists to avoid overly broad policies.