cloudflare-one-migrations

Export ZIA URL filtering, firewall, SSL inspection, DLP, and custom category policies, then map them to Cloudflare Gateway traffic policies and lists. Note that ZIA caution/warn behavior has no Gateway equivalent and must be an explicit allow/block decision.

Create one Cloudflare Tunnel per ZPA connector group, with app segment IPs becoming CIDR routes and domains becoming hostname routes. Each ZPA access policy rule maps to a reusable Cloudflare Access policy created before attaching to apps.

The default Access application limit is 5 hostnames per app. For large ZPA app segments, contact the Cloudflare account team to raise it to 50 before implementation, or split segments into multiple apps with identical policies.

In default-deny Gateway Network environments, broad L4 block rules evaluate before Access policy. Add a Network allow rule with the "Self-hosted Access App with Private Address is Present" selector at higher precedence than the block rules.

No. One Palo Alto rule can produce multiple Cloudflare resources, and App-ID, URL categories, zones, HIP, and decryption behavior rarely translate exactly. Preserve rule intent, mark partial mappings, and never auto-create broad catchall rules.

Request structured exports of policies, address/service objects and groups, users and groups, tunnels or connectors, locations, and hit counts. Screenshots and prose summaries hide missing objects and cause silent mapping gaps.