skills.rest
zscaler
zscalerOFFICIAL
Explore all skills by this author →
WebsiteGitHub

zpa-create-forwarding-policy-rule

Configure ZPA forwarding policy rules with actions and condition blocks.

44|24|Updated May 29, 2025
Search Tags:#bypass#conditions#intercept#traffic-routing#zscaler#zpa#forwarding-policy
One-click install
npx skills add https://github.com/zscaler/zscaler-mcp-server --skill zpa-create-forwarding-policy-rule
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: zpa-create-forwarding-policy-rule
Source: https://github.com/zscaler/zscaler-mcp-server/tree/main/skills/zpa/create-forwarding-policy-rule
Command: npx skills add https://github.com/zscaler/zscaler-mcp-server --skill zpa-create-forwarding-policy-rule

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Create ZPA forwarding policy rules that determine how traffic from the Zscaler Client Connector is routed, enabling precise control over bypass, interception, or conditional routing.

Core Features & Use Cases

  • Supports actions: BYPASS, INTERCEPT, and INTERCEPT_ACCESSIBLE to control how traffic reaches apps.
  • Uses condition blocks based on object types such as APP, APP_GROUP, CLIENT_TYPE, MACHINE_GRP, LOCATION, PLATFORM, COUNTRY_CODE, POSTURE, TRUSTED_NETWORK, SAML, and SCIM to scope rules.
  • Common scenarios include bypassing ZPA for specific apps, routing traffic through ZPA for contractors, or applying conditional routing based on user context or device attributes.

Quick Start

Create a forwarding policy rule named Sample Rule with action BYPASS and a simple APP_GROUP condition.

Frequently Asked Questions about zpa-create-forwarding-policy-rule

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure ZPA forwarding policy rules to bypass traffic for specific applications?▼

ZPA forwarding policy rules can bypass traffic by setting the action to BYPASS and applying condition blocks based on APP or APP_GROUP. This routes matching traffic directly, bypassing ZPA interception.

What is the difference between INTERCEPT and INTERCEPT_ACCESSIBLE actions in ZPA traffic routing?▼

In ZPA traffic routing, INTERCEPT routes traffic through the Zscaler Client Connector for inspection, while INTERCEPT_ACCESSIBLE allows traffic to reach apps that are directly accessible on the local network without tunneling.

Can I route Zscaler Client Connector traffic based on device posture or trusted networks?▼

Yes, you can conditionally route Zscaler Client Connector traffic by creating forwarding policy rules with condition blocks based on POSTURE or TRUSTED_NETWORK, allowing access control based on device attributes.

What ZPA object IDs do I need before creating a forwarding policy rule?▼

Before creating a forwarding policy rule, you need to gather object IDs using lookup tools for application segments, segment groups, SCIM groups, SAML attributes, trusted networks, and posture profiles to define conditions.

What condition types are supported for scoping ZPA forwarding policy rules?▼

ZPA forwarding policy rules support condition blocks based on APP, APP_GROUP, CLIENT_TYPE, LOCATION, PLATFORM, COUNTRY_CODE, TRUSTED_NETWORK, SAML, SCIM, and POSTURE to precisely scope traffic routing.

Does ZPA forwarding support routing traffic differently for contractors versus internal users?▼

Yes, ZPA forwarding policy rules can differentiate traffic routing for contractors versus internal users by applying condition blocks based on SAML, SCIM, or CLIENT_TYPE to scope interception or bypass actions.

Related Skills

Explore More Software Engineering Skills→
zscalerzscaler
44

zpa-create-timeout-policy-rule

Create ZPA timeout policy rules with re-authentication and idle timeout conditions.

Official
Advanced
EntroVyxEntroVyx
3

hunt-saml

Analyze SAMLResponse XML signatures to identify authentication bypass vulnerabilities.

Community
Advanced
zscalerzscaler
44

zpa-onboard-application

Automate end-to-end ZPA application onboarding from connector groups to access policies.

Official
Advanced
RayzerrekRayzerrek

cloudflare-one-migrations

Plan Cloudflare One migrations from Zscaler, Palo Alto, VPN, SWG, and SASE environments.

Community
Advanced