What it does. Configures Zero Trust Network Access using Zscaler Private Access (ZPA) to broker identity-based, context-aware connections between authenticated users and internal applications through the Zscaler Zero Trust Exchange, without placing users on the corporate network. Use when replacing traditional VPN architectures with ZTNA, or when brokering secure per-application access for remote and hybrid users via Zscaler. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-zero-trust-network-access-with-zscaler/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-zero-trust-network-access-with-zscaler, or copy the skill folder into ~/.claude/skills/implementing-zero-trust-network-access-with-zscaler/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-network-access-with-zscaler/SKILL.md

SKILL.md (verbatim)

name: implementing-zero-trust-network-access-with-zscaler
description: Configures Zero Trust Network Access using Zscaler Private Access (ZPA) to broker identity-based, context-aware connections between authenticated users and internal applications through the Zscaler Zero Trust Exchange, without placing users on the corporate network. Use when replacing traditional VPN architectures with ZTNA, or when brokering secure per-application access for remote and hybrid users via Zscaler.
domain: cybersecurity
subdomain: zero-trust-architecture
tags:
- zero-trust
- ztna
- zscaler
- network-access
- vpn-replacement
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.AA-01
- PR.AA-05
- PR.IR-01
- GV.PO-01
mitre_attack:
- T1078
- T1190
- T1059

Implementing Zero Trust Network Access with Zscaler

Prerequisites

• Understanding of zero trust principles (NIST SP 800-207)
• Familiarity with identity providers (Okta, Azure AD, Ping Identity)
• Knowledge of network security fundamentals
• Access to Zscaler Private Access (ZPA) tenant

Overview

Zero Trust Network Access (ZTNA) replaces traditional VPN architectures by enforcing identity-based, context-aware access to private applications without placing users on the corporate network. Zscaler Private Access (ZPA) is a leading ZTNA solution that brokers secure connections between authenticated users and internal applications through the Zscaler Zero Trust Exchange cloud platform.

This skill covers end-to-end deployment of ZPA including connector setup, application segmentation, policy configuration, and integration with identity providers for continuous verification.

When to Use

• When deploying or configuring implementing zero trust network access with zscaler capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Familiarity with zero trust architecture concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Architecture

Zscaler Private Access Components

1. Client Connector: Lightweight agent on user endpoints that establishes outbound TLS tunnels to the nearest ZPA Service Edge
2. ZPA Service Edge: Cloud-hosted broker (or Private Service Edge on-premises) that stitches user-to-app connections after policy evaluation
3. App Connector: Lightweight VM deployed in the application environment that creates outbound tunnels to the Service Edge
4. ZPA Admin Portal: Centralized management console for defining applications, segments, and access policies

Connection Flow

User Device (Client Connector)
    |
    v [Outbound TLS tunnel]
ZPA Service Edge (Policy Evaluation + IdP Auth)
    |
    v [Outbound TLS tunnel]
App Connector --> Internal Application

Key principle: No inbound connections are required. Both the Client Connector and App Connector initiate outbound-only connections, eliminating the attack surface of traditional VPNs.

Key Concepts

Application Segments

Define specific applications or groups of applications by IP address, FQDN, port, and protocol. Segments enable granular microsegmentation rather than broad network access.

Access Policies

Policies combine user identity, group membership, device posture, and contextual signals (location, time) to grant or deny access to application segments.

Server Groups

Logical groupings of App Connectors that serve specific application segments, enabling high availability and geographic distribution.

Browser Access

ZPA supports clientless browser-based access for web applications, enabling ZTNA for unmanaged devices and third-party users without requiring the Client Connector.

Workflow

Phase 1: Foundation Setup

1. Configure Identity Provider Integration

   • Navigate to Administration > IdP Configuration in ZPA Admin Portal
   • Add SAML 2.0 or OIDC integration with your IdP (Azure AD, Okta, Ping)
   • Configure SCIM provisioning for automatic user/group synchronization
   • Test SSO authentication flow

2. Deploy App Connectors

   • Provision App Connector VMs in each application environment (data center, AWS VPC, Azure VNet)
   • Download the provisioning key from ZPA Admin Portal
   • Install and enroll the App Connector using the provisioning key
   • Verify connector status shows "Healthy" in the admin portal
   • Deploy at least two connectors per environment for high availability

3. Create Server Groups

   • Group App Connectors by geographic location or application tier
   • Configure health check intervals and failover behavior

Phase 2: Application Segmentation

4. Define Application Segments

   • Create segments for each application or logical group
   • Specify domains/IPs, ports, and protocols
   • Associate segments with appropriate server groups
   • Enable or disable browser access as needed

5. Create Segment Groups

   • Organize application segments into logical groups (e.g., HR apps, Finance apps)
   • Use segment groups to simplify policy management

Phase 3: Policy Configuration

6. Configure Access Policies

   • Define rules matching user groups to application segments
   • Apply conditions: device posture, client type, SAML attributes
   • Order rules by priority (most restrictive first)
   • Create deny rules for blocked access scenarios

7. Enable Device Posture Checks

   • Configure posture profiles requiring OS patch level, disk encryption, antivirus status
   • Integrate with endpoint management (CrowdStrike, Microsoft Intune, Carbon Black)
   • Associate posture profiles with access policies

Phase 4: Client Deployment

8. Deploy Client Connector
   • Package the Zscaler Client Connector with enrollment token
   • Deploy via MDM (Intune, Jamf, SCCM) or manual installation
   • Configure forwarding profile to route private app traffic through ZPA
   • Test user authentication and application access

Phase 5: Monitoring and Optimization

9. Enable Logging and Monitoring

   • Configure log streaming to SIEM (Splunk, Sentinel, QRadar)
   • Set up alerts for policy violations, connector health, and authentication failures
   • Review ZPA Insights dashboard for usage analytics

10. Iterative Refinement

    • Analyze access logs to identify shadow IT and unauthorized access attempts
    • Refine application segments based on actual traffic patterns
    • Expand coverage from pilot applications to full enterprise deployment

Validation Checklist

• Identity provider integration tested with SSO and SCIM sync
• App Connectors deployed and showing healthy status in all environments
• Application segments defined with correct IPs/FQDNs, ports, protocols
• Access policies enforce least-privilege per user group
• Device posture checks block non-compliant endpoints
• Client Connector deployed to all managed endpoints
• Log streaming to SIEM confirmed with test events
• Failover tested by disabling one App Connector per server group
• Browser Access configured for web apps requiring third-party access
• VPN decommission plan documented with rollback procedures

References

• NIST SP 800-207: Zero Trust Architecture
• CISA Zero Trust Maturity Model v2.0 - Network Pillar
• Zscaler Private Access Architecture Guide
• CSA Software-Defined Perimeter and Zero Trust Specification v2.0

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

ZTNA Deployment Plan Template

Project Information

Field	Value
Project Name
Organization
Project Lead
Start Date
Target Completion
ZPA Tenant ID

Current State Assessment

Existing Remote Access

• VPN Solution: [e.g., Cisco AnyConnect, Palo Alto GlobalProtect]
• Concurrent VPN Users: [number]
• VPN Concentrator Locations: [list]
• Known VPN Issues: [latency, split-tunnel risks, capacity]

Application Inventory

App Name	FQDN/IP	Port	Protocol	User Groups	Criticality	Migration Wave

Identity Provider

• Primary IdP: [Azure AD / Okta / Ping Identity / Other]
• MFA Enabled: [Yes/No - Method]
• SCIM Supported: [Yes/No]
• Federation Protocol: [SAML 2.0 / OIDC]

ZPA Architecture Design

App Connector Placement

Environment	Location	VM Count	Server Group
Primary DC		2
DR Site		2
AWS VPC		2
Azure VNet		2

Application Segments

Segment Name	Domains/IPs	TCP Ports	UDP Ports	Server Group	Browser Access

Access Policy Matrix

Policy Name	User Groups	App Segments	Posture Profile	Conditions	Action
					Allow
					Allow
Block Default	All	All	None	None	Deny

Device Posture Profiles

Profile Name	OS	Min Version	Disk Encryption	AV/EDR Required	Domain Joined
Corporate Managed	Windows	10 22H2+	BitLocker	CrowdStrike	Yes
Corporate Managed	macOS	14.0+	FileVault	CrowdStrike	No
BYOD	Any	Current-1	Any	Any	No

Migration Plan

Wave 1: Low-Risk Web Applications (Weeks 1-2)

• Applications: [list]
• User groups: [list]
• Success criteria: [define]
• Rollback plan: [define]

Wave 2: Business-Critical Web Apps (Weeks 3-5)

• Applications: [list]
• User groups: [list]
• Success criteria: [define]
• Rollback plan: [define]

Wave 3: Non-Web TCP/UDP Applications (Weeks 6-8)

• Applications: [list]
• User groups: [list]
• Success criteria: [define]
• Rollback plan: [define]

Wave 4: Legacy Applications (Weeks 9-12)

• Applications: [list]
• User groups: [list]
• Success criteria: [define]
• Rollback plan: [define]

SIEM Integration

Field	Value
SIEM Platform	[Splunk / Sentinel / QRadar / Other]
Log Streaming Method	[HTTPS / Syslog / Cloud NSS]
Log Types	[User Activity / App Connector Status / Policy Violations]
Retention Period
Alert Rules

Testing Plan

Functional Tests

• User authentication via IdP
• Application access per policy
• Device posture enforcement
• Browser Access for web apps
• Failover between App Connectors
• Client Connector auto-update

Security Tests

• Unauthorized user access denied
• Non-compliant device blocked or restricted
• No lateral movement between segments
• Log events captured in SIEM
• Incident response playbook tested

Performance Tests

• Application latency within SLA
• Throughput meets requirements
• Service Edge selection optimal for user locations

Sign-Off

Stakeholder	Role	Approval	Date
	Network Security
	Identity Team
	Application Owners
	CISO / Security Lead
	IT Operations

references/api-reference.md (verbatim)

API Reference: Zscaler Private Access (ZPA)

ZPA Management API

Authentication

POST https://config.private.zscaler.com/signin
Body: client_id=X&client_secret=Y
Returns: {"access_token": "...", "token_type": "Bearer"}

Application Segments

Method	Endpoint	Description
GET	/mgmtconfig/v1/admin/customers/{id}/application	List app segments
POST	/mgmtconfig/v1/admin/customers/{id}/application	Create app segment

Server Groups

Method	Endpoint	Description
GET	/mgmtconfig/v1/admin/customers/{id}/serverGroup	List server groups

Access Policies

Method	Endpoint	Description
GET	/mgmtconfig/v1/admin/customers/{id}/policySet/rules	List policy rules

Connectors

Method	Endpoint	Description
GET	/mgmtconfig/v1/admin/customers/{id}/connector	List connectors

App Segment Fields

Field	Description
name	Application segment name
enabled	Whether segment is active
bypassType	NEVER, ALWAYS, or ON_NET
domainNames	FQDN list for the segment
tcpPortRanges	Allowed TCP port ranges

Bypass Types

Value	Security Implication
NEVER	Always enforce ZPA (recommended)
ALWAYS	Bypass ZPA entirely (high risk)
ON_NET	Bypass when on corporate network

References

• ZPA API: https://help.zscaler.com/zpa/about-zpa-api
• ZPA Admin Guide: https://help.zscaler.com/zpa

references/standards.md (verbatim)

Standards and Frameworks Reference

NIST SP 800-207: Zero Trust Architecture

Core Tenets Applicable to ZTNA

1. All data sources and computing services are considered resources - Every application behind ZPA is treated as a discrete resource requiring explicit access grants
2. All communication is secured regardless of network location - ZPA encrypts all tunnels end-to-end regardless of whether users are on-premises or remote
3. Access to individual enterprise resources is granted on a per-session basis - ZPA evaluates policy for each connection request rather than granting persistent network access
4. Access to resources is determined by dynamic policy - ZPA policies incorporate identity, device posture, location, and behavioral signals
5. The enterprise monitors and measures the integrity and security posture of all owned and associated assets - Device posture checks validate endpoint compliance before granting access
6. All resource authentication and authorization are dynamic and strictly enforced before access is allowed - ZPA requires authentication through IdP and authorization through policy engine for every session

NIST ZTA Deployment Models

• Enhanced Identity Governance: ZPA implements this model by using identity as the primary decision factor combined with device trust signals
• Micro-Segmentation: ZPA application segments function as software-defined microsegments at the application layer
• Software Defined Perimeters: ZPA directly implements the SDP model with its broker-based architecture

NIST SP 800-207A: Zero Trust Architecture Model for Cloud-Native Applications

• Extends zero trust principles to multi-cloud environments
• ZPA App Connectors can be deployed across AWS, Azure, GCP, and on-premises
• Supports workload-to-workload zero trust with ZPA for workloads

CISA Zero Trust Maturity Model v2.0

Network Pillar

Maturity Level	Capability	ZPA Implementation
Traditional	Macro-segmentation with static rules	Legacy VPN replaced by ZPA
Initial	Define network architecture with isolation	App Connectors isolate segments
Advanced	Micro-perimeters with identity-based access	Per-app segments with IdP integration
Optimal	Dynamic microsegmentation with continuous verification	Real-time posture + behavioral analytics

Identity Pillar

Maturity Level	Capability	ZPA Implementation
Traditional	Password-based, agency-managed	Basic IdP integration
Initial	MFA for privileged users, federated identity	SAML/OIDC with IdP, SCIM provisioning
Advanced	MFA for all users, phishing-resistant	Conditional access with posture checks
Optimal	Continuous validation, risk-based authentication	ZPA + CrowdStrike/UEBA integration

Devices Pillar

Maturity Level	Capability	ZPA Implementation
Traditional	Limited device visibility	Manual device inventory
Initial	Compliance enforcement for some devices	Basic posture profiles
Advanced	Real-time device analytics	CrowdStrike ZTA score integration
Optimal	Continuous diagnostics and mitigation	EDR-driven dynamic access decisions

CSA Software-Defined Perimeter Specification v2.0

SDP Architecture Mapping to ZPA

SDP Component	ZPA Equivalent
SDP Controller	ZPA Service Edge + Policy Engine
Initiating Host (IH)	Client Connector
Accepting Host (AH)	App Connector
SDP Gateway	ZPA Service Edge

SDP Deployment Models

• Client-to-Gateway: Standard ZPA deployment (user to application via Service Edge)
• Client-to-Server: ZPA Browser Access (direct browser connection through Service Edge)
• Server-to-Server: ZPA Workload-to-Workload (App Connector to App Connector)
• Client-to-Server-to-Client: Not directly supported in ZPA

DoD Zero Trust Reference Architecture v2.0

Pillar Alignment

• ZPA maps to the Network & Environment pillar through application-layer microsegmentation
• ZPA maps to the User pillar through IdP integration and continuous authentication
• ZPA maps to the Device pillar through endpoint posture assessment
• ZPA maps to the Application & Workload pillar through per-application access control
• Visibility & Analytics pillar addressed through ZPA log streaming and analytics dashboards

Compliance Mapping

Regulation	Requirement	ZPA Capability
NIST 800-53 AC-4	Information flow enforcement	Application segment policies
NIST 800-53 AC-17	Remote access	ZTNA replaces VPN
PCI DSS 4.0 Req 1	Network security controls	Microsegmentation per cardholder segment
HIPAA 164.312(e)	Transmission security	End-to-end encrypted tunnels
SOX Section 404	Access controls over financial systems	Auditable per-session access logs
FedRAMP	Continuous monitoring	ZPA FedRAMP Moderate authorized

references/workflows.md (verbatim)

ZTNA Implementation Workflows

Workflow 1: Initial ZPA Deployment

┌─────────────────┐
│ Pre-Assessment   │
│ - Inventory apps │
│ - Map user groups│
│ - Classify data  │
└───────┬─────────┘
        v
┌─────────────────────┐
│ IdP Integration      │
│ - SAML/OIDC config   │
│ - SCIM provisioning  │
│ - MFA enrollment     │
│ - Test SSO flow      │
└───────┬─────────────┘
        v
┌─────────────────────┐
│ App Connector Deploy │
│ - Provision VMs      │
│ - Generate enroll key│
│ - Install + enroll   │
│ - Health validation  │
└───────┬─────────────┘
        v
┌─────────────────────┐
│ Application Segments │
│ - Define apps by     │
│   FQDN/IP + ports   │
│ - Create seg groups  │
│ - Map to server grps │
└───────┬─────────────┘
        v
┌─────────────────────┐
│ Access Policies      │
│ - User->App mapping  │
│ - Posture conditions │
│ - Deny rules         │
│ - Priority ordering  │
└───────┬─────────────┘
        v
┌─────────────────────┐
│ Client Deployment    │
│ - Package connector  │
│ - MDM distribution   │
│ - Forwarding profile │
│ - User acceptance    │
└───────┬─────────────┘
        v
┌─────────────────────┐
│ Validation & Monitor │
│ - Access testing     │
│ - SIEM integration   │
│ - Dashboard setup    │
│ - Incident playbooks │
└─────────────────────┘

Workflow 2: Access Request Evaluation (Runtime)

User Request
    │
    v
┌──────────────────┐    ┌──────────────────┐
│ Client Connector  │───>│ ZPA Service Edge  │
│ - Capture request │    │ - Receive tunnel  │
│ - Forward to edge │    │ - Identify user   │
└──────────────────┘    └────────┬─────────┘
                                 │
                    ┌────────────v────────────┐
                    │ Authentication          │
                    │ - Redirect to IdP       │
                    │ - Validate SAML/OIDC    │
                    │ - Check MFA completion  │
                    └────────────┬────────────┘
                                 │
                    ┌────────────v────────────┐
                    │ Authorization            │
                    │ - Match access policies  │
                    │ - Evaluate posture       │
                    │ - Check context signals  │
                    │ - Apply least privilege  │
                    └────────────┬────────────┘
                                 │
                    ┌────YES─────┴─────NO────┐
                    v                         v
           ┌──────────────┐         ┌──────────────┐
           │ Grant Access  │         │ Deny Access   │
           │ - Select App  │         │ - Log denial  │
           │   Connector   │         │ - Alert SIEM  │
           │ - Stitch tunnel│        │ - User notify │
           │ - Monitor     │         └──────────────┘
           └──────────────┘

Workflow 3: VPN-to-ZTNA Migration

Phase 1: Assessment (Weeks 1-2)
├── Catalog all VPN-accessed applications
├── Map user groups to applications
├── Identify application dependencies
├── Baseline VPN performance metrics
└── Document compliance requirements

Phase 2: Parallel Deployment (Weeks 3-6)
├── Deploy ZPA alongside existing VPN
├── Configure App Connectors for pilot apps
├── Create policies mirroring VPN ACLs
├── Deploy Client Connector to pilot users
└── Validate access and performance

Phase 3: Migration Waves (Weeks 7-16)
├── Wave 1: Low-risk web applications
├── Wave 2: Business-critical web apps
├── Wave 3: Non-web TCP/UDP applications
├── Wave 4: Legacy applications
└── Each wave: test → validate → migrate → monitor

Phase 4: VPN Decommission (Weeks 17-20)
├── Verify all applications accessible via ZPA
├── Disable VPN for migrated user groups
├── Monitor for access issues (2-week soak)
├── Decommission VPN concentrators
└── Update disaster recovery documentation

Workflow 4: Device Posture Enforcement

┌───────────────────┐
│ Device Connects    │
└───────┬───────────┘
        v
┌───────────────────┐
│ Posture Assessment │
│ - OS version       │
│ - Patch level      │
│ - Disk encryption  │
│ - AV/EDR status    │
│ - Firewall enabled │
│ - Domain joined    │
└───────┬───────────┘
        v
┌───────────────────┐
│ Posture Evaluation │
│ Compare against    │
│ posture profiles   │
└───┬──────────┬────┘
    │          │
  PASS       FAIL
    │          │
    v          v
┌────────┐ ┌──────────────────┐
│ Full   │ │ Restricted Access │
│ Access │ │ - Browser only    │
└────────┘ │ - Limited apps    │
           │ - Remediation msg │
           └──────────────────┘

Workflow 5: Incident Response with ZPA

Alert Triggered (SIEM/SOAR)
    │
    v
┌──────────────────┐
│ 1. Triage         │
│ - Review ZPA logs │
│ - Identify user   │
│ - Identify app    │
│ - Classify event  │
└───────┬──────────┘
        v
┌──────────────────┐
│ 2. Containment    │
│ - Revoke user     │
│   access in ZPA   │
│ - Isolate app     │
│   segment         │
│ - Block device    │
│   via posture     │
└───────┬──────────┘
        v
┌──────────────────┐
│ 3. Investigation  │
│ - Pull session    │
│   logs from ZPA   │
│ - Correlate with  │
│   IdP/EDR/SIEM    │
│ - Map lateral     │
│   movement        │
└───────┬──────────┘
        v
┌──────────────────┐
│ 4. Recovery       │
│ - Update policies │
│ - Re-enable access│
│ - Post-incident   │
│   review          │
└──────────────────┘

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.