cloudflare-one-migrations

Export ZIA URL filtering, firewall, SSL inspection, DLP, and custom category policies, then map them to Cloudflare Gateway traffic policies and lists. Create rules in disabled or audit mode first, pilot with small groups, and compare logs before expanding rollout.

ZPA app segments map to Cloudflare Access applications backed by Cloudflare Tunnel routes. IP addresses and CIDRs become tunnel CIDR routes, domain names become hostname routes, and each ZPA connector group maps to one tunnel with matching cloudflared replicas.

Palo Alto rules can map to Cloudflare Gateway and Access policies, but one source rule often produces multiple Cloudflare resources. App-ID, zones, HIP profiles, and decryption behavior rarely translate exactly, so partial mappings must be flagged rather than forced.

You need structured exports of security rules, address and service objects, groups, custom categories, tunnels or connectors, identity and group data, hit counts, and logging configuration. Screenshots or prose summaries often hide missing object files and should be avoided.

In default-deny Gateway Network environments, broad L4 block rules can block private app traffic before Access policy evaluation. Add a Network allow rule with the Self-hosted Access App selector at higher precedence than the block rules.

Zscaler caution/warn behavior, DLP engines with custom regex, and network application groups have no exact Cloudflare equivalents. These must be flagged as explicit customer decisions or manual recreation tasks rather than silently mapped to allow or block rules.