cloudflare-one-migrations

Export ZIA URL filtering, firewall, SSL inspection, DLP, and custom category policies, then map them to Cloudflare Gateway traffic policies and lists. Create rules in disabled or audit mode first, pilot with small groups, and compare logs before expanding rollout.

Create one Cloudflare Tunnel per ZPA connector group, then convert app segment IPs to CIDR routes and domains to hostname routes on that tunnel. Map each ZPA access policy rule to a reusable Cloudflare Access policy before attaching it to applications.

Not directly. One Palo Alto rule can produce multiple Cloudflare resources, and App-ID, zones, HIP profiles, and decryption behavior rarely translate exactly. Export address and service objects with the rules and mark partial mappings rather than forcing equivalence.

In combined ZIA and ZPA migrations, broad Gateway Network block rules can block Access private-app traffic before policy evaluation. Add a Network allow rule using the Self-hosted Access App selector at higher precedence than the L4 block rules.

Zscaler caution/warn behavior has no exact Gateway equivalent and must be an explicit customer decision. DLP engines and custom regex require manual Cloudflare DLP profile recreation, and identity-scoped rules need SCIM group sync before enforcement.

The default limit is 5 hostnames per Access application. For large ZPA app segments, contact the Cloudflare account team to request an increase up to 50 before implementation, or split segments into multiple apps with identical policies.