[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE6DSR92HHAN29D3PP8SC6":3,"skill-same:01M6AE6DSR92HHAN29D3PP8SC6":129},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":70,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6AE6DSR92HHAN29D3PP8SC6","configuring-zscaler-private-access-for-ztna",null,"Configures Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring identity- and device-posture-based access policies, and integrating with IdPs. Use when replacing VPN concentrators with ZTNA or providing remote users secure access to internal applications without network-level connectivity.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-zscaler-private-access-for-ztna\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"configuring zscaler private access for ztna","ztna","zero-trust","sase","access-policy","app-connector","zpa","zscaler","device-posture","policy","network","ZeRO","pr","secure","connectors","identity","architecture","cybersecurity","2026-11-10 10:12:30",false,"---\nname: configuring-zscaler-private-access-for-ztna\ndescription: 'Configures Zscaler Private Access (ZPA) to replace traditional VPN\n  with zero trust network access by deploying App Connectors, defining application\n  segments, configuring identity- and device-posture-based access policies, and\n  integrating with IdPs. Use when replacing VPN concentrators with ZTNA or providing\n  remote users secure access to internal applications without network-level connectivity.\n\n  '\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- zscaler\n- zpa\n- ztna\n- zero-trust\n- app-connector\n- access-policy\n- sase\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmitre_attack:\n- T1133\n- T1078\n- T1021\n- T1219\n- T1190\n---\n\n# Configuring Zscaler Private Access for ZTNA\n\n## When to Use\n\n- When replacing traditional VPN concentrators with application-level zero trust access\n- When providing remote users secure access to internal applications without network-level connectivity\n- When implementing least-privilege access where users only see authorized applications\n- When needing to make internal applications invisible to unauthorized users and the internet\n- When integrating ZTNA with existing SASE architecture using Zscaler Internet Access (ZIA)\n\n**Do not use** for applications requiring raw UDP access (ZPA primarily supports TCP), for providing full network-level access equivalent to site-to-site VPN (use ZPA AppProtection or branch connector instead), or when the organization requires on-premises-only access control without cloud dependency.\n\n## Prerequisites\n\n- Zscaler Private Access subscription (Business or Transformation edition)\n- Identity provider configured: Okta, Microsoft Entra ID, Ping Identity, or SAML 2.0 IdP\n- App Connector VM requirements: Linux VM (CentOS 7\u002F8, RHEL 7\u002F8, Ubuntu 18.04+, Amazon Linux 2) with 2 vCPU, 4GB RAM minimum\n- Outbound connectivity from App Connector to ZPA cloud on port 443 (no inbound ports required)\n- DNS resolution from App Connector to internal application FQDNs\n- Zscaler Client Connector deployed on user endpoints\n\n## Workflow\n\n### Step 1: Deploy App Connectors in Application Network\n\nApp Connectors establish outbound-only tunnels to the ZPA cloud, providing access to internal applications.\n\n```bash\n# Download and install App Connector on Linux VM\n# Obtain provisioning key from ZPA Admin Portal > Administration > App Connectors\n\n# For RHEL\u002FCentOS\nsudo yum install -y https:\u002F\u002Fyum.private.zscaler.com\u002Fyum\u002Fel7\u002Fzpa-connector-latest.rpm\n\n# For Ubuntu\u002FDebian\ncurl -sS https:\u002F\u002Fdist.private.zscaler.com\u002Fapt\u002Fpubkey.gpg | sudo apt-key add -\necho \"deb https:\u002F\u002Fdist.private.zscaler.com\u002Fapt stable main\" | sudo tee \u002Fetc\u002Fapt\u002Fsources.list.d\u002Fzpa.list\nsudo apt update && sudo apt install -y zpa-connector\n\n# Configure the connector with provisioning key\nsudo \u002Fopt\u002Fzscaler\u002Fbin\u002Fzpa-connector configure \\\n  --provision-key \"PROVISIONING_KEY_FROM_PORTAL\"\n\n# Start the connector service\nsudo systemctl enable zpa-connector\nsudo systemctl start zpa-connector\n\n# Verify connector status\nsudo systemctl status zpa-connector\nsudo \u002Fopt\u002Fzscaler\u002Fbin\u002Fzpa-connector status\n\n# Deploy second connector for HA (minimum 2 per site)\n# Repeat on second VM with same App Connector Group provisioning key\n```\n\n### Step 2: Define Server Groups and Application Segments\n\nMap internal applications to server groups and create application segments.\n\n```text\nZPA Admin Portal Configuration:\n\n1. Server Groups:\n   Navigate to: Administration > App Connectors > Server Groups\n   - Name: \"DC-East-Servers\"\n   - App Connector Group: \"DC-East-Connectors\"\n   - Servers:\n     - hr-portal.internal.corp (10.1.1.50, TCP 443)\n     - finance-app.internal.corp (10.1.1.51, TCP 443)\n     - git.internal.corp (10.1.2.10, TCP 22, 443)\n\n2. Application Segments:\n   Navigate to: Resources > Application Segments > Add Application Segment\n   - Name: \"HR Applications\"\n   - Domain\u002FURL: hr-portal.internal.corp\n   - TCP Ports: 443\n   - Server Group: DC-East-Servers\n   - Health Reporting: Continuous\n   - Bypass Type: Never (force all traffic through ZPA)\n\n   - Name: \"Engineering Tools\"\n   - Domain\u002FURL: git.internal.corp, ci.internal.corp, wiki.internal.corp\n   - TCP Ports: 22, 80, 443\n   - Server Group: DC-East-Servers\n   - Segment Group: \"Engineering Segment Group\"\n```\n\n### Step 3: Configure Access Policies\n\nDefine who can access which application segments based on identity and device posture.\n\n```text\nZPA Admin Portal > Policies > Access Policy:\n\nRule 1: HR Team Access\n  - Name: \"HR Portal Access\"\n  - Action: ALLOW\n  - Criteria:\n    - User Groups: \"HR-Department\" (from IdP)\n    - Application Segment: \"HR Applications\"\n    - Device Posture Profile: \"Corporate Managed Device\"\n    - Client Type: Zscaler Client Connector\n  - Conditions:\n    - SAML Attribute: department = \"Human Resources\"\n    - Device Trust Level: \"HIGH\" (CrowdStrike ZTA score > 70)\n\nRule 2: Engineering Access\n  - Name: \"Engineering Tools Access\"\n  - Action: ALLOW\n  - Criteria:\n    - User Groups: \"Engineering-Team\", \"DevOps-Team\"\n    - Application Segment: \"Engineering Tools\"\n    - Device Posture Profile: \"Developer Workstation\"\n  - Conditions:\n    - Machine Group: \"Engineering Laptops\"\n\nRule 3: Contractor Limited Access\n  - Name: \"Contractor Wiki Access\"\n  - Action: ALLOW\n  - Criteria:\n    - User Groups: \"External-Contractors\"\n    - Application Segment: \"Wiki Only\"\n    - Client Type: Zscaler Client Connector OR Browser Access\n  - Conditions:\n    - Time Window: Mon-Fri 08:00-18:00 EST\n\nRule 4: Default Deny\n  - Name: \"Block All Other Access\"\n  - Action: DENY\n  - Criteria: All Users, All Applications\n  - Log: Enabled\n```\n\n### Step 4: Configure Device Posture Profiles\n\nIntegrate device posture signals from endpoint security tools.\n\n```text\nZPA Admin Portal > Administration > Device Posture:\n\nProfile 1: Corporate Managed Device\n  - CrowdStrike Falcon: Running, ZTA Score >= 60\n  - OS: Windows 10 21H2+, macOS 13+, Ubuntu 22.04+\n  - Disk Encryption: Enabled (BitLocker\u002FFileVault)\n  - Firewall: Enabled\n  - Screen Lock: Enabled\n\nProfile 2: Developer Workstation\n  - Inherits: Corporate Managed Device\n  - CrowdStrike Falcon: ZTA Score >= 70\n  - Patch Level: Within 30 days of latest\n  - Certificate: Valid corporate certificate present\n\nProfile 3: BYOD Device\n  - OS: Latest minus 1 version\n  - Browser: Chrome 120+ or Edge 120+\n  - Antivirus: Any recognized AV running\n```\n\n### Step 5: Enable Browser Access for Clientless ZTNA\n\nConfigure Browser Access for users without Zscaler Client Connector installed.\n\n```text\nZPA Admin Portal > Resources > Application Segments:\n\nFor \"HR Applications\" segment:\n  - Enable Browser Access: Yes\n  - Browser Access Type: HTTPS\n  - Custom Domain: hr.access.company.com\n  - Certificate: Upload TLS certificate for custom domain\n  - Authentication: SAML via corporate IdP\n  - Session Timeout: 4 hours\n  - Clipboard Control: Disabled for sensitive apps\n  - File Upload\u002FDownload: Restricted\n\nFor Browser Access Portal:\n  - Portal URL: access.company.com\n  - IdP: Microsoft Entra ID (SAML 2.0)\n  - MFA: Required\n  - Applications shown: Only authorized per user group\n```\n\n### Step 6: Configure Logging and Monitoring\n\nSet up log streaming for SIEM integration and continuous monitoring.\n\n```text\nZPA Admin Portal > Administration > Log Streaming Service:\n\nLog Receiver Configuration:\n  - Name: \"Splunk-SIEM\"\n  - Type: Splunk (HEC)\n  - Destination: https:\u002F\u002Fsplunk-hec.company.com:8088\n  - HEC Token: \"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\"\n  - Log Types:\n    - User Activity: Enabled\n    - App Connector Status: Enabled\n    - Audit Logs: Enabled\n    - Browser Access: Enabled\n\n# Splunk search for ZPA access anomalies\nindex=zscaler_zpa sourcetype=zpa:useractivity\n| where action=\"denied\"\n| stats count by user, application, policy_name\n| where count > 10\n| sort -count\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| App Connector | Lightweight Linux service that creates outbound-only encrypted tunnels from internal networks to ZPA cloud, providing access to applications without inbound ports |\n| Application Segment | Logical grouping of internal applications defined by FQDN\u002FIP and ports, mapped to server groups for access policy enforcement |\n| Server Group | Collection of application servers associated with App Connector groups that can serve requests for application segments |\n| Access Policy | Rules defining which users\u002Fgroups can access which application segments under what conditions (device posture, time, location) |\n| Zscaler Client Connector | Endpoint agent installed on user devices that routes traffic to ZPA cloud for policy enforcement and application access |\n| Browser Access | Clientless ZTNA option allowing application access through a web browser without requiring Zscaler Client Connector installation |\n\n## Tools & Systems\n\n- **Zscaler Private Access (ZPA)**: Cloud-native ZTNA platform replacing VPN with identity-based application access\n- **Zscaler Client Connector**: Cross-platform endpoint agent routing traffic through ZPA for policy enforcement\n- **ZPA App Connector**: Outbound-only tunnel endpoint deployed in application networks\n- **ZPA Admin Portal**: Web-based management console for policy, segment, and connector configuration\n- **ZPA Log Streaming Service (LSS)**: Real-time log export to SIEM platforms (Splunk, Sentinel, QRadar)\n- **CrowdStrike ZTA Integration**: Device posture scoring for conditional access policy enforcement\n\n## Common Scenarios\n\n### Scenario: Migrating 500-User Organization from Cisco AnyConnect VPN to ZPA\n\n**Context**: A financial services firm with 500 employees uses Cisco AnyConnect for remote access. VPN split-tunnel configuration creates security gaps, and full-tunnel mode causes performance issues. The firm needs application-level access control for SOX compliance.\n\n**Approach**:\n1. Deploy 4 App Connectors (2 per data center) with HA configuration\n2. Define application segments for 20 internal applications grouped by business function\n3. Configure access policies mapping AD groups to application segments with device posture requirements\n4. Integrate CrowdStrike ZTA scores as device posture input (minimum score 60 for standard, 80 for financial apps)\n5. Enable Browser Access for contractors accessing the vendor portal\n6. Configure LSS to stream access logs to Splunk for SOX audit trail\n7. Run parallel operation for 3 weeks: VPN and ZPA side by side\n8. Phase out VPN connections after validating all application access through ZPA\n\n**Pitfalls**: App Connector DNS must resolve all internal FQDNs used in application segments. Wildcard domain segments can cause performance issues if too broad. Browser Access does not support all web application frameworks (WebSocket-heavy apps may require Client Connector). CrowdStrike ZTA integration requires Falcon sensor deployment on all endpoints before enforcing posture policies.\n\n## Output Format\n\n```\nZPA ZTNA Deployment Report\n==================================================\nOrganization: FinanceCorp\nDeployment Date: 2026-02-23\n\nINFRASTRUCTURE:\n  App Connectors: 4 (2x DC-East, 2x DC-West)\n  Connector Status: All healthy\n  Connector Version: 24.1.2\n\nAPPLICATION COVERAGE:\n  Application Segments: 20\n  Total Applications: 45\n  Server Groups: 4\n  Segment Groups: 6\n\nACCESS POLICIES:\n  Total Rules: 12\n  Allow Rules: 11\n  Deny Rules: 1 (default deny)\n  Device Posture Profiles: 3\n\nUSER ACCESS (last 30 days):\n  Active Users: 487 \u002F 500\n  Total Sessions: 124,567\n  Allowed Sessions: 123,890 (99.5%)\n  Denied Sessions: 677 (0.5%)\n  Browser Access Sessions: 2,341\n\nVPN MIGRATION:\n  Users migrated to ZPA: 487 \u002F 500\n  VPN decommission date: 2026-03-15\n```\n","# Configuring Zscaler Private Access for ZTNA\n\n## When to Use\n\n- When replacing traditional VPN concentrators with application-level zero trust access\n- When providing remote users secure access to internal applications without network-level connectivity\n- When implementing least-privilege access where users only see authorized applications\n- When needing to make internal applications invisible to unauthorized users and the internet\n- When integrating ZTNA with existing SASE architecture using Zscaler Internet Access (ZIA)\n\n**Do not use** for applications requiring raw UDP access (ZPA primarily supports TCP), for providing full network-level access equivalent to site-to-site VPN (use ZPA AppProtection or branch connector instead), or when the organization requires on-premises-only access control without cloud dependency.\n\n## Prerequisites\n\n- Zscaler Private Access subscription (Business or Transformation edition)\n- Identity provider configured: Okta, Microsoft Entra ID, Ping Identity, or SAML 2.0 IdP\n- App Connector VM requirements: Linux VM (CentOS 7\u002F8, RHEL 7\u002F8, Ubuntu 18.04+, Amazon Linux 2) with 2 vCPU, 4GB RAM minimum\n- Outbound connectivity from App Connector to ZPA cloud on port 443 (no inbound ports required)\n- DNS resolution from App Connector to internal application FQDNs\n- Zscaler Client Connector deployed on user endpoints\n\n## Workflow\n\n### Step 1: Deploy App Connectors in Application Network\n\nApp Connectors establish outbound-only tunnels to the ZPA cloud, providing access to internal applications.\n\n```bash\n# Download and install App Connector on Linux VM\n# Obtain provisioning key from ZPA Admin Portal > Administration > App Connectors\n\n# For RHEL\u002FCentOS\nsudo yum install -y https:\u002F\u002Fyum.private.zscaler.com\u002Fyum\u002Fel7\u002Fzpa-connector-latest.rpm\n\n# For Ubuntu\u002FDebian\ncurl -sS https:\u002F\u002Fdist.private.zscaler.com\u002Fapt\u002Fpubkey.gpg | sudo apt-key add -\necho \"deb https:\u002F\u002Fdist.private.zscaler.com\u002Fapt stable main\" | sudo tee \u002Fetc\u002Fapt\u002Fsources.list.d\u002Fzpa.list\nsudo apt update && sudo apt install -y zpa-connector\n\n# Configure the connector with provisioning key\nsudo \u002Fopt\u002Fzscaler\u002Fbin\u002Fzpa-connector configure \\\n  --provision-key \"PROVISIONING_KEY_FROM_PORTAL\"\n\n# Start the connector service\nsudo systemctl enable zpa-connector\nsudo systemctl start zpa-connector\n\n# Verify connector status\nsudo systemctl status zpa-connector\nsudo \u002Fopt\u002Fzscaler\u002Fbin\u002Fzpa-connector status\n\n# Deploy second connector for HA (minimum 2 per site)\n# Repeat on second VM with same App Connector Group provisioning key\n```\n\n### Step 2: Define Server Groups and Application Segments\n\nMap internal applications to server groups and create application segments.\n\n```text\nZPA Admin Portal Configuration:\n\n1. Server Groups:\n   Navigate to: Administration > App Connectors > Server Groups\n   - Name: \"DC-East-Servers\"\n   - App Connector Group: \"DC-East-Connectors\"\n   - Servers:\n     - hr-portal.internal.corp (10.1.1.50, TCP 443)\n     - finance-app.internal.corp (10.1.1.51, TCP 443)\n     - git.internal.corp (10.1.2.10, TCP 22, 443)\n\n2. Application Segments:\n   Navigate to: Resources > Application Segments > Add Application Segment\n   - Name: \"HR Applications\"\n   - Domain\u002FURL: hr-portal.internal.corp\n   - TCP Ports: 443\n   - Server Group: DC-East-Servers\n   - Health Reporting: Continuous\n   - Bypass Type: Never (force all traffic through ZPA)\n\n   - Name: \"Engineering Tools\"\n   - Domain\u002FURL: git.internal.corp, ci.internal.corp, wiki.internal.corp\n   - TCP Ports: 22, 80, 443\n   - Server Group: DC-East-Servers\n   - Segment Group: \"Engineering Segment Group\"\n```\n\n### Step 3: Configure Access Policies\n\nDefine who can access which application segments based on identity and device posture.\n\n```text\nZPA Admin Portal > Policies > Access Policy:\n\nRule 1: HR Team Access\n  - Name: \"HR Portal Access\"\n  - Action: ALLOW\n  - Criteria:\n    - User Groups: \"HR-Department\" (from IdP)\n    - Application Segment: \"HR Applications\"\n    - Device Posture Profile: \"Corporate Managed Device\"\n    - Client Type: Zscaler Client Connector\n  - Conditions:\n    - SAML Attribute: department = \"Human Resources\"\n    - Device Trust Level: \"HIGH\" (CrowdStrike ZTA score > 70)\n\nRule 2: Engineering Access\n  - Name: \"Engineering Tools Access\"\n  - Action: ALLOW\n  - Criteria:\n    - User Groups: \"Engineering-Team\", \"DevOps-Team\"\n    - Application Segment: \"Engineering Tools\"\n    - Device Posture Profile: \"Developer Workstation\"\n  - Conditions:\n    - Machine Group: \"Engineering Laptops\"\n\nRule 3: Contractor Limited Access\n  - Name: \"Contractor Wiki Access\"\n  - Action: ALLOW\n  - Criteria:\n    - User Groups: \"External-Contractors\"\n    - Application Segment: \"Wiki Only\"\n    - Client Type: Zscaler Client Connector OR Browser Access\n  - Conditions:\n    - Time Window: Mon-Fri 08:00-18:00 EST\n\nRule 4: Default Deny\n  - Name: \"Block All Other Access\"\n  - Action: DENY\n  - Criteria: All Users, All Applications\n  - Log: Enabled\n```\n\n### Step 4: Configure Device Posture Profiles\n\nIntegrate device posture signals from endpoint security tools.\n\n```text\nZPA Admin Portal > Administration > Device Posture:\n\nProfile 1: Corporate Managed Device\n  - CrowdStrike Falcon: Running, ZTA Score >= 60\n  - OS: Windows 10 21H2+, macOS 13+, Ubuntu 22.04+\n  - Disk Encryption: Enabled (BitLocker\u002FFileVault)\n  - Firewall: Enabled\n  - Screen Lock: Enabled\n\nProfile 2: Developer Workstation\n  - Inherits: Corporate Managed Device\n  - CrowdStrike Falcon: ZTA Score >= 70\n  - Patch Level: Within 30 days of latest\n  - Certificate: Valid corporate certificate present\n\nProfile 3: BYOD Device\n  - OS: Latest minus 1 version\n  - Browser: Chrome 120+ or Edge 120+\n  - Antivirus: Any recognized AV running\n```\n\n### Step 5: Enable Browser Access for Clientless ZTNA\n\nConfigure Browser Access for users without Zscaler Client Connector installed.\n\n```text\nZPA Admin Portal > Resources > Application Segments:\n\nFor \"HR Applications\" segment:\n  - Enable Browser Access: Yes\n  - Browser Access Type: HTTPS\n  - Custom Domain: hr.access.company.com\n  - Certificate: Upload TLS certificate for custom domain\n  - Authentication: SAML via corporate IdP\n  - Session Timeout: 4 hours\n  - Clipboard Control: Disabled for sensitive apps\n  - File Upload\u002FDownload: Restricted\n\nFor Browser Access Portal:\n  - Portal URL: access.company.com\n  - IdP: Microsoft Entra ID (SAML 2.0)\n  - MFA: Required\n  - Applications shown: Only authorized per user group\n```\n\n### Step 6: Configure Logging and Monitoring\n\nSet up log streaming for SIEM integration and continuous monitoring.\n\n```text\nZPA Admin Portal > Administration > Log Streaming Service:\n\nLog Receiver Configuration:\n  - Name: \"Splunk-SIEM\"\n  - Type: Splunk (HEC)\n  - Destination: https:\u002F\u002Fsplunk-hec.company.com:8088\n  - HEC Token: \"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\"\n  - Log Types:\n    - User Activity: Enabled\n    - App Connector Status: Enabled\n    - Audit Logs: Enabled\n    - Browser Access: Enabled\n\n# Splunk search for ZPA access anomalies\nindex=zscaler_zpa sourcetype=zpa:useractivity\n| where action=\"denied\"\n| stats count by user, application, policy_name\n| where count > 10\n| sort -count\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| App Connector | Lightweight Linux service that creates outbound-only encrypted tunnels from internal networks to ZPA cloud, providing access to applications without inbound ports |\n| Application Segment | Logical grouping of internal applications defined by FQDN\u002FIP and ports, mapped to server groups for access policy enforcement |\n| Server Group | Collection of application servers associated with App Connector groups that can serve requests for application segments |\n| Access Policy | Rules defining which users\u002Fgroups can access which application segments under what conditions (device posture, time, location) |\n| Zscaler Client Connector | Endpoint agent installed on user devices that routes traffic to ZPA cloud for policy enforcement and application access |\n| Browser Access | Clientless ZTNA option allowing application access through a web browser without requiring Zscaler Client Connector installation |\n\n## Tools & Systems\n\n- **Zscaler Private Access (ZPA)**: Cloud-native ZTNA platform replacing VPN with identity-based application access\n- **Zscaler Client Connector**: Cross-platform endpoint agent routing traffic through ZPA for policy enforcement\n- **ZPA App Connector**: Outbound-only tunnel endpoint deployed in application networks\n- **ZPA Admin Portal**: Web-based management console for policy, segment, and connector configuration\n- **ZPA Log Streaming Service (LSS)**: Real-time log export to SIEM platforms (Splunk, Sentinel, QRadar)\n- **CrowdStrike ZTA Integration**: Device posture scoring for conditional access policy enforcement\n\n## Common Scenarios\n\n### Scenario: Migrating 500-User Organization from Cisco AnyConnect VPN to ZPA\n\n**Context**: A financial services firm with 500 employees uses Cisco AnyConnect for remote access. VPN split-tunnel configuration creates security gaps, and full-tunnel mode causes performance issues. The firm needs application-level access control for SOX compliance.\n\n**Approach**:\n1. Deploy 4 App Connectors (2 per data center) with HA configuration\n2. Define application segments for 20 internal applications grouped by business function\n3. Configure access policies mapping AD groups to application segments with device posture requirements\n4. Integrate CrowdStrike ZTA scores as device posture input (minimum score 60 for standard, 80 for financial apps)\n5. Enable Browser Access for contractors accessing the vendor portal\n6. Configure LSS to stream access logs to Splunk for SOX audit trail\n7. Run parallel operation for 3 weeks: VPN and ZPA side by side\n8. Phase out VPN connections after validating all application access through ZPA\n\n**Pitfalls**: App Connector DNS must resolve all internal FQDNs used in application segments. Wildcard domain segments can cause performance issues if too broad. Browser Access does not support all web application frameworks (WebSocket-heavy apps may require Client Connector). CrowdStrike ZTA integration requires Falcon sensor deployment on all endpoints before enforcing posture policies.\n\n## Output Format\n\n```\nZPA ZTNA Deployment Report\n==================================================\nOrganization: FinanceCorp\nDeployment Date: 2026-02-23\n\nINFRASTRUCTURE:\n  App Connectors: 4 (2x DC-East, 2x DC-West)\n  Connector Status: All healthy\n  Connector Version: 24.1.2\n\nAPPLICATION COVERAGE:\n  Application Segments: 20\n  Total Applications: 45\n  Server Groups: 4\n  Segment Groups: 6\n\nACCESS POLICIES:\n  Total Rules: 12\n  Allow Rules: 11\n  Deny Rules: 1 (default deny)\n  Device Posture Profiles: 3\n\nUSER ACCESS (last 30 days):\n  Active Users: 487 \u002F 500\n  Total Sessions: 124,567\n  Allowed Sessions: 123,890 (99.5%)\n  Denied Sessions: 677 (0.5%)\n  Browser Access Sessions: 2,341\n\nVPN MIGRATION:\n  Users migrated to ZPA: 487 \u002F 500\n  VPN decommission date: 2026-03-15\n```\n",{"name":5,"tags":47,"author":48,"domain":41,"license":15,"version":49,"nist_csf":50,"subdomain":55,"description":56,"mitre_attack":57},[31,30,25,26,29,28,27],"mahipal","1.0",[51,52,53,54],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture","Configures Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring identity- and device-posture-based access policies, and integrating with IdPs. Use when replacing VPN concentrators with ZTNA or providing remote users secure access to internal applications without network-level connectivity.\n",[58,59,60,61,62],"T1133","T1078","T1021","T1219","T1190","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fconfiguring-zscaler-private-access-for-ztna",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-zscaler-private-access-for-ztna",{"tool":79,"command":80},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-zscaler-private-access-for-ztna",{"tool":82,"command":83},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-zscaler-private-access-for-ztna","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-zscaler-private-access-for-ztna\u002FSKILL.md",true,[87,93,98,104,108,112,116,121,125],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"assets\u002Ftemplate.md","ASSET","资产文件",3425,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-zscaler-private-access-for-ztna\u002Fassets\u002Ftemplate.md",{"path":94,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-zscaler-private-access-for-ztna\u002FLICENSE",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fapi-reference.md","REFERENCE","参考文档",1451,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-zscaler-private-access-for-ztna\u002Freferences\u002Fapi-reference.md",{"path":105,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fstandards.md",1955,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-zscaler-private-access-for-ztna\u002Freferences\u002Fstandards.md",{"path":109,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fworkflows.md",3424,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-zscaler-private-access-for-ztna\u002Freferences\u002Fworkflows.md",{"path":113,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":114,"sourceHtmlUrl":115},"refrences\u002Fkeywords.md",4115,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fnowait\u002Frefrences\u002Fkeywords.md",{"path":117,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":66,"sourceHtmlUrl":120},"scripts\u002Fagent.py","SCRIPT","脚本","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-zscaler-private-access-for-ztna\u002Fscripts\u002Fagent.py",{"path":122,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Fnowait_processor.py",10186,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fnowait\u002Fscripts\u002Fnowait_processor.py",{"path":126,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":127,"sourceHtmlUrl":128},"scripts\u002Fprocess.py",11821,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-zscaler-private-access-for-ztna\u002Fscripts\u002Fprocess.py",[130,155,177,205,231,258],{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":137,"publishedAt":42},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[136],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[138,139,140,141,142,41,143,39,36,144,145,146,147,148,149,150,151,152,153,154],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":42},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[161],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[163,151,164,165,142,33,41,36,166,35,167,168,169,170,171,172,173,174,175,176],"boot","TPM","validating tpm measured boot attestation","verification","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":187,"publishedAt":42},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[183,186],{"categoryNo":184,"categoryName":185,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[171,188,189,190,191,41,192,193,166,194,195,196,197,198,199,200,201,202,203,204],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":212,"publishedAt":42},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[211],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[213,214,215,41,216,217,218,219,220,221,222,223,224,225,226,227,168,228,229,230],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":238,"publishedAt":42},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[237],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[239,240,241,41,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":259,"name":260,"nameZh":6,"description":261,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":262,"categories":263,"keywords":265,"publishedAt":42},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[264],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[142,266,41,267,268,269,270,271,272,273,274,200,275,201,276,277,278,279,280,281],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]