Palo Alto rules map only after understanding traffic direction, zones, objects, users, apps, decryption, and hit counts. Do not flatten zones blindly into lists.
GRE tunnel source IPs can inform policy conditions, but the transport migration is a separate Cloudflare Mesh (formerly WARP Connector) or Cloudflare WAN workstream.
CAUTION/warn behavior has no exact Gateway equivalent. Treat it as an explicit customer decision, not a silent allow/block choice.
DLP engines and custom regex usually require manual Cloudflare DLP profile recreation. Placeholder policies must not be enabled as if DLP is complete.
Network application groups and unsupported protocols are partial mappings. Review them before enablement.
If SCIM is unavailable, identity-scoped source rules become overly broad unless you add an enforceable alternative such as user/email lists. Check Gateway identity selectors (opens in a new tab) before creating those rules.
ZPA app segments, server groups, and connector groups do not map 1:1. Cloudflare separates Access apps, tunnel routes, DNS, and policies.
Creating tunnels through the API does not complete connector deployment. Plan cloudflared installation, authentication, and origin reachability separately.
Create one Cloudflare Tunnel per ZPA connector group regardless of connector runtime status (AUTHENTICATED, DISCONNECTED, or disabled). Status is operational, not architectural. Tag disconnected or legacy groups in the tunnel description and let the customer decide what to decommission after validation.
Each ZPA connector instance within a group maps to one cloudflared replica running against that tunnel’s token. Match replica count to connector instance count per group to preserve the same topology. A single tunnel token supports multiple simultaneous cloudflared processes. Recommend installing replicas within the same data center but on different hosts or subnets.
For each connector group, identify all server groups linked to it and all app segments assigned to those server groups. IP addresses and CIDRs in those app segments become CIDR routes on the corresponding tunnel; domain names become hostname routes on the same tunnel. Prefer one CIDR route per subnet over per-host /32 routes where a broad subnet covers all app segment IPs.
ZPA bypass means split-tunnel bypass in Cloudflare, not an Access bypass decision. Bypass rules map to Cloudflare One Client Split Tunnel (opens in a new tab) exclude entries. This is a manual configuration step with no API automation - the customer must add bypassed domains and IPs to the device profile split tunnel exclude list through the dashboard.
Agentless/browser apps may become separate public-hostname Access apps per domain. WARP private apps remain private-destination apps.
The default Cloudflare Access application destination limit is 5 hostnames per app. For ZPA migrations with large app segments, contact the Cloudflare account team to request an increase (up to 50) before implementation. Confirm the limit is active on the account before creating apps - without it, large segments must be split into multiple apps with identical policies, significantly increasing object count.
IP-anchored apps require an explicit egress decision before migration: preserve source IP through customer egress, use Cloudflare dedicated egress (opens in a new tab) where available, or accept that the target service must be updated to allow new source IPs. This is a customer decision that blocks implementation if unresolved.
Resolver policies can be account-wide. Be careful with overlapping private DNS namespaces across sites or virtual networks; retrieve resolver policy (opens in a new tab) docs before making DNS changes.
Each ZPA access policy rule maps to a Cloudflare reusable Access policy. Create all reusable policies before attaching them to Access apps. In default-deny Gateway Network environments, additionally create a Network allow rule with selector “Self-hosted Access App with Private Address is Present” (wirefilter: any(access.private_app[*] in {"*"})) at higher precedence than any broad L4 block rules - without it, Gateway blocks private app traffic before Access policy evaluation occurs.
In combined ZIA and ZPA migrations, Gateway Network rules can accidentally block Access private-app traffic. The Gateway Network allow rule above is the fix - place it at higher precedence (lower number) than ZIA-migrated block rules. Add and validate this rule before enabling broad L4 blocks.
One Palo Alto rule can produce multiple Cloudflare resources. Preserve rule intent, not rule count.
App-ID, URL category, zone, HIP, schedule, and decryption behavior rarely translate exactly. Mark partial mappings rather than forcing false equivalence.
Export address/service objects and groups with rules. Missing object exports cause silent-looking drops unless explicitly detected.
Broad any destination/service rules and very broad CIDRs require manual review. Do not auto-create broad catchalls.
Source exports often split references across files. Resolve IDs against object, service, and group files before declaring a rule unmappable.
Individual users, local groups, departments, and dynamic application IDs often need identity normalization. SCIM/group sync is the gating prerequisite for group selectors.
Zscaler caution/warn behavior, Palo Alto App-ID behavior, and TLS/decryption exceptions may not have exact equivalents. Flag them as decision points instead of forcing a 1:1 mapping.
Preserve source rule order and hit counts where available. Disable or delete stale/no-hit rules only with user approval.
Never create broad allow-all catchalls to preserve connectivity unless explicitly requested and time-limited.
After each migration stage, compare Cloudflare object counts against parsed source counts. Stop on mismatches.
Review every unsupported, partial, unmapped, needs_identity, needs_posture, and manual_review item before enabling policies.
Validate group matching with real pilot users after SCIM sync and re-authentication.
Test TLS inspection and Do Not Inspect behavior before enabling HTTP/DLP blocks broadly.
Keep rollback paths explicit: disable migrated rules by prefix, restore source routing, or revert the pilot group/site.
Before declaring done, produce a source-rule accounting table: migrated object, partial mapping, not migrated reason, security impact, and owner for each manual action.
Apache-2.0 — the text of every skill is reproduced unmodified, frontmatter included, under the upstream licence.
Discovery
22 skills found by walking the repository tree for SKILL.md, not by matching a directory convention. One layout observed: skills/*/SKILL.md.
Issue colours
Resolved from a curated brand profile — hue 54°, chroma 0.172. Two accent tones are generated per issue and each is proven against its own ground before it ships: a single accent that passes AA on both light and dark paper is arithmetically impossible.
Heading repairs
1 repair applied to this skill so the document has one h1 and no skipped levels:
Removed “Cloudflare One Migrations”, a leading h1 that duplicated the skill title.
Images inside a skill come from the upstream repository. Where the author gave no alternative text we mark the image decorative rather than inventing a description — a plausible caption we made up is worse than none for the reader who depends on it.
Marketplace
A plugin manifest is published at .claude-plugin/marketplace.json by Cloudflare, declaring 1 plugin. It is read for editorial metadata only — never as the skill index, which is always the repository tree.
Signal
Install counts come from skills.sh. They measure downloads, not quality, and an unranked repository is not an unread one.
Agent surfaces
The whole issue is available as one markdown document at /cloudflare/skills.md, and each skill at its own .md URL.
Publication
Set by Skills Docs from the source repository. Body text is Literata at the reader’s chosen size and measure; code is Geist Mono. Nothing on this page was written by us except this paragraph.
Appendix 6.1
1 file · 3 KB
Everything this skill ships beside its prose. All of it is set here, as a subchapter of skill 6.
ReferencesMarkdown · 1 file
Documentation the agent loads on demand, rather than up front.