Guide · Agent skill
How to use the Configuring Zscaler Private Access agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This page explains the configuring-zscaler-private-access-for-ztna agent skill, a set of instructions and optional scripts that lets an AI agent walk you through replacing a traditional VPN with Zscaler Private Access (ZPA). It is written for IT and network security staff who may never have used an agent skill before. By the end you will know how to install the skill, how to ask for help with a natural request, and what the skill can and cannot do for you.
Configuring Zscaler Private Accessmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it so the folder contains SKILL.md and its references, assets and scripts.
- 2Place the skill folder. Copy the folder into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Gather prerequisites. Confirm your ZPA edition, identity provider, Linux connector VMs and outbound 443 access before planning.
- 4Ask for a plan in plain language. Describe the applications, user groups and devices you need to cover, and ask the agent to walk you through the deployment.
- 5Build connectors and segments. Deploy at least two App Connectors per site, then define server groups and application segments for each internal application.
- 6Write access policies with default deny. Create allow rules tied to user groups, segments and device posture, and finish with a deny rule for all other access.
- 7Audit with the optional scripts. Run the admin API scripts with a limited API client to check connector health and policy coverage.
What is an agent skill and what does this one do?
An agent skill is a folder of instructions, reference files and sometimes scripts that an AI agent loads when your request matches the skill's description. This skill, named configuring-zscaler-private-access-for-ztna, is licensed under Apache-2.0 and covers zero trust network access with ZPA.
When installed, the agent can guide you through the main parts of a ZPA deployment: deploying App Connector virtual machines, defining server groups and application segments, writing access rules based on identity and device posture, enabling browser-based access, and setting up log streaming to a SIEM.
- Deploy App Connectors on Linux VMs with outbound-only connectivity to the ZPA cloud
- Map internal applications to server groups and application segments
- Write identity- and device-posture-based access policies with a default deny rule
- Configure device posture profiles, including CrowdStrike signals
- Enable Browser Access for users without the Zscaler Client Connector
- Forward ZPA logs to Splunk HEC and search for denied access
Install the skill from the ZIP download
Download the ZIP file for this skill from this page and unzip it. The skill folder contains SKILL.md, a references folder, an assets folder with a deployment checklist template, and a scripts folder.
For a personal setup, place the unzipped skill folder inside ~/.claude/skills/. To limit the skill to one project, place it inside that project's .claude/skills/ folder instead.
If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/configuring-zscaler-private-access-for-ztna/
- Project install: .claude/skills/configuring-zscaler-private-access-for-ztna/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload the skill
Trigger the skill with natural requests
You do not need a special command. The skill's description covers replacing VPN concentrators with ZTNA, giving remote users access to internal applications without network-level connectivity, and integrating with identity providers. Ask in those terms and the agent should load it.
Be specific about your situation. Name your identity provider, your application hostnames and whether you need browser access. The more context you give, the more useful the checklist will be.
- "Help me plan replacing our VPN concentrators with Zscaler Private Access for remote staff."
- "Write ZPA access policies so only the HR-Department group can reach hr-portal.internal.corp."
- "Audit our ZPA tenant for App Connectors that are unhealthy or have no HA peer."
Prerequisites you need before starting
The skill's steps only work with a licensed ZPA subscription and admin access to a Zscaler tenant. Check these items before you begin, because the agent cannot provision them for you.
The skill lists Business or Transformation edition, an identity provider such as Okta, Microsoft Entra ID, Ping Identity or a SAML 2.0 IdP, and Linux VMs for App Connectors (CentOS or RHEL 7/8, Ubuntu 18.04+, Amazon Linux 2). Each App Connector VM is listed with 2 vCPU and 4GB RAM minimum. Connectors need outbound HTTPS on port 443 and no inbound ports.
- ZPA subscription (Business or Transformation edition)
- Identity provider configured for SAML 2.0 or a supported IdP
- Linux VMs for App Connectors with outbound 443 to the ZPA cloud
- DNS resolution from connectors to internal application names
- Zscaler Client Connector on user endpoints
- For audit scripts: ZPA admin API client ID, client secret and customer ID, plus Python 3 with the requests library
Safety notes on scripts and network use
This skill runs scripts and uses the network. The scripts in the scripts folder query the ZPA admin API to audit connectors, segments and policies. They need admin API credentials, so review the scripts and store the client secret securely before running them.
The configuration steps are instructions for you to carry out in the ZPA Admin Portal and on your VMs. Treat any commands the agent suggests as text to review, not as something to run without checking the target environment.
- Review scripts/agent.py and scripts/process.py before running them
- Use an admin API client with only the access the audit needs
- Do not paste real provisioning keys or client secrets into chat
- Check that the ZPA customer ID and cloud match your tenant before running queries
Limits to know before you rely on it
The skill itself says ZPA is not the right tool for every case. It states that ZPA primarily supports TCP, so applications that need raw UDP access are a poor fit. It also says ZPA does not provide full site-to-site network connectivity; the skill points to other Zscaler options for that.
Because ZPA depends on a cloud service, organisations that must keep access control entirely on-premises will not meet that requirement with this approach.
- Not for raw UDP applications
- Not a replacement for full site-to-site network connectivity
- Not suitable where access control must stay entirely on-premises
What people use it for
- Planning a phased move of remote staff from VPN to ZPA, starting with one department's internal portal
- Writing a checklist of access rules for engineering tools that depends on device posture
- Reviewing an existing ZPA tenant for connectors that are unhealthy or missing high availability
- Preparing a contractor access design that limits a single wiki segment during business hours
- Setting up log streaming to a SIEM and drafting a search for denied access
Frequently asked questions
How do I install the configuring-zscaler-private-access-for-ztna skill?
Download the ZIP from this page and unzip it. Place the folder in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
Is this skill free to use?
The skill is licensed under Apache-2.0. Using it with Zscaler Private Access still requires a ZPA subscription, Business or Transformation edition, and admin access to a Zscaler tenant. This page does not state prices.
What do I need to run this skill?
You need a ZPA subscription, an identity provider such as Okta or Microsoft Entra ID, Linux VMs for App Connectors, and Zscaler Client Connector on user devices. The audit scripts also need ZPA admin API credentials and Python 3 with requests.
Can ZPA replace a VPN for every application?
No. The skill says ZPA primarily supports TCP, so applications needing raw UDP are not a good fit, and ZPA does not provide full site-to-site connectivity. Check each application before you plan the migration.
Is it safe to run the scripts?
The scripts query the ZPA admin API and use the network, so review them first and use an API client with only the access the audit needs. Keep client secrets and provisioning keys out of chat.
How does this compare with other ZTNA guides or tools?
This skill is a checklist-style reference for ZPA design and audits, not a product. It focuses on ZPA configuration steps; for a different vendor or a general zero trust design, use that vendor's documentation or a broader framework such as NIST SP 800-207, which the skill's standards file references.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Choose this skill if you are an IT or network security engineer planning a move from VPN to ZPA, or auditing an existing tenant, and you already have a ZPA subscription and admin access. Pick something else if your applications need raw UDP or full site-to-site connectivity, or if your access control must stay entirely on-premises.
Download the skill