configuring-zscaler-private-access-for-ztna

name	configuring-zscaler-private-access-for-ztna
description	Configuring Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring access policies based on user identity and device posture, and integrating with IdPs.
domain	cybersecurity
subdomain	zero-trust-architecture
tags	["zscaler","zpa","ztna","zero-trust","app-connector","access-policy","sase"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"]

Configuring Zscaler Private Access for ZTNA

When to Use

• When replacing traditional VPN concentrators with application-level zero trust access
• When providing remote users secure access to internal applications without network-level connectivity
• When implementing least-privilege access where users only see authorized applications
• When needing to make internal applications invisible to unauthorized users and the internet
• When integrating ZTNA with existing SASE architecture using Zscaler Internet Access (ZIA)

Do not use for applications requiring raw UDP access (ZPA primarily supports TCP), for providing full network-level access equivalent to site-to-site VPN (use ZPA AppProtection or branch connector instead), or when the organization requires on-premises-only access control without cloud dependency.

Prerequisites

• Zscaler Private Access subscription (Business or Transformation edition)
• Identity provider configured: Okta, Microsoft Entra ID, Ping Identity, or SAML 2.0 IdP
• App Connector VM requirements: Linux VM (CentOS 7/8, RHEL 7/8, Ubuntu 18.04+, Amazon Linux 2) with 2 vCPU, 4GB RAM minimum
• Outbound connectivity from App Connector to ZPA cloud on port 443 (no inbound ports required)
• DNS resolution from App Connector to internal application FQDNs
• Zscaler Client Connector deployed on user endpoints

Workflow

Step 1: Deploy App Connectors in Application Network

App Connectors establish outbound-only tunnels to the ZPA cloud, providing access to internal applications.

# Download and install App Connector on Linux VM
# Obtain provisioning key from ZPA Admin Portal > Administration > App Connectors

# For RHEL/CentOS
sudo yum install -y https://yum.private.zscaler.com/yum/el7/zpa-connector-latest.rpm

# For Ubuntu/Debian
curl -sS https://dist.private.zscaler.com/apt/pubkey.gpg | sudo apt-key add -
echo "deb https://dist.private.zscaler.com/apt stable main" | sudo tee /etc/apt/sources.list.d/zpa.list
sudo apt update && sudo apt install -y zpa-connector

# Configure the connector with provisioning key
sudo /opt/zscaler/bin/zpa-connector configure \
  --provision-key 


 systemctl  zpa-connector
 systemctl start zpa-connector


 systemctl status zpa-connector
 /opt/zscaler/bin/zpa-connector status