A full ZIA and ZPA deployment shown step by step in the console, to teach every capability.
Stack
Zscaler Internet Access, Zscaler Private Access, Zscaler OneAPI, Python
Practice area
Zscaler Engineering
Domain
Zscaler Internet Access and Zscaler Private Access configuration
Scope
Recorded configuration videos: ZIA policy, inspection and isolation, ZPA access and AppProtection, and OneAPI automation.
Updated
All configuration shown was performed in an isolated virtual machine test environment. No real production environment, client data or client systems are shown.
Narration uses an AI clone of my own voice, for clear and easy-to-follow audio.
I am not affiliated with, endorsed by, or sponsored by Zscaler, and I don't sell Zscaler products. As an engineer, I deployed and configured Zscaler by hand, and I built these scripts on the Zscaler API to make that work easier for other engineers and companies. Zscaler, ZIA and ZPA are trademarks of Zscaler, Inc.
How it works
Watch the manual configuration step by step.
These videos walk through the deployment by hand, so engineers can see every policy, setting and trade-off, from foundational controls to OneAPI automation.
Control Generative AI with Cloud App ControlAllow one generative AI tool, block file uploads to it, and default-deny every other AI app with two Cloud App Control rules.Inline DLP for Generative AI AppsA ZIA DLP rule that blocks PCI and GLBA data, scoped only to generative AI apps.File Type Control + Cloud SandboxBlock executables from newly registered and unknown domains, then quarantine unknown files until Cloud Sandbox returns a verdict.SSL Inspection: Do Not Inspect Health & FinanceDecrypt by default and exempt regulated categories by policy, with the rule order that makes the exemption work.ZPA Posture-Based Access + Reauth TimeoutsA Certificate Trust posture profile on the intranet access rule, plus an 8-hour reauthentication and 30-minute idle timeout.Lock Down Admin RDP with ZPARDP published to a single server through a dedicated ZPA app segment, with access for the IT group only.Time-Based and Caution URL FilteringBlock social media during business hours with a time interval, and show a warning page for newly registered domains.Cloud Browser Isolation for Risky SitesA read-only isolation profile and a URL Filtering Isolate rule, including the save errors met along the way.ZPA AppProtection with OWASP RulesAn OWASP CRS profile and an Inspect policy for a private web app segment, observe first.Automate ZIA and ZPA with the OneAPI and PythonOne API client, one bearer token for ZIA and ZPA, and four Python scripts: token, read, apply from YAML and activate, clean up.Three Common Changes with the OneAPIThree everyday tickets handled with Python scripts that run a dry run before they change anything.
Independent work: I am not affiliated with, endorsed by, or sponsored by Zscaler, and I don't sell Zscaler products. Zscaler, ZIA and ZPA are trademarks of Zscaler, Inc.