configuring-zscaler-private-access-for-ztna

为 ZTNA 配置 Zscaler Private Access

何时使用

• 当需要用应用级零信任访问替代传统 VPN 集中器时
• 当需要为远程用户提供对内部应用的安全访问而无需网络级连接时
• 当需要实施最小权限访问，使用户只能看到已授权的应用时
• 当需要使内部应用对未授权用户和互联网不可见时
• 当需要使用 Zscaler Internet Access (ZIA) 将 ZTNA 与现有 SASE 架构集成时

请勿使用于以下场景：需要原始 UDP 访问的应用（ZPA 主要支持 TCP）；提供等同于站点到站点 VPN 的完整网络级访问（应改用 ZPA AppProtection 或分支连接器）；或组织要求仅使用本地访问控制而不依赖云。

前提条件

• Zscaler Private Access 订阅（Business 或 Transformation 版）
• 已配置身份提供程序：Okta、Microsoft Entra ID、Ping Identity 或 SAML 2.0 IdP
• App Connector VM 要求：Linux VM（CentOS 7/8、RHEL 7/8、Ubuntu 18.04+、Amazon Linux 2），最低 2 vCPU、4GB RAM
• App Connector 到 ZPA 云的出站连接使用端口 443（无需入站端口）
• App Connector 能够对内部应用的 FQDN 进行 DNS 解析
• 已在用户终端上部署 Zscaler Client Connector

工作流

步骤 1：在应用网络中部署 App Connector

App Connector 与 ZPA 云建立仅出站隧道，提供对内部应用的访问。

# Download and install App Connector on Linux VM
# Obtain provisioning key from ZPA Admin Portal > Administration > App Connectors

# For RHEL/CentOS
sudo yum install -y https://yum.private.zscaler.com/yum/el7/zpa-connector-latest.rpm

# For Ubuntu/Debian
curl -sS https://dist.private.zscaler.com/apt/pubkey.gpg | sudo apt-key add -
echo "deb https://dist.private.zscaler.com/apt stable main" | sudo tee /etc/apt/sources.list.d/zpa.list
sudo apt update && sudo apt install -y zpa-connector

# Configure the connector with provisioning key
sudo /opt/zscaler/bin/zpa-connector configure \
  --provision-key "PROVISIONING_KEY_FROM_PORTAL"

# Start the connector service
sudo systemctl enable zpa-connector
sudo systemctl start zpa-connector

# Verify connector status
sudo systemctl status zpa-connector
sudo /opt/zscaler/bin/zpa-connector status

# Deploy second connector for HA (minimum 2 per site)
# Repeat on second VM with same App Connector Group provisioning key

步骤 2：定义服务器组和应用段

将内部应用映射到服务器组，并创建应用段。

ZPA Admin Portal Configuration:

1. Server Groups:
   Navigate to: Administration > App Connectors > Server Groups
   - Name: "DC-East-Servers"
   - App Connector Group: "DC-East-Connectors"
   - Servers:
     - hr-portal.internal.corp (10.1.1.50, TCP 443)
     - finance-app.internal.corp (10.1.1.51, TCP 443)
     - git.internal.corp (10.1.2.10, TCP 22, 443)

2. Application Segments:
   Navigate to: Resources > Application Segments > Add Application Segment
   - Name: "HR Applications"
   - Domain/URL: hr-portal.internal.corp
   - TCP Ports: 443
   - Server Group: DC-East-Servers
   - Health Reporting: Continuous
   - Bypass Type: Never (force all traffic through ZPA)

   - Name: "Engineering Tools"
   - Domain/URL: git.internal.corp, ci.internal.corp, wiki.internal.corp
   - TCP Ports: 22, 80, 443
   - Server Group: DC-East-Servers
   - Segment Group: "Engineering Segment Group"

步骤 3：配置访问策略

基于身份和设备状态定义谁可以访问哪些应用段。

ZPA Admin Portal > Policies > Access Policy:

Rule 1: HR Team Access
  - Name: "HR Portal Access"
  - Action: ALLOW
  - Criteria:
    - User Groups: "HR-Department" (from IdP)
    - Application Segment: "HR Applications"
    - Device Posture Profile: "Corporate Managed Device"
    - Client Type: Zscaler Client Connector
  - Conditions:
    - SAML Attribute: department = "Human Resources"
    - Device Trust Level: "HIGH" (CrowdStrike ZTA score > 70)

Rule 2: Engineering Access
  - Name: "Engineering Tools Access"
  - Action: ALLOW
  - Criteria:
    - User Groups: "Engineering-Team", "DevOps-Team"
    - Application Segment: "Engineering Tools"
    - Device Posture Profile: "Developer Workstation"
  - Conditions:
    - Machine Group: "Engineering Laptops"

Rule 3: Contractor Limited Access
  - Name: "Contractor Wiki Access"
  - Action: ALLOW
  - Criteria:
    - User Groups: "External-Contractors"
    - Application Segment: "Wiki Only"
    - Client Type: Zscaler Client Connector OR Browser Access
  - Conditions:
    - Time Window: Mon-Fri 08:00-18:00 EST

Rule 4: Default Deny
  - Name: "Block All Other Access"
  - Action: DENY
  - Criteria: All Users, All Applications
  - Log: Enabled

步骤 4：配置设备状态配置文件

集成来自终端安全工具的的设备状态信号。

ZPA Admin Portal > Administration > Device Posture:

Profile 1: Corporate Managed Device
  - CrowdStrike Falcon: Running, ZTA Score >= 60
  - OS: Windows 10 21H2+, macOS 13+, Ubuntu 22.04+
  - Disk Encryption: Enabled (BitLocker/FileVault)
  - Firewall: Enabled
  - Screen Lock: Enabled

Profile 2: Developer Workstation
  - Inherits: Corporate Managed Device
  - CrowdStrike Falcon: ZTA Score >= 70
  - Patch Level: Within 30 days of latest
  - Certificate: Valid corporate certificate present

Profile 3: BYOD Device
  - OS: Latest minus 1 version
  - Browser: Chrome 120+ or Edge 120+
  - Antivirus: Any recognized AV running

步骤 5：为无客户端 ZTNA 启用浏览器访问

为未安装 Zscaler Client Connector 的用户配置浏览器访问。

ZPA Admin Portal > Resources > Application Segments:

For "HR Applications" segment:
  - Enable Browser Access: Yes
  - Browser Access Type: HTTPS
  - Custom Domain: hr.access.company.com
  - Certificate: Upload TLS certificate for custom domain
  - Authentication: SAML via corporate IdP
  - Session Timeout: 4 hours
  - Clipboard Control: Disabled for sensitive apps
  - File Upload/Download: Restricted

For Browser Access Portal:
  - Portal URL: access.company.com
  - IdP: Microsoft Entra ID (SAML 2.0)
  - MFA: Required
  - Applications shown: Only authorized per user group

步骤 6：配置日志记录和监控

设置日志流式传输以用于 SIEM 集成和持续监控。

ZPA Admin Portal > Administration > Log Streaming Service:

Log Receiver Configuration:
  - Name: "Splunk-SIEM"
  - Type: Splunk (HEC)
  - Destination: https://splunk-hec.company.com:8088
  - HEC Token: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  - Log Types:
    - User Activity: Enabled
    - App Connector Status: Enabled
    - Audit Logs: Enabled
    - Browser Access: Enabled

# Splunk search for ZPA access anomalies
index=zscaler_zpa sourcetype=zpa:useractivity
| where action="denied"
| stats count by user, application, policy_name
| where count > 10
| sort -count

关键概念

术语	定义
App Connector	轻量级 Linux 服务，从内部网络向 ZPA 云创建仅出站的加密隧道，无需入站端口即可提供对应用的访问
Application Segment	由 FQDN/IP 和端口定义的内部应用逻辑分组，映射到服务器组以执行访问策略
Server Group	与 App Connector 组关联的应用服务器集合，可为应用段处理请求
Access Policy	定义哪些用户/组在何种条件下（设备状态、时间、位置）可以访问哪些应用段的规则
Zscaler Client Connector	安装在用户设备上的终端 Agent，将流量路由到 ZPA 云以执行策略和应用访问
Browser Access	无客户端 ZTNA 选项，允许通过 Web 浏览器访问应用，无需安装 Zscaler Client Connector

工具与系统

• Zscaler Private Access (ZPA)：云原生 ZTNA 平台，以基于身份的应用访问替代 VPN
• Zscaler Client Connector：跨平台终端 Agent，通过 ZPA 路由流量以执行策略
• ZPA App Connector：部署在应用网络中的仅出站隧道端点
• ZPA Admin Portal：基于 Web 的管理控制台，用于配置策略、应用段和连接器
• ZPA Log Streaming Service (LSS)：将日志实时导出到 SIEM 平台（Splunk、Sentinel、QRadar）
• CrowdStrike ZTA Integration：设备状态评分，用于执行条件访问策略

常见场景

场景：将 500 用户组织从 Cisco AnyConnect VPN 迁移到 ZPA

背景：一家拥有 500 名员工的金融服务公司使用 Cisco AnyConnect 进行远程访问。VPN 拆分隧道配置会造成安全缺口，而全隧道模式会导致性能问题。该公司需要应用级访问控制以满足 SOX 合规要求。

方法：

1. 部署 4 个 App Connector（每个数据中心 2 个），并配置 HA
2. 为 20 个内部应用定义应用段，按业务职能分组
3. 配置访问策略，将 AD 组映射到应用段，并设置设备态势要求
4. 将 CrowdStrike ZTA 评分集成为设备态势输入（标准应用最低评分 60，金融应用 80）
5. 为访问供应商门户的承包商启用 Browser Access
6. 配置 LSS，将访问日志流式传输到 Splunk，以形成 SOX 审计跟踪
7. 并行运行 3 周：VPN 与 ZPA 同时运行
8. 在验证所有应用均可通过 ZPA 访问后，逐步淘汰 VPN 连接

陷阱：App Connector 的 DNS 必须解析应用段中使用的所有内部 FQDN。通配符域段如果范围过宽，可能会导致性能问题。Browser Access 并不支持所有 Web 应用框架（大量使用 WebSocket 的应用可能需要 Client Connector）。CrowdStrike ZTA 集成要求在强制执行态势策略之前，在所有终端上部署 Falcon sensor。

输出格式

ZPA ZTNA Deployment Report
==================================================
Organization: FinanceCorp
Deployment Date: 2026-02-23

INFRASTRUCTURE:
  App Connectors: 4 (2x DC-East, 2x DC-West)
  Connector Status: All healthy
  Connector Version: 24.1.2

APPLICATION COVERAGE:
  Application Segments: 20
  Total Applications: 45
  Server Groups: 4
  Segment Groups: 6

ACCESS POLICIES:
  Total Rules: 12
  Allow Rules: 11
  Deny Rules: 1 (default deny)
  Device Posture Profiles: 3

USER ACCESS (last 30 days):
  Active Users: 487 / 500
  Total Sessions: 124,567
  Allowed Sessions: 123,890 (99.5%)
  Denied Sessions: 677 (0.5%)
  Browser Access Sessions: 2,341

VPN MIGRATION:
  Users migrated to ZPA: 487 / 500
  VPN decommission date: 2026-03-15