# Cloudflare One Migrations

Assess and plan migrations from existing VPN, SWG, or SASE platforms to Cloudflare One...

- Repository: https://github.com/cloudflare/skills (3246 stars)
- Category: DevOps
- License: Apache-2.0
- Last updated: 2026-10-31
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add cloudflare/skills --skill cloudflare-one-migrations -g -a claude-code -y`
Codex: `npx skills add cloudflare/skills --skill cloudflare-one-migrations -g -a codex -y`
Cursor: `npx skills add cloudflare/skills --skill cloudflare-one-migrations -g -a cursor -y`
Gemini CLI: `npx skills add cloudflare/skills --skill cloudflare-one-migrations -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add cloudflare/skills`

## Description

Assess and plan migrations from existing VPN, SWG, or SASE platforms to Cloudflare One, including policy mapping, parity gaps, and rollout.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Cloudflare One Migrations

Retrieve current Cloudflare docs, Cloudflare API schemas, and source-vendor export docs before generating exact configuration.

## Workflow

1. Identify the source stack: Zscaler ZIA, Zscaler ZPA, Palo Alto NGFW/Prisma/GlobalProtect, legacy VPN/SWG/SD-WAN, or other.
2. Request exports and logs before mapping. Prefer structured exports over screenshots or prose summaries.
3. Build an inventory: identities, groups, apps, destinations, connectors/tunnels, DNS/URL/firewall/DLP/TLS policies, objects/lists, locations/sites, exceptions, hit counts, and compliance logging.
4. Produce a mapping plan: source object, Cloudflare One target resource, confidence, prerequisites, unsupported/partial mappings, and manual decisions.
5. Create dependencies first: identity/[SCIM](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/index.md), connectors/on-ramps, routes/DNS, lists/objects, TLS bypasses, Access apps/policies, Gateway policies, DLP/CASB, logging.
6. Stage safely: use a migration prefix, create disabled/audit-mode rules by default, pilot with small groups/sites, compare logs, then expand rollout.
7. Account for every source rule. Each rule must map to a Cloudflare object or an explicit Not Migrated row with reason and security impact.

## Exports To Ask For

- ZIA: URL filtering, firewall filtering, SSL inspection, DLP, custom URL categories, IP groups, network services/service groups, users/groups/departments, locations, GRE tunnels, and static IPs.
- ZPA: app segments, segment groups, server groups, app connectors/connector groups, access policies, IdP/group mapping, private DNS domains, ports, and protocols.
- Palo Alto/Prisma: security/NAT/decryption rules, address/service objects and groups, URL categories, HIP profiles, GlobalProtect config, Prisma Access remote network/service connection config, zones, tags, logs, and hit counts.

## Mapping Heuristics

The rest: https://github.com/cloudflare/skills/blob/HEAD/skills/cloudflare-one-migrations/SKILL.md