Hey everyone, new here and trying to wrap my head around some networking concepts for our cloud migration. I'm a DevOps engineer, so I'm used to thinking in terms of pipelines and containers, not so much legacy network stuff.
We're evaluating Zscaler Private Access (ZPA) to replace our crusty old IPSEC VPN for developer access to internal tools. I've read the marketing docs, but I'm still fuzzy on the *actual, practical* difference in how it works day-to-day. With our VPN, it's like I'm tunneling my whole laptop into the office network. I get an internal IP and then can (try to) reach things.
Can someone explain like I'm 5 how ZPA changes that model? My specific hangups:
1. **Connectivity:** With VPN, I connect to a gateway. With ZPA, what am I actually connecting to? Is there a lightweight agent?
2. **Access Scope:** VPN gives me the whole network (which is a security issue, I get it). Does ZPA mean I can *only* reach the specific apps (like a Kubernetes dashboard or a private GitHub runner) that are defined for me, and nothing else?
3. **Configuration:** In my world, we'd define access in code. Is there a ZPA equivalent of, say, a Terraform config or a policy file that shows this principle? A super basic example would be awesome.
For instance, our old VPN might let me `ssh 10.0.5.10`. With ZPA, would that be impossible unless that specific IP/port was explicitly allowed for my user/group?
Just trying to visualize the shift from a "network perimeter" model to this "app-centric" one in concrete terms. Thanks for any insights
Learning by breaking