Six months ago, we finally pulled the plug on our legacy, site-to-site IPSec VPNs that connected our 300+ retail stores back to the data center. The goal was zero-trust network access for our store systems, and we landed on Zscaler Private Access (ZPA). I wanted to share a real-world, operational update from the trenches, focusing on the architectural shifts and the unexpected wins (and headaches) we've encountered.
**The "Why" & Initial Scope:**
Our old VPN was a constant pain point. Every time a store's consumer-grade router would flake out, we'd lose POS credit card auth, inventory lookups, and the digital signage system. The "flat network" once connected was a security nightmare. We started the ZPA pilot with three application segments:
* The core POS transaction API (running in our on-prem DC)
* The inventory management web app (already migrated to Azure)
* The internal timekeeping system
**Architecture & Key Decisions:**
We opted for Connectors (we call them "gateways" internally) deployed as lightweight VMs in our data center and Azure. We avoided putting them in stores entirely. The real magic was in the App Connectors – these are the tiny VMs that sit directly in front of each specific application segment. This micro-tunneling was a mind-shift from the "any-to-any" VPN.
* **Provisioning:** We automated the deployment of App Connectors and Connectors via Terraform and Ansible. This was crucial for scaling.
* **Policy:** Moving from IP-based firewall rules to identity and application-based policies was a steep but worthwhile learning curve. A store employee's device gets *only* the timekeeping app, while a manager's device gets that plus inventory.
**Observations & Outcomes After 6 Months:**
* **The Good:**
* **Resilience:** Store internet drops no longer break everything. If a Connector in Azure East goes down, the ZPA service seamlessly fails over to our on-prem Connector. We've had zero application downtime due to network connectivity since cutover.
* **Inherent Security:** The app-specific micro-tunnels mean lateral movement is dead. A compromised store register can't even see, let alone scan, the broader network.
* **Performance:** Surprisingly, latency to our Azure-hosted inventory app *improved* for many coastal stores, as ZPA leveraged a closer POP than our old VPN concentrator path.
* **User Experience:** For our IT support team, accessing internal tools from anywhere without a clunky VPN client has been a huge morale boost.
* **The Challenges:**
* **Cost Model Clarity:** The shift from Capex (VPN appliances) to Opex (ZPA user licenses) required FinOps adjustments. Understanding the true cost per "seat" (device) versus per "user" took some analysis. We're still working on optimizing our license count.
* **Application Discovery:** The initial phase of identifying and mapping every single application flow was more labor-intensive than anticipated. Legacy systems had undocumented dependencies.
* **Troubleshooting Mindset:** Network teams had to learn a new toolset. "Can you ping it?" is no longer relevant. We built internal runbooks focusing on ZPA App Connector logs and the Zscaler portal diagnostics.
**Current State & Next Steps:**
We're now expanding ZPA to cover our warehouse logistics partners, giving them access only to the shipment scheduling portal without a full VPN. The long-term goal is to decommission the data center entirely and have all apps in the cloud, with ZPA as the sole access layer.
For anyone considering this move, my biggest piece of advice is to start with a very well-understood application and treat the migration like a cloud migration—it's more about re-architecting access than swapping a network cable.
I'm curious if others in retail or distributed environments have hit similar points, especially around managing costs for a highly fluctuating number of seasonal devices or how you've handled legacy industrial systems (like HVAC or refrigeration telemetry) that don't support the Zscaler client.
~jason
~jason