Zscaler ZPA alternatives that are not Netskope or Cloudflare - for budget-constrained teams

Alright, let's cut through the vendor fog. Everyone's heard of Zscaler ZPA, and if you're looking here, you've probably already winced at the quote. Netskope and Cloudflare are the usual "alternatives" thrown around, but let's be real: they're just different flavors of the same expensive, all-encompassing suite model. You're not buying a tool; you're buying into an ecosystem and a hefty annual commitment.

I'm talking about the teams where the CFO isn't signing off on another six-figure "platform" for what is, at its core, a network connectivity and access problem. We need to get our users and services talking securely without the corporate card melting.

Forget the marketing. We need functional, composable pieces we can bolt onto our existing infra. Think about what ZPA actually *does* for you in practice:
* It brokers connections so nothing is publicly exposed.
* It does some level of device posture checking.
* It authenticates the user.
* It routes the traffic.

You can build that. Not as seamlessly, but for a fraction of the ongoing cost. Here's the gritty, budget-constrained engineer's alternative stack:

* **Core Connectivity:** **Tailscale** or **Headscale** (self-hosted). WireGuard under the hood, stupidly simple. It gives you the encrypted mesh network. Zero-trust networking without the buzzword tax. Define your ACLs in a simple YAML policy file.
* **Auth Integration:** Tie it to your existing IdP (Okta, Azure AD). Tailscale does this natively. For Headscale, you're wiring up OIDC. This covers your "who can connect" requirement.
* **Posture/Device Check:** This is the trickiest part to replicate cheaply. You can get *basic* checks by running a simple agent script on endpoints that reports back to a tiny internal service. Something like:
```bash
# crude example - check for disk encryption, specific process, etc.
if [ -f "/etc/encryption_status" ] && systemctl is-active --quiet crowdstrike; then
echo "posture_ok=true"
else
echo "posture_ok=false"
fi
```
Have your connection broker (e.g., a small gateway service) query this before allowing access to sensitive subnets. It's not ZPA's level, but it's a start.
* **Traffic Routing/Filtering:** Once on the mesh, use a traditional firewall (pfSense, OPNsense) or cloud VPC network ACLs to segment traffic. "East-West" microsegmentation becomes "this service subnet only accepts Tailscale IPs on port 5432."

**The Trade-Offs (Because There Are Always Trade-Offs):**
* You are now the support desk for your VPN. No single vendor to blame.
* Scaling to thousands of endpoints needs more thought than with a managed service.
* Advanced app-level policies (like "allow this SaaS app but not that one") will need a proxy (like a tiny Squid instance) in the mix, adding complexity.

Bottom line: If you have the engineering cycles to glue together a few sharp, single-purpose tools, you can defer or outright avoid the ZPA purchase. It won't be as shiny, but it'll work, and the cost will be mostly your cloud compute and a few FOSS subscriptions. Start with a PoC for a single team or application.

Anyone else gone down this path? What did your actual configs and pain points look like?

-- old salt