Hey team! We've been using Palo Alto GlobalProtect for years, but the whole "always-on VPN" model feels heavy now. With our hybrid team, we're looking at pure ZTNA solutions (like Zscaler Private Access, Twingate, etc.) for app-specific access.
Has anyone made this jump from GP to a ZTNA-only setup? I'm especially curious about:
* The user experience shift — was it smoother or more confusing?
* How you handled legacy systems that needed the old network tunnel.
* Any major pitfalls during the migration phase.
Would love to hear your real-world stories and lessons learned!
Let's build better workflows.
I'm a senior SRE at a mid-sized fintech (around 300 people, fully remote), and we replaced GlobalProtect with a ZTNA stack for our production workloads and internal tools about 18 months ago.
Here's a bulleted breakdown from our migration:
**User experience and onboarding**: Far less friction for end-users. They went from a constant VPN connection with occasional drop/reconnect cycles to a lightweight agent that simply authenticates them in the background. The biggest win was browser-based access for many apps, which meant new hires on day one could get to Confluence or Jira without any client installs.
**Handling legacy systems**: This was the main hurdle. We had a few on-premise systems that still needed L3 network access. We used the ZTNA provider's built-in "tunnel" feature (Zscaler calls it an App Connector, Twingate has a Connector) for those, essentially creating a micro-tunnel just for those specific IP ranges. It added a small config layer but kept 95% of our traffic out of the always-on VPN model.
**Migration and staging effort**: We ran both systems in parallel for about 3 months. We started by moving all our web-based internal tools (like admin panels and wikis) first, which was quick. The slow part was identifying every single dependency for our legacy apps - things like which random Redis port a service needed. We used the ZTNA's logging heavily to find blocked flows and built allow rules iteratively.
**Real cost and performance impact**: At our scale, the per-user licensing came in around $7-9/month, which was slightly higher than our Palo Alto VM-Series commitment, but the operational cost dropped because we spent less time troubleshooting VPN routes and client issues. Latency to our cloud apps improved marginally as traffic took more optimal paths, but the real performance win was killing the network bottleneck on the VPN concentrators during peak hours.
My pick is Twingate for a mid-market company like ours that's mostly cloud-native. It was significantly easier to deploy and manage versus the enterprise-focused platforms, and their model for handling those legacy systems felt straightforward. If you have a massive on-prem footprint or need very deep inspection tied to a NGFW, you might lean toward Zscaler, but you should tell us the rough percentage of your apps that still need full network-level access versus those that are web or modern protocols.
cost first, then scale