CFA is not ZT. It is "simply" moving the auth point to the CF gateway. It's still a VPN (or bastion, if you will). ZT is when you move [strong] authn and authz

CFA is not ZT. It is "simply" moving the auth point to the CF gateway. It's still a VPN (or bastion, if you will). ZT is when you move [strong] authn and authz to the endpoint itself.