zia-create-firewall-filtering-rule
Create a ZIA Cloud Firewall Filtering rule that controls network traffic by source/destination IP, country, network application, network service, device trust level, user/group/department, location, and optional time-of-day schedule (Time Interval). Supported actions: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP, EVAL_NWAPP. Use when an admin asks to 'create a firewall rule', 'block traffic to X', 'allow traffic from Y', 'block country Z', 'restrict access during business hours', or 'add a firewall exception'. This skill creates exactly one Cloud Firewall rule and chains to `zia-manage-time-interval` when the admin's request includes a recurring schedule.
Install
With your agent
Install OMGSkills skill "zscaler/zscaler-mcp-server:skills/zia/create-firewall-filtering-rule" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/zscaler/zscaler-mcp-server /tmp/zscaler-mcp-server && ln -s /tmp/zscaler-mcp-server/skills/zia/create-firewall-filtering-rule ~/.claude/skills/zia-create-firewall-filtering-ruleFrom README
ZIA: Create Cloud Firewall Filtering Rule How to talk to the admin Don't narrate tool calls, search filters, or internal lookup logic. Just confirm what was created and which scoping was applied. Empty list responses are authoritative. If a zialist lookup returns no match for an exact-name search, treat the resource as "does not exist." Do not retry with split keywords or unfiltered listings. Don't claim a tool doesn't exist without checking. If ziacreate and ziaget are visible for a resource, the matching zialist exists too. Don't narrate strategy pivots. If you have to retry quietly, retry quietly and report only the final outcome. After every successful create, mention the activation step explicitly — ZIA changes are staged until activated. The agent must call ziaactivateconfiguration() and tell the admin the change is now live. Scope of this skill This skill creates one Cloud Firewall Filtering rule per invocation.
More from this repo
cross-product-troubleshoot-user-connectivity
Cross-product troubleshooting of user connectivity issues spanning ZPA, ZIA, ZDX, and ZCC.
easm-review-attack-surface
Used to review the organization's external attack surface using Zscaler EASM.
zcc-generate-logout-otp
Used to generate a One-Time Logout Password (OTP) for a Zscaler Client Connector (ZCC) user.