Cloudflare Zt

---
name: cloudflare-zt
description: "Expert agent for Cloudflare Zero Trust. Covers Access (ZTNA), Gateway (SWG/DNS), Browser Isolation, CASB, DLP, Email Security (Area 1), Magic WAN, and Cloudflare's 300+ city anycast network. WHEN: \"Cloudflare Zero Trust\", \"Cloudflare Access\", \"Cloudflare Gateway\", \"Cloudflare ZTNA\", \"Cloudflare CASB\", \"Cloudflare Browser Isolation\", \"Cloudflare Workers\", \"Cloudflare Email Security\", \"Area 1\"."
license: MIT
---

# Cloudflare Zero Trust

This skill covers Cloudflare Zero Trust, covering Cloudflare's SSE platform — Access (ZTNA), Gateway (SWG + DNS + network firewall), Browser Isolation, CASB, DLP, Email Security (Area 1), and Magic WAN (SD-WAN). Cloudflare operates the largest anycast network in the world, spanning 300+ cities.

## How to Approach Tasks

When you receive a request:

1. **Classify** the request:
   - **Access (ZTNA)** — Application access policies, Cloudflare Tunnel, Access Applications, identity providers
   - **Gateway (SWG/DNS/Firewall)** — Web filtering, DNS-layer security, network firewall policies
   - **Browser Isolation** — RBI configuration, clientless access, isolation policies
   - **CASB** — API-based SaaS scanning, DLP, posture checks
   - **Email Security (Area 1)** — Cloud email security, phishing prevention
   - **Magic WAN** — SD-WAN, network on-ramp to Cloudflare
   - **WARP client** — Device agent, tunnel configuration, posture integration

2. **Identify the tier** — Cloudflare Zero Trust has a free tier (up to 50 users) through Enterprise. Feature availability varies significantly.

3. **Apply Cloudflare networking context** — Cloudflare's anycast network and Workers platform are unique strengths. Consider how Workers can extend security logic.

4. **Recommend** — Provide guidance with Zero Trust dashboard navigation paths and Cloudflare API references.

## Cloudflare Zero Trust Architecture

### Network Foundation

**Anycast network:** Cloudflare operates in 300+ cities. Unlike hub-and-spoke PoP models, Cloudflare's anycast routing means every city advertises the same IP addresses. User traffic routes to the physically closest Cloudflare data center automatically via BGP.

**Benefit for Zero Trust:** Any user anywhere in the world connects to their nearest Cloudflare data center with minimal latency. ZTNA, SWG, and all security functions run at every PoP.

**Cloudflare's network stack:**
```
Cloudflare Zero Trust (SSE)
├── Cloudflare Access (ZTNA)
├── Cloudflare Gateway (SWG + DNS + Network Firewall)
├── Remote Browser Isolation (RBI)
├── CASB (API-based)
├── DLP
└── Email Security (Area 1)

Cloudflare Network Services (WAN)
├── Magic WAN (SD-WAN / IPsec on-ramp)
├── Magic Firewall (network-level firewall)
├── Magic Transit (DDoS protection + routing)
└── Cloudflare Tunnel (cloudflared, secure outbound connector)
```

## Cloudflare Access (ZTNA)

### Application Types

Cloudflare Access supports multiple application types, all enforcing identity-based access:

**Self-hosted applications:**
Applications running in a private data center or cloud — accessed via Cloudflare Tunnel.
```
Internal App → cloudflared connector → Cloudflare network → Identity check → User
```

**SaaS applications:**
SAML or OIDC integration where Cloudflare acts as an identity proxy in front of SaaS apps.
```
User → Cloudflare Access → IdP auth → SAML assertion to SaaS app
```

**SSH / RDP / arbitrary TCP:**
Browser-based or WARP-tunneled access to SSH/RDP/TCP applications.

### Cloudflare Tunnel (cloudflared)

`cloudflared` is the open-source connector daemon that creates an outbound-only tunnel from your infrastructure to Cloudflare.

**Installation:**
```bash
# Install on Linux (Debian/Ubuntu)
curl -L --output cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared.deb

# Authenticate with your Cloudflare account
cloudflared tunnel login

# Create a named tunnel
cloudflared tunnel create my-app-tunnel

# Configure the tunnel (config.yml)
cat > ~/.cloudflared/config.yml << EOF
tunnel: <tunnel-id>
credentials-file: /home/user/.cloudflared/<tunnel-id>.json

ingress:
  - hostname: app.example.com
    service: http://localhost:8080
  - hostname: ssh.example.com
    service: ssh://localhost:22
  - service: http_status:404
EOF

# Run the tunnel
cloudflared tunnel run my-app-tunnel

# Or install as a system service
sudo cloudflared service install
```

**Multiple services in one tunnel:**
The ingress rules in config.yml let one `cloudflared` instance expose multiple services, each on different hostnames.

**Tunnel HA:** Run 2+ `cloudflared` instances in the same tunnel — Cloudflare load-balances across all healthy replicas automatically.

### Access Policies

Policies define who can access which applications.

**Policy structure:**
```
Application: Internal HR System
Access Policy:
  Rule: Allow HR Team
  Decision: Allow
  Include: User Group = "HR" (from IdP group membership)
  Require: Device posture = "compliant" (via WARP posture)
  Require: Country = "United States" OR Country = "United Kingdom"
  
  Rule: Block Everyone Else
  Decision: Block
  Include: Everyone
```

**Policy actions:**
- **Allow:** Permit access if all conditions met
- **Block:** Deny with block page
- **Bypass:** Skip authentication (for specific IP ranges, health check paths)
- **Service Auth:** Allow machine-to-machine service tokens

**Supported identity providers:**
- Microsoft Entra ID (Azure AD)
- Okta
- Google Workspace
- GitHub (for developer tools)
- SAML 2.0 (any SAML-compatible IdP)
- OIDC (any OpenID Connect provider)
- One-time PIN (email OTP — for users without corporate IdP)
- LinkedIn, GitHub (for external partners without corporate IdP)

### SSH Access via Browser

Cloudflare Access provides browser-based SSH access without requiring the SSH client or any software installation.

**Configuration:**
```yaml
# cloudflared config for SSH
ingress:
  - hostname: ssh.example.com
    service: ssh://localhost:22
    originRequest:
      httpHostHeader: ""
```

**Access policy:** Configure `ssh.example.com` in Access Applications as "SSH" type.

**User experience:** User goes to `https://ssh.example.com`, authenticates via IdP, gets a browser-based terminal.

**Audit logging:** All SSH sessions (keystrokes optionally) are logged in Access logs.

### Device Posture Integration

**WARP-based posture checks:**
When users have the Cloudflare WARP client installed, Access can require device posture:
- **Serial number list:** Allow access only from specific devices (approved device list)
- **OS version:** Minimum macOS/Windows version
- **File check:** Verify a specific file exists (agent presence check)
- **Process running:** Verify CrowdStrike, Carbon Black, or other EDR is running
- **Disk encryption:** BitLocker/FileVault enabled
- **Domain joined:** Windows machine is domain joined

**Third-party posture integrations:**
- CrowdStrike (via CrowdStrike Zero Trust Assessment score)
- Tanium (device health score)
- Microsoft Intune (device compliance status)
- Jamf (macOS/iOS compliance)

## Cloudflare Gateway (SWG + DNS + Network Firewall)

### DNS Filtering

DNS filtering is the lightest-weight layer — blocks malicious domains at DNS resolution.

**DNS filtering policy:**
1. User's device uses Cloudflare's DNS resolver (1.1.1.1 or custom DoH/DoT endpoint)
2. DNS query arrives at Cloudflare
3. Domain checked against categories and custom block/allow lists
4. Safe: Return DNS answer
5. Blocked: Return NX (NXDOMAIN) or block page IP

**Configuration:**
- Block categories: Malware, Phishing, Botnet C2, Adult, etc.
- Custom block list: Add specific domains to block
- Allow list: Override category blocks for specific trusted domains
- DNS over HTTPS (DoH): Configure endpoint for specific application enforcement
- DNS over TLS (DoT): Port 853 for strict DoT

**WARP DNS routing:**
WARP client routes all DNS queries through Cloudflare Gateway by default. This ensures DNS filtering applies even when the user is on untrusted networks.

### HTTP Filtering (SWG)

Full HTTP inspection including SSL decryption.

**Policy types:**
- **URL category blocking:** Block by Cloudflare URL category (similar to other vendors)
- **Application control:** Control specific SaaS applications and activities
- **File type filtering:** Block specific file type downloads
- **Antivirus:** Scan downloads for malware
- **DLP:** Inspect uploads for sensitive data

**SSL inspection setup:**
1. Generate or upload SSL certificate in Zero Trust dashboard
2. Export certificate and deploy to managed devices via MDM
3. Configure Gateway to inspect HTTPS traffic

**Bypass rules for SSL inspection:**
Create Do Not Inspect policies for financial, medical, and certificate-pinning destinations.

### Network Firewall Policies

Layer 4/7 firewall rules controlling TCP/UDP traffic from WARP-connected devices.

**Rule structure:**
```
Action: Block
Traffic: Protocol = TCP
Destination: IP = 192.0.2.0/24
Description: Block access to legacy server (decommissioned)

Action: Allow
Traffic: Protocol = TCP, Port = 22
Source: User Group = "SysAdmin"
Destination: IP = 10.0.0.0/8
Description: Allow SSH from sysadmins to internal servers
```

**Use case:** Replace VPN split tunneling rules with Cloudflare Gateway network policies for granular control over which users can access which IP ranges and ports.

## Browser Isolation (RBI)

### How Cloudflare RBI Works

**Pixel streaming approach:**
Cloudflare runs a Chrome browser instance in an isolated Cloudflare data center. The browser renders the web page; only rendered pixels are streamed back to the user. No web code runs on the user's device.

**Isolation policies:**
```
Policy: Isolate High-Risk URLs
URL Category: Newly Registered Domains
URL Category: Questionable
Action: Isolate

Policy: Isolate Personal Email
URL: mail.google.com (personal Gmail, not Google Workspace)
Action: Isolate

Policy: Allow Corporate SaaS
URL: *.company.com, mail.google.com/a/company.com
Action: Allow (no isolation)
```

**Clientless isolation:**
For users without WARP client, Browser Isolation can be accessed via a special Cloudflare URL prefix:
```
https://1dot1dot1dot1.cloudflare-gateway.com/browser/https://target-site.com
```

This allows BYOD/contractor access to risky sites without installing software.

**Controls in isolated session:**
- Disable clipboard copy/paste
- Disable printing
- Disable file downloads
- Read-only mode (no form submission)
- Keyboard input blocking
- Watermarking (overlay username on rendered content)

### Access + Browser Isolation (Clientless ZTNA)

Combine Access and Browser Isolation for agentless ZTNA:
1. Configure a self-hosted application in Access
2. Set rendering as "Browser Isolation" in the Access application settings
3. Users authenticate via browser (no WARP client)
4. Access to the internal application is rendered in Cloudflare's isolated browser
5. No application traffic reaches user's device; no application client needed

## CASB (API-Based)

### Supported Integrations

Cloudflare CASB connects to SaaS APIs:
- Microsoft 365 (SharePoint, OneDrive, Exchange, Teams)
- Google Workspace (Drive, Gmail, Calendar)
- GitHub
- Salesforce
- Slack
- Jira/Confluence (Atlassian)
- Dropbox
- Box

### Findings Types

**Security posture findings:**
- M365: MFA not enforced, legacy authentication enabled, overly permissive OAuth apps
- Google: Drive sharing set to "Anyone on the internet," weak password policy

**Data exposure findings:**
- Files shared publicly that shouldn't be
- Sensitive content in publicly accessible repositories
- Credentials or secrets committed to GitHub

**Access configuration findings:**
- Inactive user accounts still active
- Overly permissive service accounts
- Unmonitored admin accounts

### DLP in CASB

**Inline DLP (Gateway):**
DLP policies applied to HTTP traffic flowing through Gateway (uploads to cloud storage, SaaS apps).

```
DLP Profile: Credit Card Numbers
  Detection: Regex (Luhn-validated)
  
DLP Policy: Block CC Upload
  Traffic: HTTP POST/PUT
  DLP Profile: Credit Card Numbers
  Action: Block
```

**Predefined DLP profiles:** Social Security Numbers, credit cards, passport numbers, health data patterns, source code patterns.

**Custom DLP profiles:** Define custom regex patterns for organization-specific sensitive data.

## Email Security (Area 1)

Cloudflare acquired Area 1 Security in 2022, integrating it into the Zero Trust platform.

### Architecture

Area 1 is a cloud-based email security service using predictive threat intelligence.

**Deployment modes:**
- **MX record (inline):** MX record points to Area 1 — SEG-style deployment
- **BCC/journaling:** Email copy sent to Area 1 for analysis — no MX change, detection only
- **API (M365/Google):** Post-delivery API integration

**Detection approach:**
Area 1 crawls the internet (similar to a web crawler) to discover phishing infrastructure before it's used in campaigns. By mapping phishing domains and attack infrastructure early, Area 1 blocks attacks before they launch.

**Key detections:**
- Phishing (credential harvest pages)
- BEC (business email compromise)
- Malware delivery
- Spam
- Brand impersonation

**Integration with Cloudflare Zero Trust:**
- Email security findings feed into the CASB/DLP posture
- Access policies can reference email risk signals
- Unified dashboard within Zero Trust

## WARP Client

### Client Modes

**WARP mode:** Full tunnel — all traffic through Cloudflare Gateway. DNS filtering + HTTP inspection + firewall policies.

**Zero Trust (Org) mode:** Same as WARP mode but enrolled in a Zero Trust organization. Required for Access policies and device posture.

**WARP+ (paid):** Personal VPN mode — not relevant for enterprise Zero Trust.

### Deployment, Enrollment, and Posture Checks

WARP is mass-deployed via MDM (Intune, Jamf) with pre-configured organization enrollment, and collects device posture (OS version, disk encryption, EDR presence, domain-joined status, CrowdStrike ZTA score, etc.) for Access policy enforcement. See `references/warp-deployment.md` for full MDM enrollment snippets, split tunneling guidance, and the complete posture check list.

## Cloudflare Workers for Security

Cloudflare Workers is a serverless platform running JavaScript (or WASM) at every Cloudflare edge location. It can be used to extend security logic.

**Use cases in Zero Trust context:**

**Custom access logic:**
```javascript
// Worker: Check if user is in approved time window
export default {
  async fetch(request, env) {
    const hour = new Date().getUTCHours();
    const userGroup = request.headers.get('Cf-Access-Authenticated-User-Group');
    
    if (userGroup === 'contractors' && (hour < 8 || hour > 18)) {
      return new Response('Access not permitted outside business hours', { status: 403 });
    }
    return fetch(request); // Forward to origin
  }
}
```

**Custom DLP logic:**
Workers can intercept requests and responses through Gateway for custom data inspection.

**Security headers injection:**
Workers can add security headers (CSP, HSTS, X-Frame-Options) to all responses from protected applications.

## Administration

### Zero Trust Dashboard

Navigation: `one.dash.cloudflare.com` → Select account → Zero Trust

**Key sections:**
- **Access → Applications:** Manage protected applications
- **Access → Policies:** Access control rules
- **Gateway → Policies:** HTTP, DNS, and Network filtering rules
- **Gateway → Lists:** Custom block/allow lists for domains, IPs, URLs
- **CASB → Findings:** SaaS posture and DLP findings
- **Analytics → Access:** Authentication logs, blocked access attempts
- **Analytics → Gateway:** Web/DNS filtering logs
- **Settings → WARP Client:** Deployment configuration
- **Settings → Custom Pages:** Branded block/allow pages

### API and Terraform

Cloudflare Zero Trust is fully API-driven and has an official Terraform provider covering all Zero Trust resources. See `references/api-terraform.md` for authentication, key API endpoints, and a full Terraform example (Access application + policy).

### Free Tier

Cloudflare Zero Trust has a generous free tier:
- Up to **50 users** — full Access + Gateway functionality
- Browser Isolation: Limited (pay-per-use on free)
- CASB: Not included in free tier
- Email Security (Area 1): Not included in free tier

This makes Cloudflare Zero Trust an excellent option for small organizations or for testing before enterprise deployment.

## Reference Files

Load these for deep knowledge on specific topics:

- `references/warp-deployment.md` — Full WARP MDM enrollment (Intune, Jamf), split tunneling guidance, and the complete device posture check list.
- `references/api-terraform.md` — Cloudflare Zero Trust API authentication and key endpoints, plus a full Terraform example for Access application and policy.