[ZT] Combine Secure Internet Traffic on-ramps (#17831)

Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com>
Co-authored-by: Pedro Sousa <[email protected]>

Author: 3 people

public/_redirects

@@ -648,6 +648,8 @@
 /learning-paths/workers/test/intro-to-observability/ /learning-paths/workers/get-started/ 301
 /learning-paths/cybersafe/area1-onboarding/area1-api/ /learning-paths/cybersafe/area1-onboarding/ 301
 /learning-paths/cybersafe/area1-onboarding/area1-connection-methods/ /learning-paths/cybersafe/area1-onboarding/area1-inline/ 301
+/learning-paths/secure-internet-traffic/connect-networks/ /learning-paths/secure-internet-traffic/connect-devices-networks/ 301
+/learning-paths/secure-internet-traffic/connect-networks/choose-on-ramp/ /learning-paths/secure-internet-traffic/connect-devices/choose-on-ramp/ 301
 
 ## dns-filtering / secure-internet-traffic
 /learning-paths/dns-filtering/ /learning-paths/secure-internet-traffic/ 301
@@ -1803,6 +1805,9 @@
 ## DNS filtering --> Secure your Internet traffic and SaaS apps
 /learning-paths/dns-filtering/account/* /learning-paths/secure-internet-traffic/initial-setup/:splat 301
 /learning-paths/dns-filtering/create-policy/* /learning-paths/secure-internet-traffic/build-dns-policies/:splat 301
+## Secure your Internet Traffic
+/learning-paths/secure-internet-traffic/connect-devices/* /learning-paths/secure-internet-traffic/connect-devices-networks/:splat 301
+
 
 # Old WAF changelog entries
 /waf/change-log/2019-* /waf/change-log/historical-2019/ 301

src/content/docs/learning-paths/replace-vpn/connect-devices/index.mdx

@@ -3,19 +3,14 @@ title: Connect user devices
 pcx_content_type: overview
 sidebar:
   order: 5
-
 ---
 
-import { Render } from "~/components"
+import { Render } from "~/components";
 
 Now that your device enrollment policies and WARP profiles are configured, you can begin deploying the WARP client to user devices for testing.
 
 :::note
-
-
-The following steps are identical to [Connect user devices](/learning-paths/secure-internet-traffic/connect-devices/) in the Secure your Internet traffic and SaaS apps implementation guide. If you have already completed Secure your Internet traffic and SaaS apps, you can skip ahead to [Build secure access policies](/learning-paths/replace-vpn/build-policies/).
-
-
+The following steps are identical to [Device on-ramps](/learning-paths/secure-internet-traffic/connect-devices-networks/choose-on-ramp/#device-on-ramps) in the Secure your Internet traffic and SaaS apps implementation guide. If you have already completed Secure your Internet traffic and SaaS apps, you can skip ahead to [Build secure access policies](/learning-paths/replace-vpn/build-policies/).
 :::
 
 ## Objectives

src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/create-policy.mdx

@@ -9,7 +9,7 @@ import { Render } from "~/components";
 
 DNS policies determine how Gateway should handle a DNS request. When a user sends a DNS request, Gateway matches the request against your filters and either allows the query to resolve, blocks the query, or responds to the query with a different IP.
 
-You can filter DNS traffic based on query or response parameters (such as domain, source IP, or geolocation). You can also filter by user identity if you connect your devices to Gateway with the [WARP client or Cloudflare One Agent](/learning-paths/secure-internet-traffic/connect-devices/install-agent/).
+You can filter DNS traffic based on query or response parameters (such as domain, source IP, or geolocation). You can also filter by user identity if you connect your devices to Gateway with the [WARP client or Cloudflare One Agent](/learning-paths/secure-internet-traffic/connect-devices-networks/install-agent/).
 
 To create a new DNS policy:
 

src/content/docs/learning-paths/secure-internet-traffic/connect-devices-networks/choose-on-ramp.mdx

@@ -0,0 +1,73 @@
+---
+title: Choose an on-ramp
+pcx_content_type: learning-unit
+sidebar:
+  order: 1
+---
+
+import { GlossaryDefinition, GlossaryTooltip, Badge } from "~/components";
+
+Similar to the network onboarding practices in the [Replace your VPN](/learning-paths/replace-vpn/connect-private-network/) implementation guide, there are a number of ways to on-ramp your network traffic to the Cloudflare global network. This guide will quickly explore all of the options to on-ramp traffic to Cloudflare Gateway to inspect, apply policies, and filter.
+
+:::note
+The following steps are identical to [Connect user devices](/learning-paths/replace-vpn/connect-devices/) in the Replace your VPN implementation guide. If you have already completed Replace your VPN, you can skip ahead to [Network on-ramps](#network-on-ramps).
+:::
+
+## Device on-ramps
+
+The most common way to protect and filter your end-user traffic is by using a device client. The standard Cloudflare device client supports a number of operating systems and deployment methodologies, but there can still be scenarios in which an alternative path makes sense.
+
+### Zero Trust Client
+
+Cloudflare WARP is the most common onramp to send user traffic to Gateway. It is a lightweight device client, which builds proxy tunnels using either Wireguard or MASQUE, and builds a DNS proxy using DNS-over-HTTPS. It supports all major operating systems, supports all common forms of endpoint management tooling, and has a robust series of management parameters and profiles to accurately scope the needs of a diverse user base. It has flexible operating modes and can control device traffic as a proxy, control device DNS traffic as a DNS proxy, or both. It is the most common method to send traffic from user devices to be filtered and decrypted by Cloudflare Gateway.
+
+### PAC files (Enterprise only)
+
+Cloudflare supports filtering HTTP/S traffic sent via a PAC file on a user device. PAC files configured to send traffic to Cloudflare target a domain specific to your account tenant, and receive and process all URL traffic for that device that fits the proxy profile. PAC files are most commonly used in scenarios in which the device client is not appropriate or cannot be installed -- specifically Windows pre-2008 and Windows Server 2012, and devices which cannot install client software at all.
+
+### Clientless Browser Isolation
+
+Cloudflare Browser Isolation runs a headless, Chromium-based browser for your users to accomplish their secure browsing needs. It can be activated via an Access application, a Gateway policy, or by using link-based isolation (reverse proxy). In this model, your users can connect from any device to a proxy website to browse the Internet while applying all your Gateway HTTP policies and inspection requirements.
+
+|                                   | WARP                                 | PAC Files      | Clientless Browser Isolation          |
+| --------------------------------- | ------------------------------------ | -------------- | ------------------------------------- |
+| Supported OS                      | macOS, Windows, Linux, iOS, Android  | All desktop OS | All OS (with HTML5 compliant browser) |
+| Configurable via MDM              | Yes                                  | Yes            | N/A                                   |
+| Gateway policy types supported    | DNS, Network, HTTP, Resolver, Egress | HTTP           | HTTP, Resolver, Egress                |
+| Identity-based policies supported | Yes                                  | No             | Yes                                   |
+
+## Network on-ramps
+
+The primary ways to source multi-device or network traffic to Cloudflare Gateway are via Magic WAN using GRE or IPsec tunnels, the [WARP Connector](#warp-connector-) as a software-defined all-ports traffic proxy, or via upstream DNS for a whole network using [DNS filtering locations](#dns-filtering-locations).
+
+### Magic WAN
+
+:::note
+Only available on Enterprise plans.
+:::
+
+[Magic WAN](/magic-wan/) is Cloudflare's offering most analogous to a traditional SD-WAN. Magic WAN is typically deployed via an IPsec or GRE tunnel terminating on customer devices (such as firewalls or routers), or via our Magic WAN Connector hardware device. You can also be deploy Magic WAN using [Cloudflare Network Interconnect](/network-interconnect/) (CNI) at private peering locations or some public cloud instances (where compatible).
+
+Magic WAN on-ramps traffic via your connections and can send all network and HTTP traffic through Cloudflare Gateway for inspection.
+
+For more information on how Magic WAN integrates with Zero Trust, refer to [Zero Trust integration](/magic-wan/zero-trust/).
+
+### WARP Connector <Badge text="Beta" variant="caution" size="small" />
+
+[WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/), a software agent similar to our device client, functions as a virtual device to establish a connection between your network and the Cloudflare global network. You can install WARP Connector on a dedicated Linux server or virtual machine.
+
+WARP Connector supports egressing traffic from your private network to the Internet as a gateway. This means it can allow traffic initiated from a network to be on-ramped to Cloudflare for either public or private destinations. You can use WARP Connector to establish a secure egress path for servers or users on a network which may not each be able to run the WARP client and still apply Gateway network and HTTP inspection policies. This connection is most analogous to proxy server connectivity or site-to-site VPN.
+
+For more information on setting up Cloudflare Tunnel via WARP Connector, refer to [Set up WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/).
+
+### DNS filtering locations
+
+<GlossaryDefinition term="DNS location" />
+
+The fastest way to start filtering DNS queries from a location is by changing the DNS resolvers at the router or updating the upstream resolution to Cloudflare DNS resolution endpoints. This can also be accomplished from individual devices, or an network or subnet which sets resolver IPs for clients via DHCP.
+
+For more information on setting up DNS locations, refer to [Add locations](/cloudflare-one/connections/connect-devices/agentless/dns/locations/).
+
+|                                | Magic WAN             | WARP Connector        | DNS Locations |
+| ------------------------------ | --------------------- | --------------------- | ------------- |
+| Gateway policy types supported | Network, HTTP, Egress | Network, HTTP, Egress | DNS, Resolver |

src/content/docs/learning-paths/secure-internet-traffic/connect-devices-networks/index.mdx

@@ -0,0 +1,18 @@
+---
+title: Connect devices and networks to Cloudflare
+pcx_content_type: overview
+sidebar:
+  order: 2
+---
+
+import { Render } from "~/components";
+
+After setting up your Cloudflare account and Zero Trust organization, you can begin connecting your users' devices and networks to Cloudflare.
+
+## Objectives
+
+By the end of this module, you will be able to:
+
+<Render file="zero-trust/connect-devices-objectives" />
+
+- Determine when and how to use PAC files.

src/content/docs/learning-paths/secure-internet-traffic/connect-devices-networks/install-agent.mdx

@@ -0,0 +1,15 @@
+---
+title: Download and install WARP
+pcx_content_type: learning-unit
+sidebar:
+  order: 2
+---
+
+import { Render } from "~/components";
+
+<Render
+	file="zero-trust/install-agent"
+	params={{
+		one: "The device is now connected to your organization and secured with Cloudflare Zero Trust.",
+	}}
+/>

src/content/docs/learning-paths/secure-internet-traffic/connect-devices/mdm.mdx renamed to src/content/docs/learning-paths/secure-internet-traffic/connect-devices-networks/mdm.mdx

@@ -2,10 +2,9 @@
 title: MDM deployment
 pcx_content_type: learning-unit
 sidebar:
-  order: 2
-
+  order: 3
 ---
 
-import { Render } from "~/components"
+import { Render } from "~/components";
 
 <Render file="zero-trust/mdm" />

src/content/docs/learning-paths/secure-internet-traffic/connect-devices/validate-traffic-in-gateway.mdx renamed to src/content/docs/learning-paths/secure-internet-traffic/connect-devices-networks/validate-traffic-in-gateway.mdx

@@ -2,11 +2,10 @@
 title: Verify device connectivity
 pcx_content_type: learning-unit
 sidebar:
-  order: 3
-
+  order: 4
 ---
 
-import { Render } from "~/components"
+import { Render } from "~/components";
 
 <Render file="zero-trust/validate-traffic-in-gateway" />