Skip to content

Commit 3408f27

Browse files
authored
[Gateway] Update Access selectors (#21272)
* Update network policies * Update HTTP policies * Update partials * Fix formatting
1 parent 6a693fa commit 3408f27

File tree

6 files changed

+48
-37
lines changed

6 files changed

+48
-37
lines changed

src/content/docs/cloudflare-one/applications/non-http/infrastructure-apps.mdx

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ Access for Infrastructure currently only supports [SSH](/cloudflare-one/connecti
3737

3838
## 1. Add a target
3939

40-
<Render file="access/add-target" params={{ protocol: "generic" }}/>
40+
<Render file="access/add-target" params={{ protocol: "generic" }} />
4141

4242
## 2. Add an infrastructure application
4343

@@ -122,9 +122,9 @@ The following [Access policy selectors](/cloudflare-one/policies/access/#selecto
122122

123123
By default, Cloudflare will evaluate Access infrastructure application policies after evaluating all Gateway network policies. To evaluate Access infrastructure applications before or after specific Gateway policies, create the following [Gateway network policy](/cloudflare-one/policies/gateway/network-policies/):
124124

125-
| Selector | Operator | Value | Action |
126-
| ---------------------- | -------- | ----- | ------ |
127-
| All Access App Targets | is | on | Allow |
125+
| Selector | Operator | Value | Action |
126+
| ---------------------------- | -------- | --------- | ------ |
127+
| Access Infrastructure Target | is | _Present_ | Allow |
128128

129129
You can move this policy in the Gateway policy builder to change its [order of precedence](/cloudflare-one/policies/gateway/order-of-enforcement/#order-of-precedence).
130130

src/content/docs/cloudflare-one/applications/non-http/self-hosted-private-app.mdx

Lines changed: 22 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -22,35 +22,40 @@ This feature replaces the legacy [private network app type](/cloudflare-one/appl
2222

2323
## Add your application to Access
2424

25-
<Render file="access/self-hosted-app/create-app" product="cloudflare-one" params={{ private: true }}/>
25+
<Render
26+
file="access/self-hosted-app/create-app"
27+
product="cloudflare-one"
28+
params={{ private: true }}
29+
/>
2630

27-
6. Add the private IP and/or private hostname that represents the application. You can use [wildcards](/cloudflare-one/policies/access/app-paths/) with private hostnames to protect multiple parts of an application that share a root path.
31+
6. Add the private IP and/or private hostname that represents the application. You can use [wildcards](/cloudflare-one/policies/access/app-paths/) with private hostnames to protect multiple parts of an application that share a root path.
2832

29-
:::note
30-
Private hostnames are currently only available over port `443` over HTTPS and the application must have a valid Server Name Indicator (SNI).
31-
:::
33+
:::note
34+
Private hostnames are currently only available over port `443` over HTTPS and the application must have a valid Server Name Indicator (SNI).
35+
:::
3236

3337
7. <Render file="access/add-access-policies" product="cloudflare-one" />
3438

35-
8. Configure how users will authenticate:
39+
8. Configure how users will authenticate:
3640

37-
1. Select the [**Identity providers**](/cloudflare-one/identity/idp-integration/) you want to enable for your application.
41+
1. Select the [**Identity providers**](/cloudflare-one/identity/idp-integration/) you want to enable for your application.
42+
2. (Recommended) If you plan to only allow access via a single IdP, turn on **Instant Auth**. End users will not be shown the [Cloudflare Access login page](/cloudflare-one/applications/login-page/). Instead, Cloudflare will redirect users directly to your SSO login event.
43+
3. (Recommended) Turn on **WARP authentication identity** to allow users to authenticate to the application using their [WARP session identity](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions/). We recommend turning this on if your application is not in the browser and cannot handle a `302` redirect.
3844

39-
2. (Recommended) If you plan to only allow access via a single IdP, turn on **Instant Auth**. End users will not be shown the [Cloudflare Access login page](/cloudflare-one/applications/login-page/). Instead, Cloudflare will redirect users directly to your SSO login event.
40-
41-
3. (Recommended) Turn on **WARP authentication identity** to allow users to authenticate to the application using their [WARP session identity](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions/). We recommend turning this on if your application is not in the browser and cannot handle a `302` redirect.
42-
43-
9. Select **Next**.
45+
9. Select **Next**.
4446

4547
10. (Optional) Configure [App Launcher settings](/cloudflare-one/applications/app-launcher/) for the application.
4648

4749
11. <Render file="access/access-block-page" product="cloudflare-one" />
4850

4951
12. Select **Next**.
5052

51-
13. <Render file="access/self-hosted-app/advanced-settings" product="cloudflare-one" />
53+
13. <Render
54+
file="access/self-hosted-app/advanced-settings"
55+
product="cloudflare-one"
56+
/>
5257

53-
These settings only apply to private hostnames and require [Gateway TLS decryption](/cloudflare-one/policies/gateway/http-policies/tls-decryption/).
58+
These settings only apply to private hostnames and require [Gateway TLS decryption](/cloudflare-one/policies/gateway/http-policies/tls-decryption/).
5459

5560
14. Select **Save**.
5661

@@ -74,9 +79,9 @@ The WARP client manages sessions for all non-HTTPS applications. Users will rece
7479

7580
By default, Cloudflare will evaluate a private application's Access policies after evaluating all Gateway network policies. To evaluate Access private applications before or after specific Gateway policies, create the following [Gateway network policy](/cloudflare-one/policies/gateway/network-policies/):
7681

77-
| Selector | Operator | Value | Action |
78-
| ----------------------------------- | -------- | ----- | ------ |
79-
| All Access App Private Destinations | is | on | Allow |
82+
| Selector | Operator | Value | Action |
83+
| ------------------ | -------- | --------- | ------ |
84+
| Access Private App | is | _Present_ | Allow |
8085

8186
You can move this policy in the Gateway policy builder to change its [order of precedence](/cloudflare-one/policies/gateway/order-of-enforcement/#order-of-precedence).
8287

src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@ API value: `allow`
4040

4141
**Traffic**
4242

43+
- [Access Infrastructure Target](#access-infrastructure-target)
44+
- [Access Private App](#access-private-app)
4345
- [Application](#application)
4446
- [Content Categories](#content-categories)
4547
- [Destination Continent IP Geolocation](#destination-continent)
@@ -105,6 +107,8 @@ API value: `block`
105107

106108
**Traffic**
107109

110+
- [Access Infrastructure Target](#access-infrastructure-target)
111+
- [Access Private App](#access-private-app)
108112
- [Application](#application)
109113
- [Content Categories](#content-categories)
110114
- [Destination Continent IP Geolocation](#destination-continent)
@@ -393,13 +397,13 @@ Policies created using the URL selector are case-sensitive.
393397

394398
Gateway matches HTTP traffic against the following selectors, or criteria:
395399

396-
### All Access Private App Destinations
400+
### Access Infrastructure Target
397401

398-
<Render file="gateway/selectors/all-access-private-app-destinations" />
402+
<Render file="gateway/selectors/all-access-app-targets" />
399403

400-
### All Access App Targets
404+
### Access Private App
401405

402-
<Render file="gateway/selectors/all-access-app-targets" />
406+
<Render file="gateway/selectors/all-access-private-app-destinations" />
403407

404408
### Application
405409

src/content/docs/cloudflare-one/policies/gateway/network-policies/index.mdx

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,8 @@ API value: `allow`
4040

4141
**Traffic**
4242

43-
- [All Access Private Apps](#all-access-private-app-destinations)
44-
- [All Access App Targets](#all-access-app-targets)
43+
- [Access Infrastructure Target](#access-infrastructure-target)
44+
- [Access Private App](#access-private-app)
4545
- [Application](#application)
4646
- [Content Categories](#content-categories)
4747
- [Destination Continent IP Geolocation](#destination-continent)
@@ -137,6 +137,8 @@ API value: `block`
137137

138138
**Traffic**
139139

140+
- [Access Infrastructure Target](#access-infrastructure-target)
141+
- [Access Private App](#access-private-app)
140142
- [Application](#application)
141143
- [Content Categories](#content-categories)
142144
- [Destination Continent IP Geolocation](#destination-continent)
@@ -232,13 +234,13 @@ Gateway will only log successful override connections in your [network logs](/cl
232234

233235
Gateway matches network traffic against the following selectors, or criteria.
234236

235-
### All Access Private App Destinations
237+
### Access Infrastructure Target
236238

237-
<Render file="gateway/selectors/all-access-private-app-destinations" />
239+
<Render file="gateway/selectors/all-access-app-targets" />
238240

239-
### All Access App Targets
241+
### Access Private App
240242

241-
<Render file="gateway/selectors/all-access-app-targets" />
243+
<Render file="gateway/selectors/all-access-private-app-destinations" />
242244

243245
### Application
244246

src/content/partials/cloudflare-one/gateway/selectors/all-access-app-targets.mdx

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@
44

55
All [targets](/cloudflare-one/applications/non-http/infrastructure-apps/#1-add-a-target) secured by an [Access infrastructure application](/cloudflare-one/applications/non-http/infrastructure-apps/).
66

7-
| UI name | API example |
8-
| ---------------------- | --------------- |
9-
| All Access App Targets | `access.target` |
7+
| UI name | API example |
8+
| ---------------------------- | --------------- |
9+
| Access Infrastructure Target | `access.target` |

src/content/partials/cloudflare-one/gateway/selectors/all-access-private-app-destinations.mdx

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@
44

55
All destination IPs and hostnames secured by an [Access self-hosted private application](/cloudflare-one/applications/non-http/self-hosted-private-app/).
66

7-
| UI name | API example |
8-
| ----------------------------------- | -------------------- |
9-
| All Access Private App Destinations | `access.private_app` |
7+
| UI name | API example |
8+
| ------------------ | -------------------- |
9+
| Access Private App | `access.private_app` |

0 commit comments

Comments
 (0)