Skip to content

Commit 56febe2

Browse files
abracchi-twabracchi-tw
authored
[Teams] try out new page structure for policies (#479)
* new policies structure * remove former policies page
1 parent bffd695 commit 56febe2

File tree

4 files changed

+328
-1
lines changed

4 files changed

+328
-1
lines changed

‎products/cloudflare-one/src/content/glossary/index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,7 @@ Security Information and Event Management (SIEM) solutions provide an analysis l
208208
|---|---|
209209

210210
## SMB
211-
*Server Message Block*
211+
*Secure Messaging Block*
212212

213213
A network file sharing protocol that allows applications on a computer to read and write to files and to request services from server programs in a computer network. (From: [source](https://docs.microsoft.com/en-us/windows-server/storage/file-server/file-server-smb-overview))
214214

‎products/cloudflare-one/src/content/learning/policies/access-policies.md‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
---
2+
order: 2
3+
---
4+
5+
# Policies
6+
7+
<Aside>
8+
9+
Policies are sets of rules that allow you to control:
10+
* **Inbound** requests to your applications, with **Access**
11+
* **Outbound** traffic to the Internet, with **Gateway**
12+
13+
</Aside>
14+
15+
Cloudflare for Teams allows your organization to control inbound requests to your applications, as well as outbound traffic to the Internet. Policies also allow you to block security threats and potentially malicious websites.
16+
17+
While both policies in [Access](/learning/policies/access-policies/) and policies in [Gateway](/learning/policies/gateway-policies/) act as a set of rules that help you filter activity on your network, they are quite different in nature and scope. Let's dive into what you can do with policies in both products.
18+
19+
<ButtonGroup>
20+
<Button type="primary" href="/learning/policies/access-policies/">Access policies</Button>
21+
<Button type="primary" href="/learning/policies/gateway-policies/">Gateway policies</Button>
22+
</ButtonGroup>
23+
24+
## Access policies
25+
26+
Access policies let you define who has access to your organization's applications. To build an Access policy, you will have to combine different elements; the way you assemble these "building blocks" determines the scope and effectiveness of your policy.
27+
28+
The elements that make up an Access policy are:
29+
30+
* **Actions**
31+
* **Rules**
32+
* **Criteria**
33+
34+
### Actions
35+
36+
Actions let you define what *action* you want to take on a certain user or user group. Do you want to allow someone access to your applications? Do you want to deny someone access to your applications? Do you want to bypass certain users?
37+
38+
The action is the first element you'll be asked to configure when you create an Access policy in the Teams dash. You can set only one action per policy.
39+
40+
These are the action types you can choose from:
41+
42+
* **​Allow**.
43+
The allow action allows users that meet certain criteria to reach an application behind Access.
44+
* **Block**.
45+
The block action prevents users from reaching an application behind Access.
46+
* **Bypass**.
47+
The bypass action disables any Access enforcement for traffic that meets the defined rule criteria.
48+
* **Service Auth**.
49+
Service Auth rules enforce authentication flows that do not require an identity provider IdP) login, such as service tokens and mutual TLS.
50+
51+
**Note.** When applying a Bypass action, security settings revert to the defaults configured for the zone and any configured page rules. If Always use HTTPS is enabled for the site, then traffic to the bypassed destination continues in HTTPS. If it is not or you applied page rules to disable it, traffic is HTTP.
52+
53+
### Rules
54+
55+
Rules work like logical operators. They help you define which categories of users your policy will affect. Each action needs at least an Include rule; for each action, you can set as many rules as you need.
56+
57+
These are the rule types you can choose from:
58+
59+
| Include | Exclude | Require |
60+
| ------- | ------- | ------- |
61+
| The Include action is similar to an OR logical operator. In case more than one Include rule is specified, users need to meet only one of the criteria. | The Exclude rule works like a NOT logical operator. A user meeting any Exclude criteria won’t be allowed access to the application. | The Require rule works like an AND logical operator. A user must meet all specified Require rules to be allowed access. |
62+
63+
### Criteria
64+
65+
When you add a rule to your policy, you will be asked to specify the criteria you want users to meet in order for the rule to be applied to them. For example, you may want your policy to apply to all your team members in a specific country, except the ones whose email ends in `@contractor.company.com`.
66+
67+
Here is a list of all the criteria you can apply:
68+
69+
* **Emails** — `[email protected]`
70+
* **Emails ending in** — `@company.com`
71+
* **Access groups** — `example-team`
72+
* **IP ranges** — `192.168.100.14` (supports IPv4 and IPv6).
73+
* **Everyone** — allows, denies, or bypasses access to everyone.
74+
* **Country** – uses the IP address to determine country.
75+
* **Valid Certificate** - the request will need to present any valid client certificate.
76+
* **Common Name** - the request will need to present a valid certificate with an expected common name.
77+
* **Any Access Service Token** - the request will need to present the headers for any [service token](/access-service-auth/service-tokens) created for this account.
78+
* **Service Token** - the request will need to present the correct service token headers configured for the specific application
79+
* **Identity provider groups** — employs the user groups (if supported) you configured with your identity provider (IdP) or LDAP with Access. The IdP group option only displays if you use an identity provider that passes groups using SAML or OAuth Scope.
80+
* **Authentication Method** - checks the [multifactor authentication](/learning/mfa-requirements) method used by the user, if supported by the identity provider.
81+
82+
83+
### Example scenarios
84+
85+
86+
| Action | Rule | Criteria |
87+
| ------ | ---- | -------- |
88+
| Allow | Include | Emails Ending In: `@example.com` |
89+
90+
**Result**: this configuration lets any user with an `@example.com` email address, as validated against an IdP, reach the application.
91+
92+
| Action | Rule | Criteria |
93+
| ------ | ---- | -------- |
94+
| Allow | Include | Country: `Portugal` |
95+
| | Require | Emails Ending In: `@team.com` |
96+
| | Exclude | Email: `[email protected]`, `[email protected]` |
97+
98+
**Result**: this configuration lets any user from Portugal with a `@team.com` email address, as validated against an IdP, reach the application, except for `user-1` and `user-2`.
99+
100+
| Action | Rule | Criteria |
101+
| ------ | ---- | -------- |
102+
| Block | Include | `Everyone` |
103+
104+
**Result**: this configuration blocks every request to the application.

‎products/cloudflare-one/src/content/learning/policies/gateway-policies.md‎

Lines changed: 195 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
---
2+
order: 2
3+
---
4+
5+
# Policies
6+
7+
<Aside>
8+
9+
Policies are sets of rules that allow you to control:
10+
* **Inbound** requests to your applications, with **Access**
11+
* **Outbound** traffic to the Internet, with **Gateway**
12+
13+
</Aside>
14+
15+
Cloudflare for Teams allows your organization to control inbound requests to your applications, as well as outbound traffic to the Internet. Policies also allow you to block security threats and potentially malicious websites.
16+
17+
While both policies in [Access](/learning/policies/access-policies/) and policies in [Gateway](/learning/policies/gateway-policies/) act as a set of rules that help you filter activity on your network, they are quite different in nature and scope. Let's dive into what you can do with policies in both products.
18+
19+
<ButtonGroup>
20+
<Button type="primary" href="/learning/policies/access-policies/">Access policies</Button>
21+
<Button type="primary" href="/learning/policies/gateway-policies/">Gateway policies</Button>
22+
</ButtonGroup>
23+
24+
25+
## Gateway policies
26+
27+
Gateway policies allow you to grant or deny your users access to specific domains or domain categories. If the WARP client is configured to send DNS requests over DoH to Gateway, the DNS queries are evaluated against content and security policies configured for the organization. If the domain is allowed, the client receives the DNS resolution and initiates an HTTP connection.
28+
29+
Cloudflare Gateway currently filters HTTP traffic over port 80 and 443. If the HTTP connection is within a TLS connection, the TLS connection will be terminated at Cloudflare Gateway so the HTTP traffic can be inspected (unless an administrator configures a bypass rule). If the HTTP connection does not violate any policies configured by an administrator, the traffic is allowed through to the origin server.
30+
31+
### DNS policies
32+
33+
When a user makes a DNS request to Gateway, Gateway matches the request against the content or security categories you have set up for your organization. If the domain does not belong to any blocked categories, or if it matches an override rule, the user's client receives the DNS resolution and initiates an HTTP connection.
34+
35+
DNS policies can be built by doing one or more of the following:
36+
37+
1. Selecting security threat categories you want to block.
38+
1. Enabling SafeSearch.
39+
1. Enabling YouTube Restricted Mode.
40+
1. Selecting content categories you want to block.
41+
1. Adding custom domains you want to block, allow, or override.
42+
43+
#### Security threat categories
44+
45+
When creating a DNS policy, you can select as many security threat categories as you want to block with the policy. This allows you to block known and potential security threats on the public Internet.
46+
47+
#### Content categories
48+
49+
<Aside>
50+
51+
Sites that are classified as belonging to the **Child Abuse** category are blocked by default.
52+
</Aside>
53+
54+
When creating a DNS policy, you can select as many content categories as you want to block with the policy.
55+
56+
#### Destinations
57+
58+
Setting a **destination** for a policy allows you to have manual control on what action to take on requests for **specific domains**.
59+
When setting a domain as a destination, you have the option to allow, block or override that domain.
60+
* **Allow**. This action forces resolving this destination and all its sub-destinations, and takes precedence over any blocked destinations.
61+
* **Block**. This action will block a destination and all its sub-destinations.
62+
* **Override**. This action will forward all requests to a given destination to another destination you can set.
63+
64+
##### Blocking a subdomain
65+
66+
When you manually block a domain, you automatically block all of its subdomains. For example, if you are blocking `example.com`, our policy engine will also block `a.example.com`, `a.b.example.com`.
67+
68+
If you only want to block a subdomain `a.example.com`, then instead of adding `example.com` to the list, you will add `a.example.com`. Note that once you add `a.example.com` to the block list, Cloudflare Gateway will also block all subdomains of `a.example.com`.
69+
70+
##### Blocking a top-level domain
71+
72+
Just like you can choose to block a domain and all subdomains, you can block an entire top-level domain (TLD) by specifying it in a custom list. For example, if you wish to block all domains and subdomains registered as a `.net`, you would input `net` in a custom list with the *Block* action selected.
73+
74+
<Aside>
75+
76+
Blocking a popular TLD like `.com` will prevent users from connecting to significant portions of the internet.
77+
</Aside>
78+
79+
#### Order of operations
80+
81+
When a DNS query matches with a DNS policy, Gateway follows this order of operations:
82+
83+
| Step | Check If | If Matches | Else |
84+
|:----:|:---------------------------:|:---------------------------------------------------------:|:-----------:|
85+
| 1 | Domain is in Child Abuse category | Block domain, return REFUSED |Go to step 2 |
86+
| 2 | Domain in Allow list | Allow domain, return NOERROR with IP address of the domain|Go to step 3 |
87+
| 3 | Domain in Block list | Block domain, return REFUSED |Go to step 4 |
88+
| 4 | Domain in SafeSearch | Override domain, return NOERROR with safe CNAME |Go to step 5 |
89+
| 5 | Domain blocked by category | Block domain, return REFUSED |Go to step 6 |
90+
| 6 | N/A | Allow domain, return NOERROR with IP address of the domain| N/A |
91+
92+
### HTTP policies
93+
94+
<Aside>
95+
96+
This feature is only available for Gateway and Teams paid plans. For more information, see the Cloudflare for Teams [pricing page](https://www.cloudflare.com/teams-pricing/).
97+
98+
</Aside>
99+
100+
You can decide to add a policy to filter HTTP traffic on the L7 firewall. Gateway will intercept all HTTP and HTTPS traffic and apply the rules you have configured in your policy to either block, allow, or override specific elements such as websites, IP addresses, and file types.
101+
102+
You can build an HTTP policy by configuring the following elements:
103+
104+
* **Actions**
105+
* **Expressions**
106+
* **Selectors**
107+
* **Operators**
108+
109+
#### Actions
110+
111+
Just like actions on destinations in DNS policies, actions in HTTP policies allow you to choose what to do with a given set of elements (domains, IP addresses, file types, and so on). You can assign one action per policy.
112+
113+
These are the action types you can choose from:
114+
115+
* **Allow**
116+
* **Block**
117+
* **Bypass**
118+
119+
*Bypass* lets administrators bypass certain elements from inspection. Administrators who wish to bypass a site must match against the host in order to prevent HTTP inspection from occuring on both encrypted and plaintext traffic. The bypass action is only available when matching against the host criteria.
120+
121+
#### Selectors
122+
Gateway matches HTTP traffic against the following selectors, or criteria:
123+
* **Host**
124+
* **URL**
125+
* **URL Query**
126+
* **URL Path**
127+
* **URL Path and Query**
128+
* **HTTP Method**
129+
* **HTTP Response**
130+
* **Uploaded and Downloaded File Extension**
131+
* **Uploaded and Downloaded Mime Type**
132+
* **Content categories**
133+
134+
List of file extensions Gateway can match against:
135+
136+
<TableWrap>
137+
138+
| Image | Executable | Audio | Documents | Data | Compressed | System | Video |
139+
|------|------|-------|------|--------|--------|--------|-----|
140+
| avif | apk | m4a | doc | avro | 7z | bak | avi |
141+
| bmp | bat | mid | docx | csv | arj | cab | flv |
142+
| gif | bin | mp3 | odp | dat | bz2 | cpl | h264 |
143+
| ico | cgi | mpa | ods | dmg | deb | cur | m4v |
144+
| jpeg | com | wav | odt | iso | gz | emu | mkv |
145+
| png | dll | wma | pdf | json | lz | ini | mov |
146+
| psd | exe | ppt | | log | lz4 | scr | mp4 |
147+
| svg | hta | pptx | | mdb | lzh | sys | mpeg |
148+
| tif | jar | rtf | | nzb | lzma | tmp | wmv |
149+
| webp | moo | txt | | orc | pak
150+
| | pif | xls | | parquet | rar
151+
| | pl | xlsx | | rc | rpm
152+
| | prg | | | sav | sz
153+
| | | | | wasm | xz | |
154+
| | | | | sql lite | z
155+
| | | | | tar | zip
156+
| | | | | toml | zlib |
157+
| | | | | torrent | zst |
158+
| | | | | xml | |
159+
| | | | | yaml | |
160+
161+
</TableWrap>
162+
163+
#### Operators
164+
Operators are the way Gateway matches traffic to a selector. Matching happens as follows:
165+
166+
| Operator | Meaning
167+
|:---------------------:|:---------------------------:|
168+
| is | exact match, equals |
169+
| is not | all except exact match |
170+
| in | in any of defined entries |
171+
| not in | not in defined entries |
172+
| matches regex | regex evaluates to true |
173+
| does not match regex | all except when regex evals to true |
174+
175+
#### Expressions
176+
Expressions are sets of conditions with which you can combine [selectors](#selectors) and [operators](#operators). By configuring one or more expressions, you can define the scope of your HTTP policy.
177+
178+
#### Example scenarios
179+
180+
| Action | Selector | Operator |
181+
| ------ | ---- | -------- |
182+
| Block | Content categories | in: `Gaming` |
183+
184+
**Result**: this configuration blocks any traffic to domains categorized as `Gaming`.
185+
186+
#### FAQ
187+
188+
* **How can I bypass the L7 firewall for a website?**
189+
190+
Cloudflare Gateway uses the hostname in the HTTP CONNECT header to identify the destination of the request. Administrators who wish to bypass a site must match against the host in order to prevent HTTP inspection from occurring on both encrypted and plaintext traffic. The **bypass** action is only available when matching against the **host** criteria.
191+
Bypassing the L7 firewall results in no HTTP traffic inspection and logging is disabled for that HTTP session.
192+
193+
* **In what order are rules evaluated?**
194+
195+
The L7 firewall evaluates rules starting with the rule containing the lowest precedence (e.g., rule number one). Rules with a higher value precedence are evaluated after those with a lower value.

‎products/cloudflare-one/src/content/learning/policies/index.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
order: 2
3+
type: overview
4+
hideChildren: true
5+
---
6+
7+
# Policies
8+
9+
<ContentColumn>
10+
11+
<Aside>
12+
13+
Policies are sets of rules that allow you to control:
14+
* **Inbound** requests to your applications, with **Access**
15+
* **Outbound** traffic to the Internet, with **Gateway**
16+
17+
</Aside>
18+
19+
Cloudflare for Teams allows your organization to control inbound requests to your applications, as well as outbound traffic to the Internet. Policies also allow you to block security threats and potentially malicious websites.
20+
21+
While both policies in [Access](/learning/policies/access-policies/) and policies in [Gateway](/learning/policies/gateway-policies/) act as a set of rules that help you filter activity on your network, they are quite different in nature and scope. Let's dive into what you can do with policies in both products.
22+
23+
</ContentColumn>
24+
25+
<ButtonGroup>
26+
<Button type="primary" href="/learning/policies/access-policies/">Access policies</Button>
27+
<Button type="primary" href="/learning/policies/gateway-policies/">Gateway policies</Button>
28+
</ButtonGroup>

0 commit comments

Comments
 (0)