Skip to content

Commit 7215940

Browse files
maxvpmaxvp
authored
Switch flowcharts (#23615)
1 parent 5f22bad commit 7215940

File tree

1 file changed

+11
-72
lines changed

1 file changed

+11
-72
lines changed

‎src/content/partials/cloudflare-one/gateway/order-of-enforcement.mdx‎

Lines changed: 11 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -4,17 +4,6 @@
44

55
import { Render, Details } from "~/components";
66

7-
:::caution[Order of enforcement changing on 2025-07-14]
8-
On 2025-07-14, Gateway will begin evaluating network-level policies before application-level policies and verify the network path to an origin server before accepting a connection. This will only affect your policies if you are applying HTTP policies in your account. For example:
9-
10-
<Details header="Comparison of old and new order of enforcement">
11-
12-
| | Old order of enforcement | New order of enforcement |
13-
| ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
14-
| **Network Block policy and HTTP Block policy** | Gateway blocks traffic and displays the block page and/or follows the client notification settings on the HTTP policy. | Gateway blocks traffic. Gateway does not display the block page but will follow the client notification settings on the Network policy. |
15-
| **Network Allow policy and HTTP Block policy** | Gateway blocks traffic and displays the block page and follows the client notification settings on the HTTP policy. | No change. |
16-
| **Network Block policy and HTTP Allow policy** | Gateway blocks traffic and follows the client notification settings on the Network policy. | No change. |
17-
187
```mermaid
198
flowchart TB
209
%% Accessibility
@@ -71,69 +60,19 @@ flowchart TB
7160
http0@{ shape: lean-r}
7261
```
7362

74-
</Details>
75-
:::
63+
:::caution[Order of enforcement change on 2025-07-14]
64+
On 2025-07-14, Gateway began evaluating network-level policies before application-level policies and verify the network path to an origin server before accepting a connection. This only affects your policies if you are applying HTTP policies in your account. For example:
7665

77-
```mermaid
78-
flowchart TB
79-
%% Accessibility
80-
accTitle: Gateway order of enforcement
81-
accDescr: Flowchart describing the order of enforcement for Gateway policies.
66+
<Details header="Comparison of old and new order of enforcement">
8267

83-
%% In with user traffic
84-
start(["Traffic"])-->dns0[/"DNS query"/]-->dns1
85-
start-->http0{{"HTTP(S) request on port 80 or 443?"}}
86-
http0-- "Yes" -->http1
87-
http0-- "No" -->network0
88-
89-
%% DNS policies
90-
subgraph DNS
91-
dns1["DNS policies"]
92-
style DNS text-align:left
93-
dns1-- "Resolved by" -->dns2["1.1.1.1"]
94-
dns1-.->dns3
95-
96-
%% DNS resolution
97-
subgraph Resolution
98-
dns2["1.1.1.1"]
99-
dns3["Resolver policies <br />(Enterprise users only)"]-- "Resolved by" -->dns4["Custom resolver"]
100-
end
101-
102-
end
103-
dns2["1.1.1.1"]----->internet
104-
dns4----->internet
105-
dns4-.->cloudflare["Private network services <br />(Cloudflare Tunnel, Magic WAN, etc.)"]
106-
107-
108-
%% Proxied by Gateway
109-
subgraph Proxy
110-
111-
%% HTTP policies
112-
subgraph HTTP
113-
http1{{"Do Not Inspect policies"}}
114-
http1-."Inspect".->http2["Isolate policies <br />(with add-on)"]
115-
http2-->http3["Allow, Block, Do Not Scan policies"]
116-
end
117-
118-
http1-- "Do Not Inspect" -->network0
119-
http3-->network0
120-
network0[/"Network connections"/]-->network1
121-
122-
%% Network policies
123-
subgraph Network
124-
network1["Network policies"]
125-
end
126-
end
127-
128-
%% Egress
129-
subgraph Egress
130-
network1-.->egress1["Egress policies <br />(Enterprise users only)"]
131-
end
132-
133-
%% Finish
134-
network1-- "Egress with Cloudflare IP" -->internet([Internet])
135-
egress1-- "Egress with dedicated IP" -->internet
136-
```
68+
| | Old order of enforcement | New order of enforcement |
69+
| ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
70+
| **Network Block policy and HTTP Block policy** | Gateway blocks traffic and displays the block page and/or follows the client notification settings on the HTTP policy. | Gateway blocks traffic. Gateway does not display the block page but will follow the client notification settings on the Network policy. |
71+
| **Network Allow policy and HTTP Block policy** | Gateway blocks traffic and displays the block page and follows the client notification settings on the HTTP policy. | No change. |
72+
| **Network Block policy and HTTP Allow policy** | Gateway blocks traffic and follows the client notification settings on the Network policy. | No change. |
73+
74+
</Details>
75+
:::
13776

13877
## Connection establishment
13978

0 commit comments

Comments
 (0)