Skip to content

Commit 7d7ba06

Browse files
abracchi-twabracchi-tw
authored
[Teams] add Require Gateway docs to Teams (#504)
* add require gateway section * capitalization fix * add criteria to access policies section * fix to last step of instructions * fix wording * change title * fixes * whitespace
1 parent 936a9ca commit 7d7ba06

File tree

6 files changed

+145
-3
lines changed

6 files changed

+145
-3
lines changed

‎products/access/src/content/getting-started/policies.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,9 @@ Here is a list of all the criteria you can apply:
6161
* **Service Token** - the request will need to present the correct service token headers configured for the specific application
6262
* **Identity provider groups** — employs the user groups (if supported) you configured with your identity provider (IdP) or LDAP with Access. The IdP group option only displays if you use an identity provider that passes groups using SAML or OAuth Scope.
6363
* **Authentication Method** - checks the [multifactor authentication](/learning/mfa-requirements) method used by the user, if supported by the identity provider.
64+
* **WARP** - checks if the user's machine is running the Cloudflare WARP client.
65+
* **Gateway** - checks if the user's machine is running your organization's Gateway configuration.
66+
6467

6568
## Policy management
6669

‎products/cloudflare-one/src/content/glossary/index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
order: 10
33
---
44

5-
# Teams Glossary
5+
# Glossary
66

77
## [Cloudflare for Teams](https://www.cloudflare.com/teams-home/)
88
Cloudflare for Teams brings the power of Cloudflare’s global network to your internal teams and infrastructure. Teams empowers users with secure, fast and seamless access to any device on the Internet.

‎products/cloudflare-one/src/content/learning/index.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
---
22
order: 2
3-
hidden: true
43
---
54

6-
# Learning
5+
# Teams documentation
76

87
We're building this section to help you make the most of your experience with Cloudflare for Teams. We plan on having learning materials, readings, and technical deep-dives about what you can do with our products and features.
98

‎products/cloudflare-one/src/content/learning/policies.md‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
order: 2
3+
hidden: true
34
---
45

56
# Policies
@@ -172,6 +173,109 @@ When a DNS query matches with a DNS policy, Gateway follows this order of operat
172173

173174
<Aside>
174175

176+
This feature is only available for Gateway and Teams paid plans. For more information, see the Cloudflare for Teams [pricing page](https://www.cloudflare.com/teams-pricing/).
177+
178+
</Aside>
179+
180+
You can decide to add a policy to filter HTTP traffic on the L7 firewall. Gateway will intercept all HTTP and HTTPS traffic and apply the rules you have configured in your policy to either block, allow, or override specific elements such as websites, IP addresses, and file types.
181+
182+
You can build an HTTP policy by configuring the following elements:
183+
184+
* **Actions**
185+
* **Expressions**
186+
* **Selectors**
187+
* **Operators**
188+
189+
#### Actions
190+
191+
Just like actions on destinations in DNS policies, actions in HTTP policies allow you to choose what to do with a given set of elements (domains, IP addresses, file types, and so on). You can assign one action per policy.
192+
193+
These are the action types you can choose from:
194+
195+
* **Allow**
196+
* **Block**
197+
* **Bypass**
198+
199+
*Bypass* lets administrators bypass certain elements from inspection. Administrators who wish to bypass a site must match against the host in order to prevent HTTP inspection from occuring on both encrypted and plaintext traffic. The bypass action is only available when matching against the host criteria.
200+
201+
#### Selectors
202+
Gateway matches HTTP traffic against the following selectors, or criteria:
203+
* **Host**
204+
* **URL**
205+
* **URL Query**
206+
* **URL Path**
207+
* **URL Path and Query**
208+
* **HTTP Method**
209+
* **HTTP Response**
210+
* **Uploaded and Downloaded File Extension**
211+
* **Uploaded and Downloaded Mime Type**
212+
* **Content categories**
213+
214+
List of file extensions Gateway can match against:
215+
216+
<TableWrap>
217+
218+
| Image | Executable | Audio | Documents | Data | Compressed | System | Video |
219+
|------|------|-------|------|--------|--------|--------|-----|
220+
| avif | apk | m4a | doc | avro | 7z | bak | avi |
221+
| bmp | bat | mid | docx | csv | arj | cab | flv |
222+
| gif | bin | mp3 | odp | dat | bz2 | cpl | h264 |
223+
| ico | cgi | mpa | ods | dmg | deb | cur | m4v |
224+
| jpeg | com | wav | odt | iso | gz | emu | mkv |
225+
| png | dll | wma | pdf | json | lz | ini | mov |
226+
| psd | exe | ppt | | log | lz4 | scr | mp4 |
227+
| svg | hta | pptx | | mdb | lzh | sys | mpeg |
228+
| tif | jar | rtf | | nzb | lzma | tmp | wmv |
229+
| webp | moo | txt | | orc | pak
230+
| | pif | xls | | parquet | rar
231+
| | pl | xlsx | | rc | rpm
232+
| | prg | | | sav | sz
233+
| | | | | wasm | xz | |
234+
| | | | | sql lite | z
235+
| | | | | tar | zip
236+
| | | | | toml | zlib |
237+
| | | | | torrent | zst |
238+
| | | | | xml | |
239+
| | | | | yaml | |
240+
241+
</TableWrap>
242+
243+
#### Operators
244+
Operators are the way Gateway matches traffic to a selector. Matching happens as follows:
245+
246+
| Operator | Meaning
247+
|:---------------------:|:---------------------------:|
248+
| is | exact match, equals |
249+
| is not | all except exact match |
250+
| in | in any of defined entries |
251+
| not in | not in defined entries |
252+
| matches regex | regex evaluates to true |
253+
| does not match regex | all except when regex evals to true |
254+
255+
#### Expressions
256+
Expressions are sets of conditions with which you can combine [selectors](#selectors) and [operators](#operators). By configuring one or more expressions, you can define the scope of your HTTP policy.
257+
258+
#### Example scenarios
259+
260+
| Action | Selector | Operator |
261+
| ------ | ---- | -------- |
262+
| Block | Content categories | in: `Gaming` |
263+
264+
**Result**: this configuration blocks any traffic to domains categorized as `Gaming`.
265+
266+
#### FAQ
267+
268+
* **How can I bypass the L7 firewall for a website?**
269+
270+
Cloudflare Gateway uses the hostname in the HTTP CONNECT header to identify the destination of the request. Administrators who wish to bypass a site must match against the host in order to prevent HTTP inspection from occurring on both encrypted and plaintext traffic. The **bypass** action is only available when matching against the **host** criteria.
271+
Bypassing the L7 firewall results in no HTTP traffic inspection and logging is disabled for that HTTP session.
272+
273+
* **In what order are rules evaluated?**
274+
275+
The L7 firewall evaluates rules starting with the rule containing the lowest precedence (e.g., rule number one). Rules with a higher value precedence are evaluated after those with a lower value.
276+
277+
<Aside>
278+
175279
This feature is only available on the **Teams Enterprise plan**. For more information, see the Cloudflare for Teams [pricing page](https://www.cloudflare.com/teams-pricing/).
176280

177281
</Aside>

‎products/cloudflare-one/src/content/learning/require-gateway.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
order: 2
3+
---
4+
5+
# Enforce Gateway or WARP for Access
6+
7+
With Access, you can require that all traffic to specific applications is monitored by Cloudflare Gateway. With Gateway protecting and filtering all requests to your applications, you will be able to see all user traffic and activity in each of these applications, broken down by user and device.
8+
9+
Alternatively, you can require users to run WARP (Cloudflare's secure and modern VPN) in order to access an application. This ensures that all user traffic is encrypted and routed through Cloudflare.
10+
11+
You can choose to require Gateway or WARP by configuring dedicated actions within your Access policies.
12+
13+
The first step you need to take in order to require Gateway or WARP is to add a device posture integration.
14+
15+
To do that:
16+
17+
1. Log in to your [Teams dashboard](https://dash.teams.cloudflare.com/) and navigate to **Access > Authentication > Device Posture**.
18+
1. Select **Gateway** if you’d like to require all traffic to flow through your Gateway instance. Select **WARP** if you’d like to require all traffic to flow through Cloudflare’s VPN.
19+
20+
![Device Posture](../static/require-gateway/device-posture.png)
21+
22+
You are now ready to start requiring Gateway or WARP for your Access applications.
23+
24+
1. On the Teams dashboard, navigate to **Access > Applications**.
25+
26+
1. Locate the application for which you want to require Gateway or WARP.
27+
28+
1. Click **Edit**.
29+
30+
1. To have an existing policy require Gateway or WARP, click **Edit** for that specific policy. Then, and add an **Include** or **Require** rule with the option *Gateway* selected. If you'd like to require WARP instead, select *WARP*.
31+
32+
To create a new policy requiring Gateway or WARP, click **Add a rule**. Then, add an **Include** or **Require** rule with the option *Gateway* selected. If you'd like to require WARP instead, select *WARP*.
33+
34+
1. Click **Save rule**.
35+
36+
Before granting access to the application, your policy will now check that the user is running your organization's Gateway configuration, or the WARP client, on their machine.

‎products/cloudflare-one/src/content/static/require-gateway/device-posture.png‎

188 KB
Loading

0 commit comments

Comments
 (0)