Skip to content

Commit 9f89da0

Browse files
maxvpmaxvp
authored
[Gateway] Get started with API policies (#18724)
1 parent c0cd39b commit 9f89da0

File tree

4 files changed

+166
-7
lines changed

4 files changed

+166
-7
lines changed

‎src/content/partials/cloudflare-one/gateway/get-started/create-dns-policy.mdx‎

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,12 @@
22
{}
33
---
44

5-
import { Render } from "~/components";
5+
import { Render, Tabs, TabItem } from "~/components";
66

77
To create a new DNS policy:
88

9+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
10+
911
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Gateway** > **Firewall policies**.
1012
2. In the **DNS** tab, select **Add a policy**.
1113
3. Name the policy.
@@ -17,4 +19,48 @@ To create a new DNS policy:
1719
/>
1820
6. Select **Create policy**.
1921

22+
</TabItem>
23+
24+
<TabItem label="API">
25+
26+
1. [Create an API token](/fundamentals/api/get-started/create-token/) with the following permissions:
27+
28+
| Type | Item | Permission |
29+
| ------- | ---------- | ---------- |
30+
| Account | Zero Trust | Edit |
31+
32+
2. (Optional) Configure your API environment variables to include your [account ID](/fundamentals/setup/find-account-and-zone-ids/) and API token.
33+
3. Send a `POST` request to the [Create a Zero Trust Gateway rule](/api/resources/zero_trust/subresources/gateway/subresources/rules/methods/create/) endpoint. For example, we recommend adding a policy to block all [security categories](/cloudflare-one/policies/gateway/domain-categories/#security-categories):
34+
35+
```sh title="curl API DNS policy example"
36+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
37+
--header "Content-Type: application/json" \
38+
--header "Authorization: Bearer <API_TOKEN>" \
39+
--data '{
40+
"name": "Block security risks",
41+
"description": "Block all default Cloudflare DNS security categories",
42+
"precedence": 0,
43+
"enabled": true,
44+
"action": "block",
45+
"filters": [
46+
"dns"
47+
],
48+
"traffic": "any(dns.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})",
49+
"identity": "",
50+
"device_posture": ""
51+
}'
52+
```
53+
54+
```sh output
55+
{
56+
"success": true,
57+
"errors": [],
58+
"messages": []
59+
}
60+
```
61+
62+
The API will respond with a summary of the policy and the result of your request.
63+
64+
</TabItem> </Tabs>
65+
2066
For more information, refer to [DNS policies](/cloudflare-one/policies/gateway/dns-policies/).

‎src/content/partials/cloudflare-one/gateway/get-started/create-http-policy.mdx‎

Lines changed: 69 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,17 @@
22
{}
33
---
44

5-
import { Render } from "~/components";
5+
import { Render, Tabs, TabItem } from "~/components";
66

77
To create a new HTTP policy:
88

9+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
10+
911
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Gateway** > **Firewall policies**.
1012
2. In the **HTTP** tab, select **Add a policy**.
1113
3. Name the policy.
1214
4. Under **Traffic**, build a logical expression that defines the traffic you want to allow or block.
13-
5. Choose an **Action** to take when traffic matches the logical expression. For example, if you have enabled TLS inspection, some applications that use [embedded certificates](/cloudflare-one/policies/gateway/http-policies/tls-decryption/#inspection-limitations) may not support HTTP inspection, such as some Google products. You can create a policy to bypass inspection for these applications:
15+
5. Choose an **Action** to take when traffic matches the logical expression. For example, if you have configured TLS decryption, some applications that use [embedded certificates](/cloudflare-one/policies/gateway/http-policies/tls-decryption/#inspection-limitations) may not support HTTP inspection, such as some Google products. You can create a policy to bypass inspection for these applications:
1416

1517
<Render
1618
file="gateway/policies/do-not-inspect-applications"
@@ -26,4 +28,69 @@ To create a new HTTP policy:
2628

2729
6. Select **Create policy**.
2830

31+
</TabItem>
32+
33+
<TabItem label="API">
34+
35+
1. [Create an API token](/fundamentals/api/get-started/create-token/) with the following permissions:
36+
37+
| Type | Item | Permission |
38+
| ------- | ---------- | ---------- |
39+
| Account | Zero Trust | Edit |
40+
41+
2. (Optional) Configure your API environment variables to include your [account ID](/fundamentals/setup/find-account-and-zone-ids/) and API token.
42+
3. Send a `POST` request to the [Create a Zero Trust Gateway rule](/api/resources/zero_trust/subresources/gateway/subresources/rules/methods/create/) endpoint. For example, if you have configured TLS decryption, some applications that use [embedded certificates](/cloudflare-one/policies/gateway/http-policies/tls-decryption/#inspection-limitations) may not support HTTP inspection, such as some Google products. You can create a policy to bypass inspection for these applications:
43+
44+
```sh title="curl API HTTP policy example"
45+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
46+
--header "Content-Type: application/json" \
47+
--header "Authorization: Bearer <API_TOKEN>" \
48+
--data '{
49+
"name": "Do not inspect applications",
50+
"description": "Bypass TLS decryption for unsupported applications",
51+
"precedence": 0,
52+
"enabled": true,
53+
"action": "off",
54+
"filters": [
55+
"http"
56+
],
57+
"traffic": "any(app.type.ids[*] in {16})",
58+
"identity": "",
59+
"device_posture": ""
60+
}'
61+
```
62+
63+
```sh output
64+
{
65+
"success": true,
66+
"errors": [],
67+
"messages": []
68+
}
69+
```
70+
71+
The API will respond with a summary of the policy and the result of your request.
72+
73+
Cloudflare also recommends adding a policy to block [known threats](/cloudflare-one/policies/gateway/domain-categories/#security-categories) such as Command & Control, Botnet and Malware based on Cloudflare's threat intelligence:
74+
75+
```bash title="Block known risks HTTP policy"
76+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
77+
--header "Content-Type: application/json" \
78+
--header "Authorization: Bearer <API_TOKEN>" \
79+
--data '{
80+
"name": "Block known risks",
81+
"description": "Block all default Cloudflare HTTP security categories",
82+
"precedence": 0,
83+
"enabled": true,
84+
"action": "block",
85+
"filters": [
86+
"http"
87+
],
88+
"traffic": "any(http.request.uri.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})",
89+
"identity": "",
90+
"device_posture": ""
91+
}'
92+
```
93+
94+
</TabItem> </Tabs>
95+
2996
For more information, refer to [HTTP policies](/cloudflare-one/policies/gateway/http-policies/).

‎src/content/partials/cloudflare-one/gateway/get-started/create-network-policy.mdx‎

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,12 @@
22
{}
33
---
44

5-
import { Render } from "~/components";
5+
import { Render, Tabs, TabItem } from "~/components";
66

77
To create a new network policy:
88

9+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
10+
911
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Gateway** > **Firewall policies**.
1012
2. In the **Network** tab, select **Add a policy**.
1113
3. Name the policy.
@@ -17,4 +19,48 @@ To create a new network policy:
1719
/>
1820
6. Select **Create policy**.
1921

22+
</TabItem>
23+
24+
<TabItem label="API">
25+
26+
1. [Create an API token](/fundamentals/api/get-started/create-token/) with the following permissions:
27+
28+
| Type | Item | Permission |
29+
| ------- | ---------- | ---------- |
30+
| Account | Zero Trust | Edit |
31+
32+
2. (Optional) Configure your API environment variables to include your [account ID](/fundamentals/setup/find-account-and-zone-ids/) and API token.
33+
3. Send a `POST` request to the [Create a Zero Trust Gateway rule](/api/resources/zero_trust/subresources/gateway/subresources/rules/methods/create/) endpoint. For example, you can use a list of [device serial numbers](/cloudflare-one/identity/devices/warp-client-checks/corp-device/) to ensure users can only access an application if they connect with the WARP client from a company device:
34+
35+
```sh title="curl API network policy example"
36+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
37+
--header "Content-Type: application/json" \
38+
--header "Authorization: Bearer <API_TOKEN>" \
39+
--data '{
40+
"name": "Enforce device posture",
41+
"description": "Ensure only devices in Zero Trust organization can connect to application",
42+
"precedence": 0,
43+
"enabled": true,
44+
"action": "block",
45+
"filters": [
46+
"l4"
47+
],
48+
"traffic": "any(net.sni.domains[*] == \"internalapp.com\")",
49+
"identity": "",
50+
"device_posture": "not(any(device_posture.checks.passed[*] in {\"<LIST_UUID>\"}))"
51+
}'
52+
```
53+
54+
```sh output
55+
{
56+
"success": true,
57+
"errors": [],
58+
"messages": []
59+
}
60+
```
61+
62+
The API will respond with a summary of the policy and the result of your request.
63+
64+
</TabItem> </Tabs>
65+
2066
For more information, refer to [network policies](/cloudflare-one/policies/gateway/network-policies/).

‎src/content/partials/cloudflare-one/gateway/policies/enforce-device-posture.mdx‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
{}
33
---
44

5-
In the following example, you can use a list of [device serial numbers](/cloudflare-one/identity/devices/warp-client-checks/corp-device/) to ensure users can only access an application if they connect with the WARP client from a company device:
5+
For example, you can use a list of [device serial numbers](/cloudflare-one/identity/devices/warp-client-checks/corp-device/) to ensure users can only access an application if they connect with the WARP client from a company device:
66

77
| Selector | Operator | Value | Logic | Action |
88
| ---------------------------- | -------- | ----------------------- | ----- | ------ |
9-
| Passed Device Posture Checks | not in | _Device serial numbers_ | And | Block |
10-
| SNI Domain | is | `internalapp.com` | | |
9+
| SNI Domain | is | `internalapp.com` | And | Block |
10+
| Passed Device Posture Checks | not in | _Device serial numbers_ | | |

0 commit comments

Comments
 (0)