Skip to content

Commit ab07e7e

Browse files
maxvpmaxvp
committed
Fix device posture partial
1 parent 81ace67 commit ab07e7e

File tree

4 files changed

+71
-87
lines changed

4 files changed

+71
-87
lines changed

‎src/content/docs/cloudflare-one/policies/gateway/network-policies/common-policies.mdx‎

Lines changed: 4 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -87,35 +87,10 @@ curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
8787

8888
Require devices to have certain software installed or other configuration attributes. For instructions on enabling a device posture check, refer to the [device posture section](/cloudflare-one/identity/devices/). For example, you can use a list of [device serial numbers](/cloudflare-one/identity/devices/warp-client-checks/corp-device/) to ensure users can only access an application if they connect with the WARP client from a company device:
8989

90-
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
91-
92-
<Render file="gateway/policies/enforce-device-posture" />
93-
94-
</TabItem>
95-
96-
<TabItem label="API">
97-
98-
```bash
99-
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
100-
--header "Content-Type: application/json" \
101-
--header "Authorization: Bearer <API_TOKEN>" \
102-
--data '{
103-
"name": "Enforce device posture",
104-
"description": "Limit access to an internal application to approved organization devices",
105-
"enabled": true,
106-
"action": "block",
107-
"filters": [
108-
"l4"
109-
],
110-
"traffic": "any(net.sni.domains[*] == \"example.com\")",
111-
"identity": "",
112-
"device_posture": "not(any(device_posture.checks.passed[*] in {\"<POSTURE_CHECK_UUID>\"}))"
113-
}'
114-
```
115-
116-
To get the UUIDs of your device posture checks, use the [List device posture rules](/api/resources/zero_trust/subresources/devices/subresources/posture/methods/list/) endpoint.
117-
118-
</TabItem> </Tabs>
90+
<Render
91+
file="gateway/policies/dash-plus-api/network-enforce-device-posture"
92+
product="cloudflare-one"
93+
/>
11994

12095
## Enforce session duration
12196

‎src/content/partials/cloudflare-one/gateway/policies/block-applications.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
{}
33
---
44

5-
import { GlossaryTooltip, Tabs, TabItem } from "~/components";
5+
import { GlossaryTooltip } from "~/components";
66

77
:::note
88
After seven days, view your [shadow IT analytics](/cloudflare-one/insights/analytics/shadow-it-discovery/) and block additional applications based on what your users are accessing.

‎src/content/partials/cloudflare-one/gateway/policies/dash-plus-api/network-enforce-device-posture.mdx‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
{}
3+
---
4+
5+
import { Tabs, TabItem, Render } from "~/components";
6+
7+
In the following example, you can use a list of [device serial numbers](/cloudflare-one/identity/devices/warp-client-checks/corp-device/) to ensure users can only access an application if they connect with the WARP client from a company device:
8+
9+
<Tabs syncKey="dashPlusAPI">
10+
<TabItem label="Dashboard">
11+
12+
<Render
13+
file="gateway/policies/enforce-device-posture"
14+
product="cloudflare-one"
15+
/>
16+
17+
</TabItem>
18+
<TabItem label="API">
19+
20+
```sh
21+
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
22+
--header "Content-Type: application/json" \
23+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
24+
--data '{
25+
"name": "All-NET-ApplicationAccess-Allow",
26+
"description": "Ensure access to the application comes from authorized WARP clients",
27+
"precedence": 5000,
28+
"enabled": false,
29+
"action": "block",
30+
"filters": [
31+
"l4"
32+
],
33+
"traffic": "any(net.sni.domains[*] == \"internalapp.com\")",
34+
"device_posture": "not(any(device_posture.checks.passed[*] in {\"<Device Serial Numbers List UUID>\"}))",
35+
"rule_settings": {
36+
"block_page_enabled": true,
37+
"block_reason": "This domain/IP was explicitly blocked by your network administrator. Please reach out to your helpdesk for assistance"
38+
}
39+
}'
40+
```
41+
42+
To get the UUIDs of your device posture checks, use the [List device posture rules](/api/resources/zero_trust/subresources/devices/subresources/posture/methods/list/) endpoint.
43+
44+
</TabItem>
45+
<TabItem label="Terraform">
46+
47+
```tf
48+
resource "cloudflare_zero_trust_gateway_policy" "dns_resolvedip_blocklist_rule" {
49+
account_id = var.account_id
50+
name = "All-NET-ApplicationAccess-Allow"
51+
description = "Ensure access to the application comes from authorized WARP clients"
52+
precedence = 5000
53+
enabled = false
54+
action = "block"
55+
filters = ["l4"]
56+
traffic = "any(net.sni.domains[*] == \"internalapp.com\")"
57+
posture = "not(any(device_posture.checks.passed[*] in {\"${"$"}${cloudflare_zero_trust_list.allowed_devices_sn_list.id}\"}))"
58+
rule_settings {
59+
block_page_enabled = true
60+
block_page_reason = "This domain/IP was explicitly blocked by your network administrator. Please reach out to your helpdesk for assistance"
61+
}
62+
}
63+
```
64+
65+
</TabItem>
66+
</Tabs>

‎src/content/partials/cloudflare-one/gateway/policies/enforce-device-posture.mdx‎

Lines changed: 0 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -2,64 +2,7 @@
22
{}
33
---
44

5-
import { Tabs, TabItem } from "~/components";
6-
7-
In the following example, you can use a list of [device serial numbers](/cloudflare-one/identity/devices/warp-client-checks/corp-device/) to ensure users can only access an application if they connect with the WARP client from a company device:
8-
9-
<Tabs syncKey="dashPlusAPI">
10-
<TabItem label="Dashboard">
11-
125
| Selector | Operator | Value | Logic | Action |
136
| ---------------------------- | -------- | ----------------------- | ----- | ------ |
147
| Passed Device Posture Checks | not in | _Device serial numbers_ | And | Block |
158
| SNI Domain | is | `internalapp.com` | | |
16-
17-
</TabItem>
18-
<TabItem label="API">
19-
20-
```sh
21-
curl --request POST \
22-
--url https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rules \
23-
--header 'Content-Type: application/json' \
24-
--header "Authorization: Bearer <API TOKEN>" \
25-
--data '{
26-
"name": "All-NET-ApplicationAccess-Allow",
27-
"description": "Ensure access to the application comes from authorized WARP clients",
28-
"precedence": 5000,
29-
"enabled": false,
30-
"action": "block",
31-
"filters": [
32-
"l4"
33-
],
34-
"traffic": "any(net.sni.domains[*] == \"internalapp.com\")",
35-
"device_posture": "not(any(device_posture.checks.passed[*] in {\"<Device Serial Numbers List UUID>\"}))",
36-
"rule_settings": {
37-
"block_page_enabled": true,
38-
"block_reason": "This domain/IP was explicitly blocked by your network administrator. Please reach out to your helpdesk for assistance"
39-
}
40-
}'
41-
```
42-
43-
</TabItem>
44-
<TabItem label="Terraform">
45-
46-
```tf
47-
resource "cloudflare_zero_trust_gateway_policy" "dns_resolvedip_blocklist_rule" {
48-
account_id = var.account_id
49-
name = "All-NET-ApplicationAccess-Allow"
50-
description = "Ensure access to the application comes from authorized WARP clients"
51-
precedence = 5000
52-
enabled = false
53-
action = "block"
54-
filters = ["l4"]
55-
traffic = "any(net.sni.domains[*] == \"internalapp.com\")"
56-
posture = "not(any(device_posture.checks.passed[*] in {\"${"$"}${cloudflare_zero_trust_list.allowed_devices_sn_list.id}\"}))"
57-
rule_settings {
58-
block_page_enabled = true
59-
block_page_reason = "This domain/IP was explicitly blocked by your network administrator. Please reach out to your helpdesk for assistance"
60-
}
61-
}
62-
```
63-
64-
</TabItem>
65-
</Tabs>

0 commit comments

Comments
 (0)