Skip to content

Commit ad0e381

Browse files
committed
Add missing network recommended policy
1 parent 3cf4b2f commit ad0e381

File tree

2 files changed

+11
-10
lines changed

2 files changed

+11
-10
lines changed

src/content/docs/learning-paths/secure-internet-traffic/build-network-policies/recommended-network-policies.mdx

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,3 +89,12 @@ Implicitly deny all of your internal IP ranges included in a list. We recommend
8989
| Selector | Operator | Value | Action |
9090
| -------------- | -------- | ---------------------- | ------ |
9191
| Destination IP | in list | _Internal Network IPs_ | Block |
92+
93+
## All-NET-ApplicationAccess-Allow
94+
95+
Only allow network traffic from known and approved devices.
96+
97+
<Render
98+
file="gateway/policies/dash-plus-api/network/enforce-device-posture"
99+
product="cloudflare-one"
100+
/>

src/content/partials/cloudflare-one/gateway/policies/dash-plus-api/network/enforce-device-posture.mdx

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,8 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
3131
"l4"
3232
],
3333
"traffic": "any(net.sni.domains[*] == \"internalapp.com\")",
34-
"device_posture": "not(any(device_posture.checks.passed[*] in {\"<Device Serial Numbers List UUID>\"}))",
35-
"rule_settings": {
36-
"block_page_enabled": true,
37-
"block_reason": "This domain/IP was explicitly blocked by your network administrator. Please reach out to your helpdesk for assistance"
38-
}
39-
}'
34+
"device_posture": "not(any(device_posture.checks.passed[*] in {\"<DEVICE_SERIAL_NUMBERS_LIST_UUID>\"}))"
35+
}'
4036
```
4137

4238
To get the UUIDs of your device posture checks, use the [List device posture rules](/api/resources/zero_trust/subresources/devices/subresources/posture/methods/list/) endpoint.
@@ -55,10 +51,6 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_resolvedip_blocklist_rule"
5551
filters = ["l4"]
5652
traffic = "any(net.sni.domains[*] == \"internalapp.com\")"
5753
posture = "not(any(device_posture.checks.passed[*] in {\"${"$"}${cloudflare_zero_trust_list.allowed_devices_sn_list.id}\"}))"
58-
rule_settings {
59-
block_page_enabled = true
60-
block_page_reason = "This domain/IP was explicitly blocked by your network administrator. Please reach out to your helpdesk for assistance"
61-
}
6254
}
6355
```
6456

0 commit comments

Comments
 (0)