Skip to content

Commit b32da38

Browse files
maxvpmaxvp
authored
[Gateway] Network common policy API examples (#18943)
1 parent 60d05b0 commit b32da38

File tree

4 files changed

+193
-7
lines changed

4 files changed

+193
-7
lines changed

‎src/content/docs/cloudflare-one/policies/gateway/dns-policies/common-policies.mdx‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
4646
}'
4747
```
4848

49+
To get the UUIDs of your lists, use the [List Zero Trust lists](/api/resources/zero_trust/subresources/gateway/subresources/lists/methods/list/) endpoint.
50+
4951
</TabItem> </Tabs>
5052

5153
## Block security threats

‎src/content/docs/cloudflare-one/policies/gateway/network-policies/common-policies.mdx‎

Lines changed: 187 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,25 +18,105 @@ Refer to the [network policies page](/cloudflare-one/policies/gateway/network-po
1818

1919
<Render file="gateway/policies/block-applications" product="cloudflare-one" />
2020

21+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
22+
2123
| Selector | Operator | Value | Action |
2224
| ----------- | -------- | ------------------------- | ------ |
2325
| Application | in | _Artificial Intelligence_ | Block |
2426

27+
</TabItem>
28+
29+
<TabItem label="API">
30+
31+
```bash
32+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
33+
--header "Content-Type: application/json" \
34+
--header "Authorization: Bearer <API_TOKEN>" \
35+
--data '{
36+
"name": "Block unauthorized applications",
37+
"description": "Block access to unauthorized AI applications",
38+
"enabled": true,
39+
"action": "block",
40+
"filters": [
41+
"l4"
42+
],
43+
"traffic": "any(app.type.ids[*] in {25})",
44+
"identity": "",
45+
"device_posture": ""
46+
}'
47+
```
48+
49+
</TabItem> </Tabs>
50+
2551
## Check user identity
2652

2753
<Render file="gateway/policies/check-user-identity" />
2854

55+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
56+
2957
| Selector | Operator | Value | Logic | Action |
3058
| ---------------- | -------- | ------------- | ----- | ------ |
3159
| Application | in | _Salesforce_ | And | Block |
3260
| User Group Names | in | _Contractors_ | | |
3361

62+
</TabItem>
63+
64+
<TabItem label="API">
65+
66+
```bash
67+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
68+
--header "Content-Type: application/json" \
69+
--header "Authorization: Bearer <API_TOKEN>" \
70+
--data '{
71+
"name": "Check user identity",
72+
"description": "Block access to Salesforce by temporary employees and contractors",
73+
"enabled": true,
74+
"action": "block",
75+
"filters": [
76+
"l4"
77+
],
78+
"traffic": "any(app.ids[*] in {606})",
79+
"identity": "any(identity.groups.name[*] in {\"Contractors\"})",
80+
"device_posture": ""
81+
}'
82+
```
83+
84+
</TabItem> </Tabs>
85+
3486
## Enforce device posture
3587

36-
Require devices to have certain software installed or other configuration attributes. For instructions on enabling a device posture check, refer to the [device posture section](/cloudflare-one/identity/devices/).
88+
Require devices to have certain software installed or other configuration attributes. For instructions on enabling a device posture check, refer to the [device posture section](/cloudflare-one/identity/devices/). For example, you can use a list of [device serial numbers](/cloudflare-one/identity/devices/warp-client-checks/corp-device/) to ensure users can only access an application if they connect with the WARP client from a company device:
89+
90+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
3791

3892
<Render file="gateway/policies/enforce-device-posture" />
3993

94+
</TabItem>
95+
96+
<TabItem label="API">
97+
98+
```bash
99+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
100+
--header "Content-Type: application/json" \
101+
--header "Authorization: Bearer <API_TOKEN>" \
102+
--data '{
103+
"name": "Enforce device posture",
104+
"description": "Limit access to an internal application to approved organization devices",
105+
"enabled": true,
106+
"action": "block",
107+
"filters": [
108+
"l4"
109+
],
110+
"traffic": "any(net.sni.domains[*] == \"example.com\")",
111+
"identity": "",
112+
"device_posture": "not(any(device_posture.checks.passed[*] in {\"<POSTURE_CHECK_UUID>\"}))"
113+
}'
114+
```
115+
116+
To get the UUIDs of your device posture checks, use the [List device posture rules](/api/resources/zero_trust/subresources/devices/subresources/posture/methods/list/) endpoint.
117+
118+
</TabItem> </Tabs>
119+
40120
## Enforce session duration
41121

42122
To require users to re-authenticate after a certain amount of time has elapsed, configure [WARP sessions](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions/).
@@ -47,32 +127,136 @@ Restrict user access to only the specific sites or applications configured in yo
47127

48128
### 1. Allow HTTP and HTTPS traffic
49129

130+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
131+
50132
| Selector | Operator | Value | Logic | Action |
51133
| ----------------- | -------- | ----------- | ----- | ------ |
52134
| Detected Protocol | is | _TLS_ | And | Allow |
53135
| Destination Port | in | `80`, `443` | | |
54136

137+
</TabItem>
138+
139+
<TabItem label="API">
140+
141+
```bash
142+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
143+
--header "Content-Type: application/json" \
144+
--header "Authorization: Bearer <API_TOKEN>" \
145+
--data '{
146+
"name": "Allow HTTP and HTTPS traffic",
147+
"description": "Restrict traffic to HTTP and HTTPS traffic",
148+
"enabled": true,
149+
"action": "allow",
150+
"filters": [
151+
"l4"
152+
],
153+
"traffic": "net.detected_protocol == \"tls\" and net.dst.port in {80 443}",
154+
"identity": "",
155+
"device_posture": ""
156+
}'
157+
```
158+
159+
</TabItem> </Tabs>
160+
55161
### 2. Block all other traffic
56162

163+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
164+
57165
| Selector | Operator | Value | Action |
58166
| -------- | -------- | ------------ | ------ |
59-
| Protocol | in | _UDP_, _TCP_ | Block |
167+
| Protocol | in | _TCP_, _UDP_ | Block |
168+
169+
</TabItem>
170+
171+
<TabItem label="API">
172+
173+
```bash
174+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
175+
--header "Content-Type: application/json" \
176+
--header "Authorization: Bearer <API_TOKEN>" \
177+
--data '{
178+
"name": "Block all other traffic",
179+
"description": "Block all other traffic that is not HTTP or HTTPS",
180+
"enabled": true,
181+
"action": "block",
182+
"filters": [
183+
"l4"
184+
],
185+
"traffic": "net.protocol in {\"tcp\" \"udp\"}",
186+
"identity": "",
187+
"device_posture": ""
188+
}'
189+
```
190+
191+
</TabItem> </Tabs>
60192

61193
## Restrict access to private networks
62194

63195
Restrict access to resources which you have connected through [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/).
64196

65-
The following example consists of two policies: the first allows specific users to reach your application, and the second blocks all other traffic. Make sure that the Allow policy has higher priority (by positioning it towards the top of the list in the UI).
197+
The following example consists of two policies: the first allows specific users to reach your application, and the second blocks all other traffic.
66198

67199
### 1. Allow company employees
68200

201+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
202+
69203
| Selector | Operator | Value | Logic | Action |
70204
| -------------- | ------------- | ---------------- | ----- | ------ |
71205
| Destination IP | in | `10.0.0.0/8` | And | Allow |
72206
| User Email | matches regex | `.*@example.com` | | |
73207

208+
</TabItem>
209+
210+
<TabItem label="API">
211+
212+
```bash
213+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
214+
--header "Content-Type: application/json" \
215+
--header "Authorization: Bearer <API_TOKEN>" \
216+
--data '{
217+
"name": "Allow company employees",
218+
"description": "Allow any users with an organization email to reach the application",
219+
"enabled": true,
220+
"action": "allow",
221+
"filters": [
222+
"l4"
223+
],
224+
"traffic": "net.dst.ip in {10.0.0.0/8}",
225+
"identity": "identity.email matches \".*@example.com\"",
226+
"device_posture": ""
227+
}'
228+
```
229+
230+
</TabItem> </Tabs>
231+
74232
### 2. Block everyone else
75233

234+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
235+
76236
| Selector | Operator | Value | Action |
77237
| -------------- | -------- | ------------ | ------ |
78238
| Destination IP | in | `10.0.0.0/8` | Block |
239+
240+
</TabItem>
241+
242+
<TabItem label="API">
243+
244+
```bash
245+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
246+
--header "Content-Type: application/json" \
247+
--header "Authorization: Bearer <API_TOKEN>" \
248+
--data '{
249+
"name": "Block everyone else",
250+
"description": "Block any other users from accessing the application",
251+
"enabled": true,
252+
"action": "block",
253+
"filters": [
254+
"l4"
255+
],
256+
"traffic": "net.dst.ip in {10.0.0.0/8}",
257+
"identity": "",
258+
"device_posture": ""
259+
}'
260+
```
261+
262+
</TabItem> </Tabs>

‎src/content/partials/cloudflare-one/gateway/get-started/create-network-policy.mdx‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,13 @@ To create a new network policy:
1212
2. In the **Network** tab, select **Add a policy**.
1313
3. Name the policy.
1414
4. Under **Traffic**, build a logical expression that defines the traffic you want to allow or block.
15-
5. Choose an **Action** to take when traffic matches the logical expression.
15+
5. Choose an **Action** to take when traffic matches the logical expression. For example, you can use a list of [device serial numbers](/cloudflare-one/identity/devices/warp-client-checks/corp-device/) to ensure users can only access an application if they connect with the WARP client from a company device:
16+
1617
<Render
1718
file="gateway/policies/enforce-device-posture"
1819
product="cloudflare-one"
1920
/>
21+
2022
6. Select **Create policy**.
2123

2224
</TabItem>

‎src/content/partials/cloudflare-one/gateway/policies/enforce-device-posture.mdx‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,7 @@
22
{}
33
---
44

5-
For example, you can use a list of [device serial numbers](/cloudflare-one/identity/devices/warp-client-checks/corp-device/) to ensure users can only access an application if they connect with the WARP client from a company device:
6-
75
| Selector | Operator | Value | Logic | Action |
86
| ---------------------------- | -------- | ----------------------- | ----- | ------ |
9-
| SNI Domain | is | `internalapp.com` | And | Block |
7+
| SNI Domain | is | `example.com` | And | Block |
108
| Passed Device Posture Checks | not in | _Device serial numbers_ | | |

0 commit comments

Comments
 (0)