You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide.mdx
+49-34Lines changed: 49 additions & 34 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,6 +15,17 @@ This guide helps you diagnose and resolve common issues with the Cloudflare WARP
15
15
4.**Fix common misconfigurations**: [Profile mismatch](#wrong-profile-id), [split tunnel issues](#wrong-split-tunnel-configuration), [managed network issues](#review-your-managed-network-settings), [user group mismatch](#check-a-users-group-membership).
16
16
5.**File a support ticket**: [How to file a ticket](#5-file-a-support-ticket) after you have exhausted your troubleshooting options.
17
17
18
+
:::note[AI-assisted troubleshooting]
19
+
20
+
Cloudflare One includes two free AI helpers to speed up WARP investigations:
21
+
22
+
[**WARP Diagnostics Analyzer**](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/#warp-diagnostics-analyzer-beta) - Uses AI to parse a device’s WARP diagnostic log and summarizes key events, likely causes, and recommended next steps in a concise summary. This analyzer is available for logs collected via the dashboard.
23
+
24
+
25
+
[**DEX MCP server**](/cloudflare-one/insights/dex/dex-mcp-server/) — An AI tool that allows customers to ask a question like, "Show me the connectivity and performance metrics for the device used by carly@acme.com", and receive an answer that contains data from the DEX API.
26
+
27
+
:::
28
+
18
29
## 1. Before you start
19
30
20
31
### Prerequisites
@@ -29,21 +40,19 @@ Many troubleshooting issues are caused by outdated client versions. For the best
29
40
30
41
After updating the WARP client, monitor the issue to see if it recurs. If the issue persists, continue with the troubleshooting guide.
31
42
32
-
:::tip[Check the device's WARP version]
33
-
34
-
Via the device:
43
+
#### Via the device
35
44
36
45
1. Open the WARP GUI on the desktop.
37
46
2. Select the gear icon.
38
47
3. Select **About WARP**.
48
+
4. Compare your device's version with the [latest version of WARP](/cloudflare-one/connections/connect-devices/warp/download-warp/).
39
49
40
-
Via the Zero Trust dashboard:
50
+
#### Via the Zero Trust dashboard
41
51
42
52
1. Log into [Zero Trust](https://one.dash.cloudflare.com/) > go to **My Team** > **Devices**.
43
53
2. Select the device you want to investigate.
44
54
3. Find the device's WARP version under **Client version** in the side menu.
45
-
46
-
:::
55
+
4. Compare your device's version with the [latest version of WARP](/cloudflare-one/connections/connect-devices/warp/download-warp/).
47
56
48
57
### WARP basics
49
58
@@ -86,15 +95,15 @@ You can collect diagnostic logs in two ways: the [Cloudflare dashboard](#option-
86
95
87
96
Collect WARP diagnostic logs remotely from the Zero Trust dashboard by using Digital Experience Monitoring's (DEX) remote captures.
88
97
89
-
#### Start a remote capture
90
-
91
98
:::tip[Best practice]
92
99
93
100
To troubleshoot effectively, Cloudflare recommends reproducing the issue and noting your timestamps immediately before collecting logs. Though recreating the issue may not be possible in all cases, reproducing the issue right before WARP diag collection or during the window that a packet capture (PCAP) is running will help you troubleshoot with greater visibility.
94
101
95
102
Refer to [WARP log retention window](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/#log-retention-window) to learn more.
96
103
:::
97
104
105
+
#### Start a remote capture
106
+
98
107
<Render
99
108
file="dex/pcaps-run"
100
109
product="cloudflare-one"
@@ -114,6 +123,20 @@ Refer to [WARP log retention window](/cloudflare-one/connections/connect-devices
114
123
115
124
After you have your diagnostic files, go to [Review key files](/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide/#3-review-key-files) to continue troubleshooting.
116
125
126
+
:::tip[AI-assisted troubleshooting]
127
+
128
+
The [WARP Diagnostics Analyzer](/cloudflare-one/connections/connect-devices/warp/troubleshooting/warp-logs/#warp-diagnostics-analyzer-beta) uses AI to parse a device’s WARP diagnostic log and summarizes key events, likely causes, and recommended next steps in a concise summary.
129
+
130
+
After you run a [DEX remote capture](#option-a-collect-logs-via-the-cloudflare-dashboard) for WARP diagnostics:
131
+
132
+
1. Go to **DEX** > **Remote captures**.
133
+
2. Find your capture in the list of captures.
134
+
3. Select the three-dot icon next to **Status** > select **View WARP Diag** to generate an AI summary.
135
+
136
+
This analyzer is available for logs collected via the dashboard.
137
+
138
+
:::
139
+
117
140
### Option B: Collect logs via the CLI
118
141
119
142
Collect WARP diagnostic logs on your desktop using the `warp-diag` CLI.
@@ -247,7 +270,7 @@ Exclude mode, with hosts/ips:
247
270
cname.user.net
248
271
```
249
272
250
-
:::tip[Exclude mode versus Include mode]
273
+
:::note[Exclude mode versus Include mode]
251
274
`Exclude mode` means all traffic will be sent through the WARP tunnel except for the IPs and domains you specify.
252
275
253
276
`Include mode` means only traffic destined to the IPs or domains you specify will be sent through the WARP tunnel.
@@ -314,20 +337,6 @@ To verify that WARP is configured and working properly, review the following:
314
337
315
338
A profile ID is a unique identifier assigned to each [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) in the Zero Trust dashboard, used to determine which configuration settings apply to a device.
316
339
317
-
If your organization has multiple device profiles defined in the Zero Trust dashboard, a device may be matched to an unexpected profile because:
318
-
319
-
1. How profile precedence is configured.
320
-
321
-
:::note[WARP evaluates profile IDs in the order they appear in the dashboard]
3. User group [mismatch](#check-a-users-group-membership).
329
-
4. Lack of [precise match rules](#edit-your-device-profile-match-rules).
330
-
331
340
#### Check the applied device profile
332
341
333
342
To check that the applied device profile is the intended device profile:
@@ -336,19 +345,19 @@ To check that the applied device profile is the intended device profile:
336
345
2. Find and select the device profile intended for the device.
337
346
3. Under **Profile details**, compare the displayed **Profile ID** with the `Profile ID` in the `warp-settings.txt` file.
338
347
339
-
If the profile ID displayed in the `warp-settings.txt` file does not match the intended device profile's ID shown in the dashboard:
348
+
If your organization has multiple device profiles defined in the Zero Trust dashboard, a device may be matched to an unexpected profile because:
340
349
341
-
1. If you are using a managed network, review your [managed network settings](/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide/#review-your-managed-network-settings) for common errors.
342
-
2.[Edit your device profile's match rules](/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide/#edit-your-device-profile-match-rules) in the intended profile to make them more specific (for example, by adding identity-based [selectors](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/#selectors) like [`email`](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/#user-email), or [`group name`](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/#user-group-names).)
350
+
- How [profile precedence](#review-profile-precedence) is configured.
351
+
-[Managed network](#review-your-managed-network-settings) issues (if you are using a managed network.)
352
+
- User group [mismatch](#check-a-users-group-membership).
353
+
- Lack of [precise match rules](#edit-your-device-profile-match-rules).
343
354
344
-
:::caution
345
-
Avoid [reordering profiles](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/#order-of-precedence) unless you are confident it will not affect other users.
346
-
:::
355
+
#### Review profile precedence
347
356
348
-
:::note
349
-
350
-
Identity-based selectors are only available if the user [enrolled the device](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) by logging in to an identity provider (IdP).
Avoid [reordering profiles](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/#order-of-precedence) unless you are confident it will not affect other users.
352
361
:::
353
362
354
363
#### Review your managed network settings
@@ -398,6 +407,12 @@ To modify the match rules of a device profile, you will need to edit the device
Identity-based selectors are only available if the user [enrolled the device](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) by logging in to an identity provider (IdP).
@@ -412,7 +427,7 @@ After downloading the WARP diagnostic logs, review that your configuration is wo
412
427
413
428
1. Open the `warp-settings.txt` file and find `Exclude mode, with hosts/ips:` or `Include mode, with hosts/ips:`.
414
429
415
-
:::tip[Exclude mode versus Include mode]
430
+
:::note[Exclude mode versus Include mode]
416
431
`Exclude mode` means all traffic will be sent through the WARP tunnel except for the IPs and domains you specify.
417
432
418
433
`Include mode` means only traffic destined to the IPs or domains you specify will be sent through the WARP tunnel.
@@ -438,7 +453,7 @@ Both methods update the client with the latest configuration.
438
453
439
454
On the end user device, open the WARP GUI and toggle WARP on and off.
440
455
441
-
:::tip[What if the end user cannot turn off WARP?]
456
+
:::note[What if the end user cannot turn off WARP?]
442
457
If the end user's [WARP switch](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#lock-warp-switch) is locked, they will need an [admin override code](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#admin-override) to be able to toggle the WARP switch.
443
458
444
459
[Resetting the encryption keys](#option-b-reset-the-encryption-keys) may be a faster solution.
0 commit comments