Skip to content

Commit db0f6b3

Browse files
deadlypants1973deadlypants1973
committed
updates
1 parent 7dfd991 commit db0f6b3

File tree

3 files changed

+223
-84
lines changed

3 files changed

+223
-84
lines changed

‎src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles.mdx‎

Lines changed: 73 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -35,86 +35,73 @@ Your profile will appear in the **Profile settings** list. You can rearrange the
3535
Send a `POST` request to the [Devices API](/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/methods/create/):
3636

3737
<APIRequest
38-
path="/accounts/{account_id}/devices/policy"
39-
method="POST"
40-
json={{
41-
"allow_mode_switch": false,
42-
"allow_updates": false,
43-
"allowed_to_leave": false,
44-
"auto_connect": 600,
45-
"captive_portal": 180,
46-
"description": "Example device profile recommended in the implementation documentation. For details, refer to https://developers.cloudflare.com/learning-paths/replace-vpn/configure-device-agent/device-profiles/",
47-
"disable_auto_fallback": true,
48-
"enabled": true,
49-
"exclude_office_ips": false,
50-
"match": "identity.email in {\"[email protected]\"} or any(identity.groups.name[*] in {\"developers\" \"admin\"}) and os.name == \"windows\"",
51-
"name": "Example device profile",
52-
"precedence": 101,
53-
"service_mode_v2": {
54-
"mode": "warp"
38+
path="/accounts/{account_id}/devices/policy"
39+
method="POST"
40+
json={{
41+
allow_mode_switch: false,
42+
allow_updates: false,
43+
allowed_to_leave: false,
44+
auto_connect: 600,
45+
captive_portal: 180,
46+
description:
47+
"Example device profile recommended in the implementation documentation. For details, refer to https://developers.cloudflare.com/learning-paths/replace-vpn/configure-device-agent/device-profiles/",
48+
disable_auto_fallback: true,
49+
enabled: true,
50+
exclude_office_ips: false,
51+
match:
52+
'identity.email in {"[email protected]"} or any(identity.groups.name[*] in {"developers" "admin"}) and os.name == "windows"',
53+
name: "Example device profile",
54+
precedence: 101,
55+
service_mode_v2: {
56+
mode: "warp",
5557
},
56-
"support_url": "https://support.example.com",
57-
"switch_locked": true
58-
}}
58+
support_url: "https://support.example.com",
59+
switch_locked: true,
60+
}}
5961
/>
6062

6163
</TabItem>
6264
<TabItem label="Terraform (v5)">
6365

6466
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
65-
- `Zero Trust Write`
67+
- `Zero Trust Write`
6668

6769
2. Create a new profile using the [`cloudflare_zero_trust_device_custom_profile`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_device_custom_profile) resource:
6870

69-
```tf
70-
resource "cloudflare_zero_trust_device_custom_profile" "example" {
71-
account_id = var.cloudflare_account_id
72-
name = "Example device profile"
73-
description = "Example device profile recommended in the implementation documentation. For details, refer to https://developers.cloudflare.com/learning-paths/replace-vpn/configure-device-agent/device-profiles/"
74-
allow_mode_switch = false
75-
allow_updates = false
76-
allowed_to_leave = false
77-
auto_connect = 600
78-
captive_portal = 180
79-
disable_auto_fallback = true
80-
enabled = true
81-
exclude_office_ips = false
82-
precedence = 101
83-
service_mode_v2 = {mode = "warp"}
84-
support_url = "https://support.example.com"
85-
switch_locked = true
86-
tunnel_protocol = "wireguard"
87-
88-
match = trimspace(replace(<<-EOT
89-
identity.email in {"[email protected]"}
90-
or any(identity.groups.name[*] in {"developers" "admin"})
91-
and os.name == "windows"
92-
EOT
93-
, "\n", " "))
94-
}
95-
```
71+
```tf
72+
resource "cloudflare_zero_trust_device_custom_profile" "example" {
73+
account_id = var.cloudflare_account_id
74+
name = "Example device profile"
75+
description = "Example device profile recommended in the implementation documentation. For details, refer to https://developers.cloudflare.com/learning-paths/replace-vpn/configure-device-agent/device-profiles/"
76+
allow_mode_switch = false
77+
allow_updates = false
78+
allowed_to_leave = false
79+
auto_connect = 600
80+
captive_portal = 180
81+
disable_auto_fallback = true
82+
enabled = true
83+
exclude_office_ips = false
84+
precedence = 101
85+
service_mode_v2 = {mode = "warp"}
86+
support_url = "https://support.example.com"
87+
switch_locked = true
88+
tunnel_protocol = "wireguard"
89+
90+
match = trimspace(replace(<<-EOT
91+
identity.email in {"[email protected]"}
92+
or any(identity.groups.name[*] in {"developers" "admin"})
93+
and os.name == "windows"
94+
EOT
95+
, "\n", " "))
96+
}
97+
```
9698

9799
</TabItem>
98100
</Tabs>
99101

100102
## Edit profile settings
101103

102-
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **WARP Client**.
103-
2. In the **Profile settings** card, find the profile you want to update and select **Configure**.
104-
3. Modify [WARP settings](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#device-settings) for this profile.
105-
:::note
106-
107-
Changing any of the settings below will cause the WARP connection to restart. The user may experience a brief period of connectivity loss while the new settings are being applied.
108-
109-
- [Service mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#service-mode)
110-
- [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#local-domain-fallback)
111-
- [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#split-tunnels)
112-
113-
:::
114-
115-
4. Select **Save profile**.
116-
117-
<Render file="warp/client-notification-lag" product="cloudflare-one" />
104+
<Render file="warp/edit-profile-settings" />
118105

119106
## Verify device profile
120107

@@ -136,50 +123,59 @@ You can configure device profiles to match against the following selectors, or c
136123

137124
Apply a device profile based on the user's email.
138125

139-
<Render file="gateway/selectors/user-email" params={{ UIname: "User email" }}/>
126+
<Render file="gateway/selectors/user-email" params={{ UIname: "User email" }} />
140127

141128
### User group emails
142129

143130
Apply a device profile based on an [IdP group](/cloudflare-one/policies/gateway/identity-selectors/#idp-groups-in-gateway) email address of which the user is configured as a member in the IdP.
144131

145-
<Render file="gateway/selectors/user-group-email" params={{ UIname: "User group emails" }}/>
132+
<Render
133+
file="gateway/selectors/user-group-email"
134+
params={{ UIname: "User group emails" }}
135+
/>
146136

147137
### User group IDs
148138

149139
Apply a device profile based on an [IdP group](/cloudflare-one/policies/gateway/identity-selectors/#idp-groups-in-gateway) ID of which the user is configured as a member in the IdP.
150140

151-
<Render file="gateway/selectors/user-group-ids" params={{ UIname: "User group IDs" }}/>
141+
<Render
142+
file="gateway/selectors/user-group-ids"
143+
params={{ UIname: "User group IDs" }}
144+
/>
152145

153146
### User group names
154147

155148
Apply a device profile based on an [IdP group](/cloudflare-one/policies/gateway/identity-selectors/#idp-groups-in-gateway) name of which the user is configured as a member in the IdP.
156149

157-
<Render file="gateway/selectors/user-group-names" params={{ UIname: "User group names" }}/>
150+
<Render
151+
file="gateway/selectors/user-group-names"
152+
params={{ UIname: "User group names" }}
153+
/>
158154

159155
### Operating system
160156

161157
Apply a device profile based on the operating system of the device.
162158

163-
| UI name | API example |
164-
| --------------- | ------------------------------------------------- |
159+
| UI name | API example |
160+
| ---------------- | ---------------------------------- |
165161
| Operating system | `os.name in {\"windows\" \"mac\"}` |
166162

167163
### Operating system version
168164

169165
Apply a device profile based on the [OS version](/cloudflare-one/identity/devices/warp-client-checks/os-version/#determine-the-os-version) of the device.
170166

171-
| UI name | API example |
172-
| --------------- | ------------------------------------------------- |
167+
| UI name | API example |
168+
| ------------------------ | ------------------------- |
173169
| Operating system version | `os.version == \"1.2.0\"` |
174170

175-
<Render file="warp/os-version-semver" />
171+
<Render file="warp/os-version-semver" />
176172

177173
### Managed network
178174

179175
Apply a device profile based on the [managed network](/cloudflare-one/connections/connect-devices/warp/configure-warp/managed-networks/) that the device is connected to.
180176

181-
| UI name | API example |
182-
| --------------- | ------------------------------------------------- |
177+
| UI name | API example |
178+
| --------------- | ------------------------------ |
183179
| Managed network | `network == \"Austin office\"` |
184180

185181
### SAML attributes
@@ -192,8 +188,8 @@ Apply a device profile based on an attribute name and value from a [SAML IdP](/c
192188

193189
Apply a device profile based on the [service token](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#check-for-service-token) used to enroll the device.
194190

195-
| UI name | API example |
196-
| --------------- | ------------------------------------------------- |
191+
| UI name | API example |
192+
| ------------- | ------------------------------------------------------------------------- |
197193
| Service Token | `identity.service_token_uuid == \"f174e90a-fafe-4643-bbbc-4a0ed4fc8415\"` |
198194

199195
## Comparison operators

‎src/content/docs/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide.mdx‎

Lines changed: 129 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -185,11 +185,11 @@ Open the `warp-status.txt` file to review the WARP client settings, split tunnel
185185

186186
#### Example `warp-settings.txt` file
187187

188-
Review the following `warp-settings.txt` file and the descriptions of its content.
188+
Review the following `warp-settings.txt` file and the descriptions of its content below.
189189

190190
```txt
191191
Merged configuration:
192-
(derived) Always On: true # Current state of the WARP toggle on the GUI
192+
(derived) Always On: true
193193
(network policy) Switch Locked: false # If false, does not allows the user to [turn off the WARP switch](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#lock-warp-switch) and disconnect the client.
194194
(network policy) Mode: WarpWithDnsOverHttps <-- This is WARP with Gateway mode
195195
(network policy) WARP tunnel protocol: WireGuard
@@ -228,12 +228,134 @@ The command `warp-cli settings` will generate the same information in your devic
228228

229229
#### Contents of `warp-settings.txt` file
230230

231-
- `Always On`
231+
Review the meanings of the fields in `warp-settings.txt` that are relevant to troubleshooting.
232232

233-
This
233+
##### Always On
234234

235-
### Common misconfiguration issues
235+
Refers to the current state of the WARP toggle in the GUI. In the example file, the WARP toggle is switched on.
236236

237-
#### Wrong profile ID
237+
```txt
238+
Always On: true
239+
```
240+
241+
##### Switch Locked
242+
243+
Refers to the [Lock WARP Switch](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#lock-warp-switch) which allows the user to turn off the WARP switch and disconnect the client. In the example file, the value is `false` meaning the user is able to turn the WARP switch on or off at their discretion.
244+
245+
```txt
246+
Switch Locked: false
247+
```
248+
249+
When the Lock WARP switch is enabled (`true`), users will need an [Admin override](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#admin-override) code to temporarily turn off WARP on their device.
250+
251+
##### Mode
252+
253+
Refers to the [WARP mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) the device is using. In the example file, the WARP mode is `WarpWithDnsOverHttps` which is Gateway with WARP mode. Refer to the [WARP modes comparison matrix](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/) to match your `warp-settings.txt` file's value with the mode name.
254+
255+
```txt
256+
Mode: WarpWithDnsOverHttps
257+
```
258+
259+
##### Exclude mode, with hosts/ips
260+
261+
Refers to your [split tunnel](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) settings. In the example file, WARP is running in Exclude mode, meaning all traffic except for the traffic destined for these hosts and IPs will be sent through the WARP tunnel. The host `cname.user.net` and the IP `1xx.1xx.1xx.1xx/25 ` are both excluded from the WARP tunnel.
262+
263+
```txt
264+
Exclude mode, with hosts/ips:
265+
1xx.1xx.1xx.1xx/25 (zoom)
266+
...
267+
cname.user.net
268+
```
269+
270+
##### Fallback domains
271+
272+
Refers to your [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/) settings. In the example file, WARP lists `intranet` as a domain that will not be sent to Gateway for proccessing and will instead be sent directly to the configured fallback servers.
273+
274+
```txt
275+
(network policy) Fallback domains:
276+
intranet
277+
...
278+
```
279+
280+
##### Allow Mode Switch
281+
282+
Refers to the [Mode switch](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#mode-switch) setting. In the example file, the mode switch is enabled (`true`) which means the user has the option to switch between [Gateway with WARP](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-warp-default) mode and [Gateway with DoH](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-doh) mode.
283+
284+
```txt
285+
Allow Mode Switch: true
286+
```
287+
288+
##### Allow Updates
289+
290+
Refers to the [Allow updates](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#allow-updates) setting. In the example file, the allow updates setting is set to `false` meaning the user will not receive update notifications when a new version of the WARP client is available and cannot update WARP without administrator approval.
291+
292+
```txt
293+
Allow Updates: false
294+
```
295+
296+
##### Allowed to Leave Org
297+
298+
Refers to the [Allow device to leave organization](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#allow-device-to-leave-organization) setting. In the example file, the value is set to `true` meaning the user can log out from your Zero Trust organization.
299+
300+
```txt
301+
Allowed to Leave Org: true
302+
```
303+
304+
##### LAN Access Settings
305+
306+
Refers to the [Allow users to enable local network exclusion](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#allow-users-to-enable-local-network-exclusion) setting. When enabled, it allows users to temporarily access local devices (like printers) by excluding the detected local subnet from the WARP tunnel. This example indicates access is allowed until the next WARP reconnection, and only for subnets up to /24.
307+
308+
```txt
309+
LAN Access Settings: Allowed until reconnect on a /24 subnet
310+
```
311+
312+
##### Profile ID
313+
314+
Refers to the [Device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) a device is using. In this example, the ID is `000000x1-00x1-1xx0-1xx1-11101x1axx11` which can be cross-referenced in the dashboard by going to **Zero Trust** > **My team** > **Devices** > selecting a device name and reviewing the **Device ID** under **Basic Information**.
315+
316+
```txt
317+
Profile ID: 000000x1-00x1-1xx0-1xx1-11101x1axx11
318+
```
319+
320+
## Common misconfiguration issues and solutions
321+
322+
Use the following list to help identify and troubleshoot common WARP configuration problems.
323+
324+
- [Wrong profile ID](/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide/#edit-your-device-profile-match-rules)
325+
- [Wrong split tunnel configuration](/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide/#wrong-split-tunnel-configuration)
326+
327+
### Wrong profile ID
328+
329+
If your organization has multiple device profiles defined in the Zero Trust dashboard, a device may be matched to an unexpected profile due to lack of precide matcing rules or how profile precedence is configured. Device profiles are evaluated top to bottom based on their order in the UI, and the first matching profile is applied.
330+
331+
To debug a possibly misconfigured device profile, you must:
332+
333+
1. [Check](/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide/#check-the-applied-device-profile) that the applied device profile is correct.
334+
2. If the applied device profile is incorrect, you must then [edit your device profile](/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide/#edit-your-device-profile-match-rules) for more precise rule matching.
335+
3. If the device profile is correct but you are still having issues, note this and move onto another possible WARP misconfiguraton to continue troubleshooting.
336+
337+
#### Check the applied device profile
338+
339+
To check that the applied device profile is the intended device profile:
340+
341+
1. Go to [Zero Trust](https://one.dash.cloudflare.com/) > **Settings** > **WARP Client**.
342+
2. Find and select the device profile intended for the device.
343+
3. Under **Profile details** compare the Profile ID with the value found in the `warp-settings.txt` file.
344+
345+
If the profile ID does not match the intended device profile, avoid [reordering profiles](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/#order-of-precedence) unless you are confident it will not affect other users.
346+
347+
Instead, [modify the match rules](/cloudflare-one/connections/connect-devices/warp/troubleshooting/troubleshooting-guide/#edit-your-device-profile-match-rules) in the intended profile to make them more specific (for example, by adding identity-based [selectors](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/#selectors) like [`email`](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/#user-email), or [`group name`](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/#user-group-names).)
348+
349+
:::note
350+
351+
Identity-based selectors are only available if the user [enrolled the device](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) by logging in to an identity provider (IdP).
352+
353+
:::
354+
355+
#### Edit your device profile match rules
356+
357+
To modify the match rules of a device profile, you will need to edit the device profile. To edit the device profile:
358+
359+
<Render file="warp/edit-profile-settings" />
238360

239-
#### Wrong split tunnel configuration
361+
### Wrong split tunnel configuration

‎src/content/partials/cloudflare-one/warp/edit-profile-settings.mdx‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
{}
3+
---
4+
5+
import { Render } from "~/components";
6+
7+
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **WARP Client**.
8+
2. In the **Profile settings** card, find the profile you want to update and select **Configure**.
9+
3. Use [selectors](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/#selectors) to add or adjust match rules, and modify [WARP settings](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#device-settings) for this profile as needed.
10+
:::note
11+
12+
Changing any of the settings below will cause the WARP connection to restart. The user may experience a brief period of connectivity loss while the new settings are being applied.
13+
- [Service mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#service-mode)
14+
- [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#local-domain-fallback)
15+
- [Split Tunnels](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#split-tunnels)
16+
17+
:::
18+
19+
4. Select **Save profile**.
20+
21+
<Render file="warp/client-notification-lag" product="cloudflare-one" />

0 commit comments

Comments
 (0)