Skip to content

[CF1] gateway posture checks note #20995

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Mar 21, 2025
Merged

[CF1] gateway posture checks note #20995

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bcb8e83
[CF1] gateway posture checks note
deadlypants1973 Mar 20, 2025
3c165fa
Update src/content/docs/cloudflare-one/identity/devices/index.mdx
deadlypants1973 Mar 21, 2025
fa76b05
Update src/content/docs/cloudflare-one/identity/devices/index.mdx
deadlypants1973 Mar 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions src/content/docs/cloudflare-one/identity/devices/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,14 @@ C --5 min--> E[Cache] --> F[Gateway policy]
A --> G[Service provider] --interval--> C
```

:::caution

Gateway does not terminate an active session, even if a subsequent posture check fails during that session. Gateway only evaluates posture checks at the beginnning of a session, and ongoing sessions will remain uninterrupted.
Copy link
Contributor

@ranbel ranbel Mar 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What counts as an "active Gateway session"?

Copy link
Contributor

@ranbel ranbel Mar 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We currently have WARP session durations https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions/
and Access session durations https://developers.cloudflare.com/cloudflare-one/identity/users/session-management/

Copy link
Contributor

@kkrum kkrum Mar 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's the same "Active connections are not terminated" note that is included here: https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-sessions/#limitations

That same product behavior applies to policies subject to a posture rule whose result changes mid "Active Connection".


For example, if you establish an SSH session based on a successful posture check, but a posture requirement fails after the session has started, the session will remain active.

:::

### Expiration

By default, the posture result on Cloudflare remains valid until it is overwritten by new data. You can specify an `expiration` time using our [API](/api/resources/zero_trust/subresources/devices/subresources/posture/methods/update/). We recommend setting the expiration to be longer than the [polling frequency](#polling-frequency).
Expand Down