Skip to content

[Gateway] Overlapping hostnames #23437

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Jul 9, 2025
Merged

[Gateway] Overlapping hostnames #23437

Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
3fd45b3
Add overlapping hostnames section
maxvp Jul 3, 2025
ca99d37
Add precedence info
maxvp Jul 8, 2025
ea358f2
Reorder
maxvp Jul 8, 2025
7576386
Clarify action taken
maxvp Jul 8, 2025
a763d41
Clarify overlap
maxvp Jul 8, 2025
3608018
Apply feedback
maxvp Jul 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/content/docs/cloudflare-one/policies/gateway/application-app-types.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,12 @@ Gateway sorts applications into the following app type groups:

## Usage

### Overlapping hostnames

When you use the Application selector in Gateway policies, actions taken by Gateway will be limited to the specific application defined. Gateway may also log other applications that use the same hostnames, but it will not take action unless the application was matched by the policy. Overlapping hostnames are most common for vendors with many applications, such as Google or Meta. For example, both the Facebook and Facebook Messenger apps use the `chat-e2ee.facebook.com` hostname. When evaluating traffic to the Facebook Messenger app, Gateway will only take action on Facebook Messenger traffic but log both the Facebook and Facebook Messenger apps.

To ensure Gateway evaluates traffic with your desired precedence, order your most specific policies with the highest priority according to [order of precedence](/cloudflare-one/policies/gateway/order-of-enforcement/#priority-within-a-policy-builder).

### Do Not Inspect applications

Gateway automatically groups applications incompatible with TLS decryption into the _Do Not Inspect_ app type. As Cloudflare identifies incompatible applications, Gateway will periodically update this app type to add new applications. To ensure Gateway does not intercept any current or future incompatible traffic, you can [create a Do Not Inspect HTTP policy](/cloudflare-one/policies/gateway/http-policies/#do-not-inspect) with the entire _Do Not Inspect_ app type selected.
Expand Down
Loading