diff --git a/public/__redirects b/public/__redirects index 1aaf7d55bb5d017..fbc138ffab4905e 100644 --- a/public/__redirects +++ b/public/__redirects @@ -2386,6 +2386,8 @@ /cloudflare-one/identity/users/session-management/ /cloudflare-one/team-and-resources/users/session-management/ 301 /cloudflare-one/identity/users/seat-management/ /cloudflare-one/team-and-resources/users/seat-management/ 301 /cloudflare-one/identity/users/scim/ /cloudflare-one/team-and-resources/users/scim/ 301 +/cloudflare-one/applications/login-page/ /cloudflare-one/reusable-components/custom-pages/access-login-page/ 301 +/cloudflare-one/applications/block-page/ /cloudflare-one/reusable-components/custom-pages/access-block-page/ 301 /cloudflare-one/connections/connect-devices/* /cloudflare-one/team-and-resources/devices/:splat 301 /cloudflare-one/connections/connect-networks/* /cloudflare-one/networks/connectors/cloudflare-tunnel/:splat 301 /cloudflare-one/policies/gateway/* /cloudflare-one/traffic-policies/:splat 301 @@ -2397,6 +2399,7 @@ /cloudflare-one/identity/devices/service-providers/* /cloudflare-one/integrations/service-providers/:splat 301 /cloudflare-one/applications/configure-apps/* /cloudflare-one/access-controls/applications/http-apps/:splat 301 /cloudflare-one/applications/non-http/* /cloudflare-one/access-controls/applications/non-http/:splat 301 +/cloudflare-one/identity/devices/* /cloudflare-one/reusable-components/posture-checks/:splat 301 # Learning paths diff --git a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx index 4707624b1bd979b..0d65db2bebe9ca9 100644 --- a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx +++ b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx @@ -24,7 +24,7 @@ However, if you want to update the Minimum TLS settings for all wildcard hostnam ## Enable mTLS -Once you have [added a custom hostname](/cloudflare-for-platforms/cloudflare-for-saas/start/getting-started/), you can enable mTLS by using Cloudflare Access. Go to [Cloudflare Zero Trust](https://one.dash.cloudflare.com/) and [add mTLS authentication](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/) with a few clicks. +Once you have [added a custom hostname](/cloudflare-for-platforms/cloudflare-for-saas/start/getting-started/), you can enable mTLS by using Cloudflare Access. Go to [Cloudflare Zero Trust](https://one.dash.cloudflare.com/) and [add mTLS authentication](/cloudflare-one/reusable-components/posture-checks/access-integrations/mutual-tls-authentication/) with a few clicks. :::note Currently, you cannot add mTLS policies for custom hostnames using [API Shield](/api-shield/security/mtls/). diff --git a/src/content/docs/cloudflare-one/access-controls/applications/http-apps/mcp-servers/mcp-portals.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/mcp-servers/mcp-portals.mdx index 95d537ef3cf5dcb..13078aded81488e 100644 --- a/src/content/docs/cloudflare-one/access-controls/applications/http-apps/mcp-servers/mcp-portals.mdx +++ b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/mcp-servers/mcp-portals.mdx @@ -107,7 +107,7 @@ Cloudflare Access automatically creates an Access application for each MCP serve 3. To configure identity providers for the portal: 1. Select the **Login methods** tab. 2. Select the [identity providers](/cloudflare-one/integrations/identity-providers/) that you want to enable for your application. - 3. (Recommended) If you plan to only allow access via a single identity provider, turn on **Instant Auth**. End users will not be shown the [Cloudflare Access login page](/cloudflare-one/applications/login-page/). Instead, Cloudflare will redirect users directly to your SSO login event. + 3. (Recommended) If you plan to only allow access via a single identity provider, turn on **Instant Auth**. End users will not be shown the [Cloudflare Access login page](/cloudflare-one/reusable-components/custom-pages/access-login-page/). Instead, Cloudflare will redirect users directly to your SSO login event. 4. To customize the block page: 1. Select the **Experience settings** tab. 2. diff --git a/src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx b/src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx index 4fd00718078c34c..611a6d0e175b4b5 100644 --- a/src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx +++ b/src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx @@ -40,7 +40,7 @@ This feature replaces the legacy [private network app type](/cloudflare-one/acce 8. Configure how users will authenticate: 1. Select the [**Identity providers**](/cloudflare-one/integrations/identity-providers/) you want to enable for your application. - 2. (Recommended) If you plan to only allow access via a single IdP, turn on **Instant Auth**. End users will not be shown the [Cloudflare Access login page](/cloudflare-one/applications/login-page/). Instead, Cloudflare will redirect users directly to your SSO login event. + 2. (Recommended) If you plan to only allow access via a single IdP, turn on **Instant Auth**. End users will not be shown the [Cloudflare Access login page](/cloudflare-one/reusable-components/custom-pages/access-login-page/). Instead, Cloudflare will redirect users directly to your SSO login event. 3. (Recommended) Turn on **WARP authentication identity** to allow users to authenticate to the application using their [WARP session identity](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions/). We recommend turning this on if your application is not in the browser and cannot handle a `302` redirect. 9. Select **Next**. diff --git a/src/content/docs/cloudflare-one/access-controls/policies/index.mdx b/src/content/docs/cloudflare-one/access-controls/policies/index.mdx index 8b64dcf64e423f0..aa9b75a135331f5 100644 --- a/src/content/docs/cloudflare-one/access-controls/policies/index.mdx +++ b/src/content/docs/cloudflare-one/access-controls/policies/index.mdx @@ -152,7 +152,7 @@ Non-identity attributes are polled continuously, meaning they are-evaluated with | Identity provider group | Checks the user groups configured with your identity provider (IdP). This selector only displays if you use Microsoft Entra ID, GitHub, Google, Okta, or an IdP that provisions groups with [SCIM](/cloudflare-one/team-and-resources/users/scim/). | ✅ | ❌ | ✅ | | SAML Group | Checks a SAML attribute name / value pair. This selector only displays if you use a [generic SAML](/cloudflare-one/integrations/identity-providers/generic-saml/) identity provider. | ✅ | ❌ | ✅ | | OIDC Claim | Checks an OIDC claim name / value pair. This selector only displays if you use a [generic OIDC](/cloudflare-one/integrations/identity-providers/generic-oidc/) identity provider. | ✅ | ❌ | ✅ | -| Device posture | Checks [device posture signals](/cloudflare-one/identity/devices/) from the WARP client or a third-party service provider. | ✅ | ✅ | ❌ | +| Device posture | Checks [device posture signals](/cloudflare-one/reusable-components/posture-checks/) from the WARP client or a third-party service provider. | ✅ | ✅ | ❌ | | Warp | Checks that the device is connected to WARP, including the consumer version. | ✅ | ✅ | ❌ | | Gateway | Checks that the device is connected to your Zero Trust instance through the [WARP client](/cloudflare-one/team-and-resources/devices/warp/). | ✅ | ✅ | ❌ | diff --git a/src/content/docs/cloudflare-one/api-terraform/index.mdx b/src/content/docs/cloudflare-one/api-terraform/index.mdx index af1ac12afd7f9b0..e602b4e4cc29724 100644 --- a/src/content/docs/cloudflare-one/api-terraform/index.mdx +++ b/src/content/docs/cloudflare-one/api-terraform/index.mdx @@ -2,7 +2,7 @@ pcx_content_type: navigation title: API and Terraform sidebar: - order: 11 + order: 15 --- import { DirectoryListing, Render } from "~/components"; diff --git a/src/content/docs/cloudflare-one/applications/app-launcher.mdx b/src/content/docs/cloudflare-one/applications/app-launcher.mdx index ff9d3b3ce62328f..198993a48dee3ea 100644 --- a/src/content/docs/cloudflare-one/applications/app-launcher.mdx +++ b/src/content/docs/cloudflare-one/applications/app-launcher.mdx @@ -8,7 +8,3 @@ sidebar: import { Render } from "~/components"; - -## Tags - - diff --git a/src/content/docs/cloudflare-one/data-loss-prevention/dlp-policies/common-policies.mdx b/src/content/docs/cloudflare-one/data-loss-prevention/dlp-policies/common-policies.mdx index 8843f6f73c06698..6bf0a59db0953a3 100644 --- a/src/content/docs/cloudflare-one/data-loss-prevention/dlp-policies/common-policies.mdx +++ b/src/content/docs/cloudflare-one/data-loss-prevention/dlp-policies/common-policies.mdx @@ -41,7 +41,7 @@ You can configure access on a per-user or group basis by adding [identity-based Many Android applications (such as Google Drive) use certificate pinning, which is incompatible with Gateway inspection. If needed, you can create a [Do Not Inspect policy](/cloudflare-one/traffic-policies/http-policies/#do-not-inspect) so that the app can continue to function on Android: -1. Set up an [OS version device posture check](/cloudflare-one/identity/devices/warp-client-checks/os-version/) that checks for the Android operating system. +1. Set up an [OS version device posture check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/os-version/) that checks for the Android operating system. 2. Create the following HTTP policy in Gateway: diff --git a/src/content/docs/cloudflare-one/faq/policies-faq.mdx b/src/content/docs/cloudflare-one/faq/policies-faq.mdx index d4bdea3fda54536..09167dfae099836 100644 --- a/src/content/docs/cloudflare-one/faq/policies-faq.mdx +++ b/src/content/docs/cloudflare-one/faq/policies-faq.mdx @@ -59,7 +59,7 @@ If the domain is only blocked by a network policy, it may be because: ## When does Access return a Forbidden status page versus a login page? -Access returns a Forbidden page with status codes `401`/`403` when it determines there is no way a user can pass a [policy](/cloudflare-one/access-controls/policies/). If Cloudflare can make a full policy determination that a user will not be able to log in, Access will return a Forbidden page instead of a [login page](/cloudflare-one/applications/login-page/). +Access returns a Forbidden page with status codes `401`/`403` when it determines there is no way a user can pass a [policy](/cloudflare-one/access-controls/policies/). If Cloudflare can make a full policy determination that a user will not be able to log in, Access will return a Forbidden page instead of a [login page](/cloudflare-one/reusable-components/custom-pages/access-login-page/). For example, your application has a policy that requires a user to be in a [specific geolocation](/cloudflare-one/access-controls/policies/#allow) to log in. diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/index.mdx b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/index.mdx deleted file mode 100644 index e18c39e35c5d327..000000000000000 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/index.mdx +++ /dev/null @@ -1,33 +0,0 @@ ---- -pcx_content_type: navigation -title: WARP client checks -sidebar: - order: 1 - ---- - -These device posture checks are performed by the [Cloudflare WARP client](/cloudflare-one/team-and-resources/devices/warp/). To use this feature, you must [deploy the WARP client](/cloudflare-one/team-and-resources/devices/warp/deployment/) to your devices and enable the desired posture checks. - -## Supported WARP modes - -* Gateway with WARP -* Secure Web Gateway without DNS filtering -* Device Information Only - -## Supported operating systems - -| Device posture check | macOS | Windows | Linux | iOS | Android/ChromeOS | -| --------------------------------------------------------------------------------------------- | ----- | ------- | ----------- | --- | ---------------- | -| [Application check](/cloudflare-one/identity/devices/warp-client-checks/application-check/) | ✅ | ✅ | ✅ | ❌ | ❌ | -| [Carbon Black](/cloudflare-one/identity/devices/warp-client-checks/carbon-black/) | ✅ | ✅ | ✅ | ❌ | ❌ | -| [Client certificate](/cloudflare-one/identity/devices/warp-client-checks/client-certificate/) | ✅ | ✅ | ✅ | ❌ | ❌ | -| [Device serial numbers](/cloudflare-one/identity/devices/warp-client-checks/corp-device/) | ✅ | ✅ | ✅ | ❌ | ❌ | -| [Device UUID](/cloudflare-one/identity/devices/warp-client-checks/device-uuid/) | ❌ | ❌ | ❌ | ✅ | ✅ | -| [Disk encryption](/cloudflare-one/identity/devices/warp-client-checks/disk-encryption/) | ✅ | ✅ | ✅ | ❌ | ❌ | -| [Domain joined](/cloudflare-one/identity/devices/warp-client-checks/domain-joined/) | ❌ | ✅ | ❌ | ❌ | ❌ | -| [File check](/cloudflare-one/identity/devices/warp-client-checks/file-check/) | ✅ | ✅ | ✅ | ❌ | ❌ | -| [Firewall](/cloudflare-one/identity/devices/warp-client-checks/firewall/) | ✅ | ✅ | ❌ | ❌ | ❌ | -| [OS version](/cloudflare-one/identity/devices/warp-client-checks/os-version/) | ✅ | ✅ | ✅ | ✅ | ✅ | -| [Require Gateway](/cloudflare-one/identity/devices/warp-client-checks/require-gateway/) | ✅ | ✅ | ✅ | ✅ | ✅ | -| [Require WARP](/cloudflare-one/identity/devices/warp-client-checks/require-warp/) | ✅ | ✅ | ✅ | ✅ | ✅ | -| [SentinelOne](/cloudflare-one/identity/devices/warp-client-checks/sentinel-one/) | ✅ | ✅ | ✅ | ❌ | ❌ | diff --git a/src/content/docs/cloudflare-one/insights/logs/posture-logs.mdx b/src/content/docs/cloudflare-one/insights/logs/posture-logs.mdx index e9e0eebb15fd403..c6bf81eb36270d0 100644 --- a/src/content/docs/cloudflare-one/insights/logs/posture-logs.mdx +++ b/src/content/docs/cloudflare-one/insights/logs/posture-logs.mdx @@ -6,9 +6,9 @@ sidebar: --- -Posture logs show the [device posture check](/cloudflare-one/identity/devices/) results reported by the WARP client. +Posture logs show the [device posture check](/cloudflare-one/reusable-components/posture-checks/) results reported by the WARP client. -To view device posture logs, log in to [Zero Trust](https://one.dash.cloudflare.com/) and go to **Logs** > **Posture**. Logs will only display if you have configured [device posture checks](/cloudflare-one/identity/devices/) for your Zero Trust organization. +To view device posture logs, log in to [Zero Trust](https://one.dash.cloudflare.com/) and go to **Logs** > **Posture**. Logs will only display if you have configured [device posture checks](/cloudflare-one/reusable-components/posture-checks/) for your Zero Trust organization. Enterprise users can generate more detailed logs with [Logpush](/cloudflare-one/insights/logs/logpush/). @@ -36,8 +36,8 @@ Enterprise users can generate more detailed logs with [Logpush](/cloudflare-one/ | Field | Description | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| **Name** | Name of the [device posture check](/cloudflare-one/identity/devices). | -| **Type** | Type of [WARP client check](/cloudflare-one/identity/devices/warp-client-checks/) or [service provider check](/cloudflare-one/integrations/service-providers/). | +| **Name** | Name of the [device posture check](/cloudflare-one/reusable-components/posture-checks/). | +| **Type** | Type of [WARP client check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/) or [service provider check](/cloudflare-one/integrations/service-providers/). | | **Rule ID** | UUID of the device posture check. | | **Conditions met** | Whether the device passed or failed the posture check criteria. Evaluates to `true` if the **Received values** match the **Expected values**. | | **Expected values** | Values required to pass the device posture check. | diff --git a/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/grpc.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/grpc.mdx index 0e3021cf74a012f..86fed84f764c44f 100644 --- a/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/grpc.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/grpc.mdx @@ -46,7 +46,7 @@ To establish a secure, outbound-only connection to Cloudflare: ## 4. (Recommended) Create a Gateway policy -You can configure [Gateway network policies](/cloudflare-one/traffic-policies/network-policies/) to either block or allow access to the gRPC server. The following example consists of two policies: the first allows gRPC connections from devices that pass [device posture checks](/cloudflare-one/identity/devices/), and the second blocks all other traffic. Make sure that the Allow policy has higher [priority](/cloudflare-one/traffic-policies/order-of-enforcement/#order-of-precedence). +You can configure [Gateway network policies](/cloudflare-one/traffic-policies/network-policies/) to either block or allow access to the gRPC server. The following example consists of two policies: the first allows gRPC connections from devices that pass [device posture checks](/cloudflare-one/reusable-components/posture-checks/), and the second blocks all other traffic. Make sure that the Allow policy has higher [priority](/cloudflare-one/traffic-policies/order-of-enforcement/#order-of-precedence). ### 1. Allow secured devices diff --git a/src/content/docs/cloudflare-one/applications/block-page.mdx b/src/content/docs/cloudflare-one/reusable-components/custom-pages/access-block-page.mdx similarity index 76% rename from src/content/docs/cloudflare-one/applications/block-page.mdx rename to src/content/docs/cloudflare-one/reusable-components/custom-pages/access-block-page.mdx index 04753d0cd54d139..8e934fdb770ebc5 100644 --- a/src/content/docs/cloudflare-one/applications/block-page.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/custom-pages/access-block-page.mdx @@ -1,8 +1,8 @@ --- pcx_content_type: how-to -title: Block page +title: Access custom block pages sidebar: - order: 8 + order: 4 --- import { Render } from "~/components"; diff --git a/src/content/docs/cloudflare-one/applications/login-page.mdx b/src/content/docs/cloudflare-one/reusable-components/custom-pages/access-login-page.mdx similarity index 87% rename from src/content/docs/cloudflare-one/applications/login-page.mdx rename to src/content/docs/cloudflare-one/reusable-components/custom-pages/access-login-page.mdx index 75293d9d6b4f2da..b3dd915ac8e2516 100644 --- a/src/content/docs/cloudflare-one/applications/login-page.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/custom-pages/access-login-page.mdx @@ -1,8 +1,8 @@ --- pcx_content_type: how-to -title: Login page +title: Access login page sidebar: - order: 7 + order: 3 --- import { Render } from "~/components"; diff --git a/src/content/docs/cloudflare-one/reusable-components/custom-pages/index.mdx b/src/content/docs/cloudflare-one/reusable-components/custom-pages/index.mdx new file mode 100644 index 000000000000000..984ad5beb570a1c --- /dev/null +++ b/src/content/docs/cloudflare-one/reusable-components/custom-pages/index.mdx @@ -0,0 +1,12 @@ +--- +pcx_content_type: navigation +title: Custom pages +sidebar: + order: 4 + group: + hideIndex: true +--- + +import { DirectoryListing } from "~/components" + + diff --git a/src/content/docs/cloudflare-one/reusable-components/index.mdx b/src/content/docs/cloudflare-one/reusable-components/index.mdx new file mode 100644 index 000000000000000..f1a96ce7b781438 --- /dev/null +++ b/src/content/docs/cloudflare-one/reusable-components/index.mdx @@ -0,0 +1,12 @@ +--- +pcx_content_type: navigation +title: Reusable components +sidebar: + order: 11 + group: + hideIndex: true +--- + +import { DirectoryListing } from "~/components" + + diff --git a/src/content/docs/cloudflare-one/identity/devices/access-integrations/index.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/index.mdx similarity index 64% rename from src/content/docs/cloudflare-one/identity/devices/access-integrations/index.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/index.mdx index 25c6f1626349524..10cf48f23204c05 100644 --- a/src/content/docs/cloudflare-one/identity/devices/access-integrations/index.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/index.mdx @@ -10,5 +10,5 @@ These device posture checks can only be enforced for Cloudflare Access applicati | Device posture check | macOS | Windows | Linux | iOS | Android/ChromeOS | [WARP mode](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | | ----------------------------------------------------------------------------------------------- | ----- | ------- | ----- | --- | ---------------- | ---------------------------------------------------------------------------------------- | | [Microsoft Entra ID Conditional Access](/cloudflare-one/tutorials/entra-id-conditional-access/) | ✅ | ✅ | ❌ | ❌ | ❌ | WARP not required | -| [Mutual TLS](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/) | ✅ | ✅ | ✅ | ✅ | ✅ | WARP not required | -| [Tanium](/cloudflare-one/identity/devices/access-integrations/tanium/) | ✅ | ✅ | ✅ | ❌ | ❌ | Gateway with WARP, Secure Web Gateway without DNS filtering, or Device Information Only | +| [Mutual TLS](/cloudflare-one/reusable-components/posture-checks/access-integrations/mutual-tls-authentication/) | ✅ | ✅ | ✅ | ✅ | ✅ | WARP not required | +| [Tanium](/cloudflare-one/reusable-components/posture-checks/access-integrations/tanium/) | ✅ | ✅ | ✅ | ❌ | ❌ | Gateway with WARP, Secure Web Gateway without DNS filtering, or Device Information Only | diff --git a/src/content/docs/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/mutual-tls-authentication.mdx similarity index 100% rename from src/content/docs/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/mutual-tls-authentication.mdx diff --git a/src/content/docs/cloudflare-one/identity/devices/access-integrations/tanium.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/tanium.mdx similarity index 97% rename from src/content/docs/cloudflare-one/identity/devices/access-integrations/tanium.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/tanium.mdx index 26d6e6cdfde0a4b..79effb3c7130724 100644 --- a/src/content/docs/cloudflare-one/identity/devices/access-integrations/tanium.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/tanium.mdx @@ -30,7 +30,7 @@ The Tanium integration cannot be used with [Gateway device posture policies](/cl product="cloudflare-one" params={{ name: "Access integrations", - link: "/cloudflare-one/identity/devices/access-integrations/", + link: "/cloudflare-one/reusable-components/posture-checks/access-integrations/", }} /> diff --git a/src/content/docs/cloudflare-one/identity/devices/index.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/index.mdx similarity index 83% rename from src/content/docs/cloudflare-one/identity/devices/index.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/index.mdx index 282f70254dc6752..fa11fdc103506ea 100644 --- a/src/content/docs/cloudflare-one/identity/devices/index.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/index.mdx @@ -1,6 +1,6 @@ --- pcx_content_type: how-to -title: Device posture +title: Posture checks sidebar: order: 4 --- @@ -13,9 +13,9 @@ With Cloudflare Zero Trust, you can configure Zero Trust policies that rely on a Setup instructions and requirements vary depending on the device posture attribute. Refer to the links below to view the setup guide for your provider. -- [WARP client checks](/cloudflare-one/identity/devices/warp-client-checks/) are performed by the Cloudflare WARP client. +- [WARP client checks](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/) are performed by the Cloudflare WARP client. - [Service-to-service checks](/cloudflare-one/integrations/service-providers/) are performed by third-party device posture providers. -- [Access integration checks](/cloudflare-one/identity/devices/access-integrations/) are only configurable for Access applications. These attributes cannot be used in Gateway policies. +- [Access integration checks](/cloudflare-one/reusable-components/posture-checks/access-integrations/) are only configurable for Access applications. These attributes cannot be used in Gateway policies. ## 2. Verify device posture checks @@ -32,12 +32,12 @@ You can now use your device posture check in an [Access policy](/cloudflare-one/ :::caution[Gateway policy limitation] -Gateway does not support device posture checks for the [Tanium Access integration](/cloudflare-one/identity/devices/access-integrations/tanium/). +Gateway does not support device posture checks for the [Tanium Access integration](/cloudflare-one/reusable-components/posture-checks/access-integrations/tanium/). ::: ## 4. Ensure traffic is going through WARP -[WARP client](/cloudflare-one/identity/devices/warp-client-checks/) and [service-to-service](/cloudflare-one/integrations/service-providers/) posture checks rely on traffic going through WARP to detect posture information for a device. In your [Split Tunnel configuration](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/), ensure that the following domains are included in WARP: +[WARP client](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/) and [service-to-service](/cloudflare-one/integrations/service-providers/) posture checks rely on traffic going through WARP to detect posture information for a device. In your [Split Tunnel configuration](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/), ensure that the following domains are included in WARP: - The IdP used to authenticate to Cloudflare Zero Trust if posture check is part of an Access policy. - `.cloudflareaccess.com` if posture check is part of an Access policy. diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/application-check.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/application-check.mdx similarity index 98% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/application-check.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/application-check.mdx index 549bbf0accdaa8f..11ab319554c4c20 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/application-check.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/application-check.mdx @@ -16,7 +16,7 @@ The Application Check device posture attribute checks that a specific applicatio product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/carbon-black.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/carbon-black.mdx similarity index 95% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/carbon-black.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/carbon-black.mdx index 54d3eb34f622963..e6887f422692696 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/carbon-black.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/carbon-black.mdx @@ -17,7 +17,7 @@ Cloudflare Zero Trust can check if [Carbon Black](https://www.carbonblack.com/) product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/client-certificate.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/client-certificate.mdx similarity index 98% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/client-certificate.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/client-certificate.mdx index 10ec0e1b04c9de3..b9b4ec561cb8338 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/client-certificate.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/client-certificate.mdx @@ -44,7 +44,7 @@ The Client Certificate device posture attribute checks if the device has a valid :::note -To generate a sample root CA for testing, refer to [Generate mTLS certificates](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#generate-mtls-certificates). +To generate a sample root CA for testing, refer to [Generate mTLS certificates](/cloudflare-one/reusable-components/posture-checks/access-integrations/mutual-tls-authentication/#generate-mtls-certificates). ::: ## Configure the client certificate check @@ -73,9 +73,9 @@ To generate a sample root CA for testing, refer to [Generate mTLS certificates]( - User trust store
- + - System keychain - +
- NSSDB (`/etc/pki/nssdb`) - To search a custom location, enter the diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/corp-device.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/corp-device.mdx similarity index 93% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/corp-device.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/corp-device.mdx index 2259325be4ed178..31743a2e6f32735 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/corp-device.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/corp-device.mdx @@ -16,7 +16,7 @@ Cloudflare Zero Trust allows you to build Zero Trust rules based on device seria product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> @@ -71,4 +71,4 @@ You can use the following commands to check the serial number of your device. Th ### iOS, Android and ChromeOS -Serial number checks are not supported on mobile devices. You can identify mobile devices by a [unique client ID](/cloudflare-one/identity/devices/warp-client-checks/device-uuid) instead of by serial number. +Serial number checks are not supported on mobile devices. You can identify mobile devices by a [unique client ID](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/device-uuid) instead of by serial number. diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/device-uuid.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/device-uuid.mdx similarity index 91% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/device-uuid.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/device-uuid.mdx index 10b77ef0fe02e54..51182bcbf9604f7 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/device-uuid.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/device-uuid.mdx @@ -16,7 +16,7 @@ Cloudflare Zero Trust allows you to build Zero Trust rules based on device UUIDs product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> @@ -64,6 +64,6 @@ Hyphens are automatically stripped from UUIDs. For example, the posture check wi 5. Select **Save**. -6. [Verify](/cloudflare-one/identity/devices/#2-verify-device-posture-checks) that the posture check is returning the expected results. +6. [Verify](/cloudflare-one/reusable-components/posture-checks/#2-verify-device-posture-checks) that the posture check is returning the expected results. You can now create an Access or Gateway device posture policy that checks if the device presents a UUID on your list. diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/disk-encryption.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/disk-encryption.mdx similarity index 97% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/disk-encryption.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/disk-encryption.mdx index 264d257429e0820..73ce91ae1933203 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/disk-encryption.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/disk-encryption.mdx @@ -19,7 +19,7 @@ The Disk Encryption device posture attribute ensures that disks are encrypted on product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/domain-joined.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/domain-joined.mdx similarity index 94% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/domain-joined.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/domain-joined.mdx index a3b0651fe651017..406b8dada7c2c0d 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/domain-joined.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/domain-joined.mdx @@ -19,7 +19,7 @@ The Domain Joined device posture attribute ensures that a user is a member of a product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/file-check.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/file-check.mdx similarity index 67% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/file-check.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/file-check.mdx index 7b98f340a132d83..3a1f62ae76bea17 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/file-check.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/file-check.mdx @@ -16,7 +16,7 @@ The File Check device posture attribute checks for the presence of a file on a d product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> @@ -32,8 +32,8 @@ The File Check device posture attribute checks for the presence of a file on a d 1. **Name**: Enter a unique name for this device posture check. 2. **Operating system**: Select your operating system. 3. **File Path**: Enter a file path (for example, `c:\my folder\myfile.exe`). - 4. **Signing certificate thumbprint (recommended)**: Enter the [thumbprint](/cloudflare-one/identity/devices/warp-client-checks/application-check/#determine-the-signing-thumbprint) of the publishing certificate used to sign the file. Adding this information will enable the check to ensure that the file was signed by the expected software developer. - 5. **SHA-256 (optional)**: Enter the [SHA-256 value](/cloudflare-one/identity/devices/warp-client-checks/application-check/#determine-the-sha-256-value) of the file. This is used to ensure the integrity of the file on the device. + 4. **Signing certificate thumbprint (recommended)**: Enter the [thumbprint](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/application-check/#determine-the-signing-thumbprint) of the publishing certificate used to sign the file. Adding this information will enable the check to ensure that the file was signed by the expected software developer. + 5. **SHA-256 (optional)**: Enter the [SHA-256 value](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/application-check/#determine-the-sha-256-value) of the file. This is used to ensure the integrity of the file on the device. 5. Select **Save**. diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/firewall.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/firewall.mdx similarity index 95% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/firewall.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/firewall.mdx index 412a58c10b41178..537a2ff8f470a68 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/firewall.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/firewall.mdx @@ -19,7 +19,7 @@ The Firewall device posture attribute ensures that a firewall is running on a de product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/index.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/index.mdx new file mode 100644 index 000000000000000..4ebe78397f841b9 --- /dev/null +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/index.mdx @@ -0,0 +1,33 @@ +--- +pcx_content_type: navigation +title: WARP client checks +sidebar: + order: 1 + +--- + +These device posture checks are performed by the [Cloudflare WARP client](/cloudflare-one/team-and-resources/devices/warp/). To use this feature, you must [deploy the WARP client](/cloudflare-one/team-and-resources/devices/warp/deployment/) to your devices and enable the desired posture checks. + +## Supported WARP modes + +* Gateway with WARP +* Secure Web Gateway without DNS filtering +* Device Information Only + +## Supported operating systems + +| Device posture check | macOS | Windows | Linux | iOS | Android/ChromeOS | +| --------------------------------------------------------------------------------------------- | ----- | ------- | ----------- | --- | ---------------- | +| [Application check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/application-check/) | ✅ | ✅ | ✅ | ❌ | ❌ | +| [Carbon Black](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/carbon-black/) | ✅ | ✅ | ✅ | ❌ | ❌ | +| [Client certificate](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/client-certificate/) | ✅ | ✅ | ✅ | ❌ | ❌ | +| [Device serial numbers](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/corp-device/) | ✅ | ✅ | ✅ | ❌ | ❌ | +| [Device UUID](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/device-uuid/) | ❌ | ❌ | ❌ | ✅ | ✅ | +| [Disk encryption](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/disk-encryption/) | ✅ | ✅ | ✅ | ❌ | ❌ | +| [Domain joined](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/domain-joined/) | ❌ | ✅ | ❌ | ❌ | ❌ | +| [File check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/file-check/) | ✅ | ✅ | ✅ | ❌ | ❌ | +| [Firewall](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/firewall/) | ✅ | ✅ | ❌ | ❌ | ❌ | +| [OS version](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/os-version/) | ✅ | ✅ | ✅ | ✅ | ✅ | +| [Require Gateway](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-gateway/) | ✅ | ✅ | ✅ | ✅ | ✅ | +| [Require WARP](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-warp/) | ✅ | ✅ | ✅ | ✅ | ✅ | +| [SentinelOne](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/sentinel-one/) | ✅ | ✅ | ✅ | ❌ | ❌ | diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/os-version.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/os-version.mdx similarity index 98% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/os-version.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/os-version.mdx index b06664786244888..3c51d0691249ca5 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/os-version.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/os-version.mdx @@ -16,7 +16,7 @@ The OS Version device posture attribute checks whether the version of a device's product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/require-gateway.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-gateway.mdx similarity index 71% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/require-gateway.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-gateway.mdx index 0828e4ea9d74252..f75d69f5ae0ac61 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/require-gateway.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-gateway.mdx @@ -10,7 +10,7 @@ head: import { Render } from "~/components"; -With Require Gateway, you can allow access to your applications only to devices enrolled in your Zero Trust organization. Unlike [Require WARP](/cloudflare-one/identity/devices/warp-client-checks/require-warp/), which will check for any WARP instance (including the consumer version), Require Gateway will only allow requests coming from devices whose traffic is filtered by your organization's Cloudflare Gateway configuration. This policy is best used when you want to protect company-owned assets by only allowing access to employees. +With Require Gateway, you can allow access to your applications only to devices enrolled in your Zero Trust organization. Unlike [Require WARP](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-warp/), which will check for any WARP instance (including the consumer version), Require Gateway will only allow requests coming from devices whose traffic is filtered by your organization's Cloudflare Gateway configuration. This policy is best used when you want to protect company-owned assets by only allowing access to employees. ## Prerequisites @@ -19,7 +19,7 @@ With Require Gateway, you can allow access to your applications only to devices product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/require-warp.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-warp.mdx similarity index 94% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/require-warp.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-warp.mdx index 9b69e34f5638f6a..528533f4cc841a6 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/require-warp.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-warp.mdx @@ -25,7 +25,7 @@ Cloudflare Zero Trust enables you to restrict access to your applications to dev product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/sentinel-one.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/sentinel-one.mdx similarity index 96% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/sentinel-one.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/sentinel-one.mdx index 46e554f8445dff7..1a7ed0426d4b067 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/sentinel-one.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/sentinel-one.mdx @@ -20,7 +20,7 @@ Cloudflare Zero Trust can check if [SentinelOne](https://www.sentinelone.com/) i product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/reusable-components/tags.mdx b/src/content/docs/cloudflare-one/reusable-components/tags.mdx new file mode 100644 index 000000000000000..b9330837773c4f5 --- /dev/null +++ b/src/content/docs/cloudflare-one/reusable-components/tags.mdx @@ -0,0 +1,11 @@ +--- +pcx_content_type: how-to +title: Tags +sidebar: + order: 2 +--- + +import { Render } from "~/components"; + + + diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment.mdx index 6c010e49aeab9ea..d6dc9ae89a15a97 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment.mdx @@ -177,7 +177,7 @@ Windows offers two locations to install the certificate, each impacting which us The root certificate is now installed and ready to be used. :::caution -If your certificate is installed in the **Local Machine Store**, the [device posture check](/cloudflare-one/identity/devices/warp-client-checks/) looking for a certificate will fail. Install the certificate in the **Current User Store** to ensure a successful posture device check. +If your certificate is installed in the **Local Machine Store**, the [device posture check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/) looking for a certificate will fail. Install the certificate in the **Current User Store** to ensure a successful posture device check. ::: ### Linux diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles.mdx index 72895aee4bc6305..2386a5ddd2771f2 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles.mdx @@ -186,7 +186,7 @@ Apply a device profile based on the operating system of the device. ### Operating system version -Apply a device profile based on the [OS version](/cloudflare-one/identity/devices/warp-client-checks/os-version/#determine-the-os-version) of the device. +Apply a device profile based on the [OS version](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/os-version/#determine-the-os-version) of the device. | UI name | API example | | ------------------------ | ------------------------- | diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels.mdx index e4606ede02ef593..1d50b410a56b2ed 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels.mdx @@ -34,7 +34,7 @@ Do not exclude a site from Split Tunnels if you want to see the traffic in your ## Routes for Split Tunnels Include mode -Many Cloudflare Zero Trust services rely on traffic going through WARP, such as [device posture checks](/cloudflare-one/identity/devices/) and [WARP session durations](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions/). If you are using Split Tunnels in Include mode, you will need to manually add Cloudflare Zero Trust domains and IPs in order for these features to function. +Many Cloudflare Zero Trust services rely on traffic going through WARP, such as [device posture checks](/cloudflare-one/reusable-components/posture-checks/) and [WARP session durations](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions/). If you are using Split Tunnels in Include mode, you will need to manually add Cloudflare Zero Trust domains and IPs in order for these features to function. ### Cloudflare Zero Trust domains diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only.mdx index 999a426f216d7eb..248f5f382efe4a5 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only.mdx @@ -118,7 +118,7 @@ To block traffic from devices that do not have a valid client certificate: | Hostname | equals | `app.mycompany.com` | | | 5. Select **Deploy**. -Device Information Only mode is now enabled on the device. To start enforcing device posture, set up a [WARP client check](/cloudflare-one/identity/devices/warp-client-checks/) and add a _Require_ device posture rule to your [Access policy](/cloudflare-one/access-controls/policies/). When the device connects to the Access application for the first time, the browser will ask to use the client certificate installed by WARP. +Device Information Only mode is now enabled on the device. To start enforcing device posture, set up a [WARP client check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/) and add a _Require_ device posture rule to your [Access policy](/cloudflare-one/access-controls/policies/). When the device connects to the Access application for the first time, the browser will ask to use the client certificate installed by WARP. ![Browser prompts for client diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/index.mdx index 77251121c7822f4..e150a4c27761130 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/index.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/index.mdx @@ -56,7 +56,7 @@ Proxy mode is best suited for organizations that want to filter traffic directed ## Device Information Only -This mode is best suited for organizations that only want to enforce [WARP client device posture checks](/cloudflare-one/identity/devices/warp-client-checks/) for zones in your account. DNS, Network and HTTP traffic is handled by the default mechanisms on your devices. To setup Device Information Only mode, refer to the [dedicated page](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only/). +This mode is best suited for organizations that only want to enforce [WARP client device posture checks](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/) for zones in your account. DNS, Network and HTTP traffic is handled by the default mechanisms on your devices. To setup Device Information Only mode, refer to the [dedicated page](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only/). | DNS filtering | Network filtering | HTTP filtering | Features enabled | | ------------- | ----------------- | -------------- | ------------------------------------------------------------------------------------ | diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment.mdx index ae9274ac6959c5b..68cfd7796d22c46 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment.mdx @@ -29,7 +29,7 @@ You can verify which devices have enrolled by going to **My Team** > **Devices** ### Check for mTLS certificate -Enterprise customers can enforce [mutual TLS authentication](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/) during device enrollment. +Enterprise customers can enforce [mutual TLS authentication](/cloudflare-one/reusable-components/posture-checks/access-integrations/mutual-tls-authentication/) during device enrollment. diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters.mdx index 8101e6b762d74fd..2b80ba8951b1c4e 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters.mdx @@ -19,7 +19,7 @@ Most of the parameters listed below are also configurable in Zero Trust under ** ## Required for full Cloudflare Zero Trust features -For the majority of Cloudflare Zero Trust features to work, you need to specify a team name. Examples of Cloudflare Zero Trust features which depend on the team name are [HTTP policies](/cloudflare-one/traffic-policies/http-policies/), [Browser Isolation](/cloudflare-one/remote-browser-isolation/), and [device posture](/cloudflare-one/identity/devices/). +For the majority of Cloudflare Zero Trust features to work, you need to specify a team name. Examples of Cloudflare Zero Trust features which depend on the team name are [HTTP policies](/cloudflare-one/traffic-policies/http-policies/), [Browser Isolation](/cloudflare-one/remote-browser-isolation/), and [device posture](/cloudflare-one/reusable-components/posture-checks/). ### `organization` @@ -239,7 +239,7 @@ This parameter replaces the old `enabled` property, which can no longer be used Only valid for iOS and Android/ChromeOS. ::: -Assigns a unique identifier to the device for the [device UUID posture check](/cloudflare-one/identity/devices/warp-client-checks/device-uuid). +Assigns a unique identifier to the device for the [device UUID posture check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/device-uuid). **Value Type:** `string` diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/intune.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/intune.mdx index 27012438f3b7338..d56f385614e1a35 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/intune.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/intune.mdx @@ -325,7 +325,7 @@ By completing this step, you deliver the WARP client to targeted macOS devices, Refer to the [generic instructions for iOS](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/#ios). -Intune allows you to insert [predefined variables](https://learn.microsoft.com/en-us/mem/intune/apps/app-configuration-policies-use-ios#tokens-used-in-the-property-list) into the XML configuration file. For example, you can set the [`unique_client_id`](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/#unique_client_id) key to `{{deviceid}}` for a [device UUID posture check](/cloudflare-one/identity/devices/warp-client-checks/device-uuid/) deployment. +Intune allows you to insert [predefined variables](https://learn.microsoft.com/en-us/mem/intune/apps/app-configuration-policies-use-ios#tokens-used-in-the-property-list) into the XML configuration file. For example, you can set the [`unique_client_id`](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/#unique_client_id) key to `{{deviceid}}` for a [device UUID posture check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/device-uuid/) deployment. ### Per-app VPN for iOS diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/index.mdx index 368a9391dae2976..b83b538a6ea532f 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/index.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/index.mdx @@ -12,7 +12,7 @@ import { Render, Stream } from "~/components" ## About Cloudflare WARP -The Cloudflare WARP client allows you to protect corporate devices by securely and privately sending traffic from those devices to Cloudflare's global network, where [Cloudflare Gateway](/cloudflare-one/traffic-policies/) can apply advanced web filtering. The WARP client also makes it possible to apply advanced [Zero Trust policies](/cloudflare-one/identity/devices/) that check for a device's health before it connects to corporate applications. +The Cloudflare WARP client allows you to protect corporate devices by securely and privately sending traffic from those devices to Cloudflare's global network, where [Cloudflare Gateway](/cloudflare-one/traffic-policies/) can apply advanced web filtering. The WARP client also makes it possible to apply advanced [Zero Trust policies](/cloudflare-one/reusable-components/posture-checks/) that check for a device's health before it connects to corporate applications. ## How WARP works @@ -59,7 +59,7 @@ Deploying the WARP client significantly enhances your organization's security an - **Application and device-specific insights**: With WARP installed on your corporate devices, you can view detailed application and user-level activity on the [Zero Trust Shadow IT Discovery](/cloudflare-one/insights/analytics/shadow-it-discovery/) page, while also monitoring device and network performance with [Digital Experience Monitoring (DEX)](/cloudflare-one/insights/dex/) to proactively detect and resolve issues. -- **Device posture checks**: The WARP client provides advanced Zero Trust protection by making it possible to check for [device posture](/cloudflare-one/identity/devices/). By setting up device posture checks, you can build Zero Trust policies that check for a device's location, disk encryption status, OS version, and more. +- **Device posture checks**: The WARP client provides advanced Zero Trust protection by making it possible to check for [device posture](/cloudflare-one/reusable-components/posture-checks/). By setting up device posture checks, you can build Zero Trust policies that check for a device's location, disk encryption status, OS version, and more. - **Secure private and infrastructure access**: WARP lets devices connect to [private networks](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/) over Cloudflare Tunnel and is required for [Access for Infrastructure](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/), enabling secure SSH with short-lived certificates and detailed logging. diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs.mdx index 3845c1a0c3200f5..6599e971139e05a 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs.mdx @@ -113,7 +113,7 @@ The `warp-debugging-info--