From 9ca6f127ba692f0c13d5aa7ab60097934e7d71cf Mon Sep 17 00:00:00 2001 From: Ranbel Sun Date: Thu, 23 Oct 2025 16:16:21 -0400 Subject: [PATCH 1/8] new folder --- .../docs/cloudflare-one/api-terraform/index.mdx | 2 +- .../cloudflare-one/reusable-components/index.mdx | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 src/content/docs/cloudflare-one/reusable-components/index.mdx diff --git a/src/content/docs/cloudflare-one/api-terraform/index.mdx b/src/content/docs/cloudflare-one/api-terraform/index.mdx index af1ac12afd7f9b..e602b4e4cc2972 100644 --- a/src/content/docs/cloudflare-one/api-terraform/index.mdx +++ b/src/content/docs/cloudflare-one/api-terraform/index.mdx @@ -2,7 +2,7 @@ pcx_content_type: navigation title: API and Terraform sidebar: - order: 11 + order: 15 --- import { DirectoryListing, Render } from "~/components"; diff --git a/src/content/docs/cloudflare-one/reusable-components/index.mdx b/src/content/docs/cloudflare-one/reusable-components/index.mdx new file mode 100644 index 00000000000000..f1a96ce7b78143 --- /dev/null +++ b/src/content/docs/cloudflare-one/reusable-components/index.mdx @@ -0,0 +1,12 @@ +--- +pcx_content_type: navigation +title: Reusable components +sidebar: + order: 11 + group: + hideIndex: true +--- + +import { DirectoryListing } from "~/components" + + From bc1bbdc2fd9572366fb26a7c1272e2d43e57ae2b Mon Sep 17 00:00:00 2001 From: Ranbel Sun Date: Thu, 23 Oct 2025 16:19:46 -0400 Subject: [PATCH 2/8] move posture checks --- public/__redirects | 1 + .../certificate-management/enforce-mtls.mdx | 2 +- .../access-controls/policies/index.mdx | 2 +- .../dlp-policies/common-policies.mdx | 2 +- .../devices/warp-client-checks/index.mdx | 33 ------------------- .../insights/logs/posture-logs.mdx | 6 ++-- .../cloudflare-tunnel/use-cases/grpc.mdx | 2 +- .../access-integrations/index.mdx | 4 +-- .../mutual-tls-authentication.mdx | 2 +- .../access-integrations/tanium.mdx | 2 +- .../posture-checks}/index.mdx | 10 +++--- .../warp-client-checks/application-check.mdx | 2 +- .../warp-client-checks/carbon-black.mdx | 2 +- .../warp-client-checks/client-certificate.mdx | 6 ++-- .../warp-client-checks/corp-device.mdx | 4 +-- .../warp-client-checks/device-uuid.mdx | 4 +-- .../warp-client-checks/disk-encryption.mdx | 2 +- .../warp-client-checks/domain-joined.mdx | 2 +- .../warp-client-checks/file-check.mdx | 6 ++-- .../warp-client-checks/firewall.mdx | 2 +- .../warp-client-checks/index.mdx | 33 +++++++++++++++++++ .../warp-client-checks/os-version.mdx | 2 +- .../warp-client-checks/require-gateway.mdx | 4 +-- .../warp-client-checks/require-warp.mdx | 2 +- .../warp-client-checks/sentinel-one.mdx | 2 +- .../manual-deployment.mdx | 2 +- .../warp/configure-warp/device-profiles.mdx | 2 +- .../route-traffic/split-tunnels.mdx | 2 +- .../warp-modes/device-information-only.mdx | 2 +- .../warp/configure-warp/warp-modes/index.mdx | 2 +- .../warp/deployment/device-enrollment.mdx | 2 +- .../deployment/mdm-deployment/parameters.mdx | 4 +-- .../mdm-deployment/partners/intune.mdx | 2 +- .../team-and-resources/devices/warp/index.mdx | 4 +-- .../warp/troubleshooting/warp-logs.mdx | 2 +- .../http-policies/common-policies.mdx | 6 ++-- .../traffic-policies/identity-selectors.mdx | 2 +- .../network-policies/common-policies.mdx | 2 +- .../tutorials/extend-sso-with-workers.mdx | 4 +-- .../tutorials/m365-dedicated-egress-ips.mdx | 2 +- .../tutorials/mysql-network-policy.mdx | 2 +- .../isolate-application.mdx | 2 +- .../mtls/concepts/mtls-cloudflare.mdx | 4 +-- .../mtls/mtls-cloudflare-access/index.mdx | 12 +++---- .../build-policies/policy-design.mdx | 4 +-- .../recommended-network-policies.mdx | 2 +- .../zero-trust/cloudflare-gateway.mdx | 4 +-- .../architectures/sase.mdx | 20 +++++------ .../designing-ztna-access-policies.mdx | 4 +-- .../design-guides/network-vpn-migration.mdx | 2 +- .../design-guides/zero-trust-for-saas.mdx | 8 ++--- .../sase/augment-access-with-serverless.mdx | 2 +- .../docs/ssl/client-certificates/byo-ca.mdx | 2 +- ...onfigure-your-mobile-app-or-iot-device.mdx | 2 +- .../docs/ssl/client-certificates/index.mdx | 2 +- .../client-certificates/zero-trust-mtls.mdx | 2 +- src/content/docs/ssl/troubleshooting/faq.mdx | 2 +- .../3rd-party-integration-guide.mdx | 2 +- ...tent-management-systems-like-wordpress.mdx | 2 +- src/content/notifications/index.yaml | 4 +-- .../get-started/create-network-policy.mdx | 4 +-- .../network/enforce-device-posture.mdx | 2 +- .../gateway/selectors/device-posture.mdx | 2 +- .../posture/configure-posture-check.mdx | 2 +- .../tunnel/troubleshoot-private-networks.mdx | 2 +- .../warp/device-enrollment-mtls.mdx | 4 +-- .../account-permissions-table.mdx | 8 ++--- .../device-enrollment-permissions.mdx | 2 +- .../warp-releases/linux/ga/2024.6.497.0.yaml | 2 +- .../warp-releases/linux/ga/2025.5.893.0.yaml | 2 +- .../warp-releases/macos/ga/2023.9.252.0.yaml | 2 +- .../warp-releases/macos/ga/2024.6.416.0.yaml | 2 +- .../warp-releases/macos/ga/2024.9.346.0.yaml | 2 +- .../warp-releases/macos/ga/2025.5.893.0.yaml | 2 +- .../windows/beta/2025.5.735.1.yaml | 2 +- .../windows/ga/2023.9.248.0.yaml | 2 +- .../windows/ga/2024.6.415.0.yaml | 2 +- .../windows/ga/2025.5.893.0.yaml | 2 +- 78 files changed, 155 insertions(+), 154 deletions(-) delete mode 100644 src/content/docs/cloudflare-one/identity/devices/warp-client-checks/index.mdx rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/access-integrations/index.mdx (64%) rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/access-integrations/mutual-tls-authentication.mdx (99%) rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/access-integrations/tanium.mdx (97%) rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/index.mdx (83%) rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/warp-client-checks/application-check.mdx (98%) rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/warp-client-checks/carbon-black.mdx (95%) rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/warp-client-checks/client-certificate.mdx (98%) rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/warp-client-checks/corp-device.mdx (93%) rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/warp-client-checks/device-uuid.mdx (91%) rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/warp-client-checks/disk-encryption.mdx (97%) rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/warp-client-checks/domain-joined.mdx (94%) rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/warp-client-checks/file-check.mdx (67%) rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/warp-client-checks/firewall.mdx (95%) create mode 100644 src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/index.mdx rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/warp-client-checks/os-version.mdx (98%) rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/warp-client-checks/require-gateway.mdx (71%) rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/warp-client-checks/require-warp.mdx (94%) rename src/content/docs/cloudflare-one/{identity/devices => reusable-components/posture-checks}/warp-client-checks/sentinel-one.mdx (96%) diff --git a/public/__redirects b/public/__redirects index 1aaf7d55bb5d01..dfa7e8a78fbe7f 100644 --- a/public/__redirects +++ b/public/__redirects @@ -2397,6 +2397,7 @@ /cloudflare-one/identity/devices/service-providers/* /cloudflare-one/integrations/service-providers/:splat 301 /cloudflare-one/applications/configure-apps/* /cloudflare-one/access-controls/applications/http-apps/:splat 301 /cloudflare-one/applications/non-http/* /cloudflare-one/access-controls/applications/non-http/:splat 301 +/cloudflare-one/identity/devices/* /cloudflare-one/reusable-components/posture-checks/:splat 301 # Learning paths diff --git a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx index 4707624b1bd979..0d65db2bebe9ca 100644 --- a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx +++ b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx @@ -24,7 +24,7 @@ However, if you want to update the Minimum TLS settings for all wildcard hostnam ## Enable mTLS -Once you have [added a custom hostname](/cloudflare-for-platforms/cloudflare-for-saas/start/getting-started/), you can enable mTLS by using Cloudflare Access. Go to [Cloudflare Zero Trust](https://one.dash.cloudflare.com/) and [add mTLS authentication](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/) with a few clicks. +Once you have [added a custom hostname](/cloudflare-for-platforms/cloudflare-for-saas/start/getting-started/), you can enable mTLS by using Cloudflare Access. Go to [Cloudflare Zero Trust](https://one.dash.cloudflare.com/) and [add mTLS authentication](/cloudflare-one/reusable-components/posture-checks/access-integrations/mutual-tls-authentication/) with a few clicks. :::note Currently, you cannot add mTLS policies for custom hostnames using [API Shield](/api-shield/security/mtls/). diff --git a/src/content/docs/cloudflare-one/access-controls/policies/index.mdx b/src/content/docs/cloudflare-one/access-controls/policies/index.mdx index 8b64dcf64e423f..aa9b75a135331f 100644 --- a/src/content/docs/cloudflare-one/access-controls/policies/index.mdx +++ b/src/content/docs/cloudflare-one/access-controls/policies/index.mdx @@ -152,7 +152,7 @@ Non-identity attributes are polled continuously, meaning they are-evaluated with | Identity provider group | Checks the user groups configured with your identity provider (IdP). This selector only displays if you use Microsoft Entra ID, GitHub, Google, Okta, or an IdP that provisions groups with [SCIM](/cloudflare-one/team-and-resources/users/scim/). | ✅ | ❌ | ✅ | | SAML Group | Checks a SAML attribute name / value pair. This selector only displays if you use a [generic SAML](/cloudflare-one/integrations/identity-providers/generic-saml/) identity provider. | ✅ | ❌ | ✅ | | OIDC Claim | Checks an OIDC claim name / value pair. This selector only displays if you use a [generic OIDC](/cloudflare-one/integrations/identity-providers/generic-oidc/) identity provider. | ✅ | ❌ | ✅ | -| Device posture | Checks [device posture signals](/cloudflare-one/identity/devices/) from the WARP client or a third-party service provider. | ✅ | ✅ | ❌ | +| Device posture | Checks [device posture signals](/cloudflare-one/reusable-components/posture-checks/) from the WARP client or a third-party service provider. | ✅ | ✅ | ❌ | | Warp | Checks that the device is connected to WARP, including the consumer version. | ✅ | ✅ | ❌ | | Gateway | Checks that the device is connected to your Zero Trust instance through the [WARP client](/cloudflare-one/team-and-resources/devices/warp/). | ✅ | ✅ | ❌ | diff --git a/src/content/docs/cloudflare-one/data-loss-prevention/dlp-policies/common-policies.mdx b/src/content/docs/cloudflare-one/data-loss-prevention/dlp-policies/common-policies.mdx index 8843f6f73c0669..6bf0a59db0953a 100644 --- a/src/content/docs/cloudflare-one/data-loss-prevention/dlp-policies/common-policies.mdx +++ b/src/content/docs/cloudflare-one/data-loss-prevention/dlp-policies/common-policies.mdx @@ -41,7 +41,7 @@ You can configure access on a per-user or group basis by adding [identity-based Many Android applications (such as Google Drive) use certificate pinning, which is incompatible with Gateway inspection. If needed, you can create a [Do Not Inspect policy](/cloudflare-one/traffic-policies/http-policies/#do-not-inspect) so that the app can continue to function on Android: -1. Set up an [OS version device posture check](/cloudflare-one/identity/devices/warp-client-checks/os-version/) that checks for the Android operating system. +1. Set up an [OS version device posture check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/os-version/) that checks for the Android operating system. 2. Create the following HTTP policy in Gateway: diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/index.mdx b/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/index.mdx deleted file mode 100644 index e18c39e35c5d32..00000000000000 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/index.mdx +++ /dev/null @@ -1,33 +0,0 @@ ---- -pcx_content_type: navigation -title: WARP client checks -sidebar: - order: 1 - ---- - -These device posture checks are performed by the [Cloudflare WARP client](/cloudflare-one/team-and-resources/devices/warp/). To use this feature, you must [deploy the WARP client](/cloudflare-one/team-and-resources/devices/warp/deployment/) to your devices and enable the desired posture checks. - -## Supported WARP modes - -* Gateway with WARP -* Secure Web Gateway without DNS filtering -* Device Information Only - -## Supported operating systems - -| Device posture check | macOS | Windows | Linux | iOS | Android/ChromeOS | -| --------------------------------------------------------------------------------------------- | ----- | ------- | ----------- | --- | ---------------- | -| [Application check](/cloudflare-one/identity/devices/warp-client-checks/application-check/) | ✅ | ✅ | ✅ | ❌ | ❌ | -| [Carbon Black](/cloudflare-one/identity/devices/warp-client-checks/carbon-black/) | ✅ | ✅ | ✅ | ❌ | ❌ | -| [Client certificate](/cloudflare-one/identity/devices/warp-client-checks/client-certificate/) | ✅ | ✅ | ✅ | ❌ | ❌ | -| [Device serial numbers](/cloudflare-one/identity/devices/warp-client-checks/corp-device/) | ✅ | ✅ | ✅ | ❌ | ❌ | -| [Device UUID](/cloudflare-one/identity/devices/warp-client-checks/device-uuid/) | ❌ | ❌ | ❌ | ✅ | ✅ | -| [Disk encryption](/cloudflare-one/identity/devices/warp-client-checks/disk-encryption/) | ✅ | ✅ | ✅ | ❌ | ❌ | -| [Domain joined](/cloudflare-one/identity/devices/warp-client-checks/domain-joined/) | ❌ | ✅ | ❌ | ❌ | ❌ | -| [File check](/cloudflare-one/identity/devices/warp-client-checks/file-check/) | ✅ | ✅ | ✅ | ❌ | ❌ | -| [Firewall](/cloudflare-one/identity/devices/warp-client-checks/firewall/) | ✅ | ✅ | ❌ | ❌ | ❌ | -| [OS version](/cloudflare-one/identity/devices/warp-client-checks/os-version/) | ✅ | ✅ | ✅ | ✅ | ✅ | -| [Require Gateway](/cloudflare-one/identity/devices/warp-client-checks/require-gateway/) | ✅ | ✅ | ✅ | ✅ | ✅ | -| [Require WARP](/cloudflare-one/identity/devices/warp-client-checks/require-warp/) | ✅ | ✅ | ✅ | ✅ | ✅ | -| [SentinelOne](/cloudflare-one/identity/devices/warp-client-checks/sentinel-one/) | ✅ | ✅ | ✅ | ❌ | ❌ | diff --git a/src/content/docs/cloudflare-one/insights/logs/posture-logs.mdx b/src/content/docs/cloudflare-one/insights/logs/posture-logs.mdx index e9e0eebb15fd40..f44618f0e832c6 100644 --- a/src/content/docs/cloudflare-one/insights/logs/posture-logs.mdx +++ b/src/content/docs/cloudflare-one/insights/logs/posture-logs.mdx @@ -6,9 +6,9 @@ sidebar: --- -Posture logs show the [device posture check](/cloudflare-one/identity/devices/) results reported by the WARP client. +Posture logs show the [device posture check](/cloudflare-one/reusable-components/posture-checks/) results reported by the WARP client. -To view device posture logs, log in to [Zero Trust](https://one.dash.cloudflare.com/) and go to **Logs** > **Posture**. Logs will only display if you have configured [device posture checks](/cloudflare-one/identity/devices/) for your Zero Trust organization. +To view device posture logs, log in to [Zero Trust](https://one.dash.cloudflare.com/) and go to **Logs** > **Posture**. Logs will only display if you have configured [device posture checks](/cloudflare-one/reusable-components/posture-checks/) for your Zero Trust organization. Enterprise users can generate more detailed logs with [Logpush](/cloudflare-one/insights/logs/logpush/). @@ -37,7 +37,7 @@ Enterprise users can generate more detailed logs with [Logpush](/cloudflare-one/ | Field | Description | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Name** | Name of the [device posture check](/cloudflare-one/identity/devices). | -| **Type** | Type of [WARP client check](/cloudflare-one/identity/devices/warp-client-checks/) or [service provider check](/cloudflare-one/integrations/service-providers/). | +| **Type** | Type of [WARP client check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/) or [service provider check](/cloudflare-one/integrations/service-providers/). | | **Rule ID** | UUID of the device posture check. | | **Conditions met** | Whether the device passed or failed the posture check criteria. Evaluates to `true` if the **Received values** match the **Expected values**. | | **Expected values** | Values required to pass the device posture check. | diff --git a/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/grpc.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/grpc.mdx index 0e3021cf74a012..86fed84f764c44 100644 --- a/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/grpc.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/grpc.mdx @@ -46,7 +46,7 @@ To establish a secure, outbound-only connection to Cloudflare: ## 4. (Recommended) Create a Gateway policy -You can configure [Gateway network policies](/cloudflare-one/traffic-policies/network-policies/) to either block or allow access to the gRPC server. The following example consists of two policies: the first allows gRPC connections from devices that pass [device posture checks](/cloudflare-one/identity/devices/), and the second blocks all other traffic. Make sure that the Allow policy has higher [priority](/cloudflare-one/traffic-policies/order-of-enforcement/#order-of-precedence). +You can configure [Gateway network policies](/cloudflare-one/traffic-policies/network-policies/) to either block or allow access to the gRPC server. The following example consists of two policies: the first allows gRPC connections from devices that pass [device posture checks](/cloudflare-one/reusable-components/posture-checks/), and the second blocks all other traffic. Make sure that the Allow policy has higher [priority](/cloudflare-one/traffic-policies/order-of-enforcement/#order-of-precedence). ### 1. Allow secured devices diff --git a/src/content/docs/cloudflare-one/identity/devices/access-integrations/index.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/index.mdx similarity index 64% rename from src/content/docs/cloudflare-one/identity/devices/access-integrations/index.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/index.mdx index 25c6f162634952..10cf48f23204c0 100644 --- a/src/content/docs/cloudflare-one/identity/devices/access-integrations/index.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/index.mdx @@ -10,5 +10,5 @@ These device posture checks can only be enforced for Cloudflare Access applicati | Device posture check | macOS | Windows | Linux | iOS | Android/ChromeOS | [WARP mode](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | | ----------------------------------------------------------------------------------------------- | ----- | ------- | ----- | --- | ---------------- | ---------------------------------------------------------------------------------------- | | [Microsoft Entra ID Conditional Access](/cloudflare-one/tutorials/entra-id-conditional-access/) | ✅ | ✅ | ❌ | ❌ | ❌ | WARP not required | -| [Mutual TLS](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/) | ✅ | ✅ | ✅ | ✅ | ✅ | WARP not required | -| [Tanium](/cloudflare-one/identity/devices/access-integrations/tanium/) | ✅ | ✅ | ✅ | ❌ | ❌ | Gateway with WARP, Secure Web Gateway without DNS filtering, or Device Information Only | +| [Mutual TLS](/cloudflare-one/reusable-components/posture-checks/access-integrations/mutual-tls-authentication/) | ✅ | ✅ | ✅ | ✅ | ✅ | WARP not required | +| [Tanium](/cloudflare-one/reusable-components/posture-checks/access-integrations/tanium/) | ✅ | ✅ | ✅ | ❌ | ❌ | Gateway with WARP, Secure Web Gateway without DNS filtering, or Device Information Only | diff --git a/src/content/docs/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/mutual-tls-authentication.mdx similarity index 99% rename from src/content/docs/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/mutual-tls-authentication.mdx index 4d0bd8cba33c37..bdec082f5ee58a 100644 --- a/src/content/docs/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/mutual-tls-authentication.mdx @@ -15,7 +15,7 @@ Only available on Enterprise plans. With a root certificate authority (CA) in place, Access only allows requests from devices with a corresponding client certificate. When a request reaches the application, Access responds with a request for the client to present a certificate. If the device fails to present the certificate, the request is not allowed to proceed. If the client does have a certificate, Access completes a key exchange to verify. -![mTLS handshake diagram](~/assets/images/cloudflare-one/identity/devices/mtls.png) +![mTLS handshake diagram](~/assets/images/cloudflare-one/reusable-components/posture-checks/mtls.png) :::caution[Important] diff --git a/src/content/docs/cloudflare-one/identity/devices/access-integrations/tanium.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/tanium.mdx similarity index 97% rename from src/content/docs/cloudflare-one/identity/devices/access-integrations/tanium.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/tanium.mdx index 26d6e6cdfde0a4..79effb3c713072 100644 --- a/src/content/docs/cloudflare-one/identity/devices/access-integrations/tanium.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/access-integrations/tanium.mdx @@ -30,7 +30,7 @@ The Tanium integration cannot be used with [Gateway device posture policies](/cl product="cloudflare-one" params={{ name: "Access integrations", - link: "/cloudflare-one/identity/devices/access-integrations/", + link: "/cloudflare-one/reusable-components/posture-checks/access-integrations/", }} /> diff --git a/src/content/docs/cloudflare-one/identity/devices/index.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/index.mdx similarity index 83% rename from src/content/docs/cloudflare-one/identity/devices/index.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/index.mdx index 282f70254dc675..fa11fdc103506e 100644 --- a/src/content/docs/cloudflare-one/identity/devices/index.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/index.mdx @@ -1,6 +1,6 @@ --- pcx_content_type: how-to -title: Device posture +title: Posture checks sidebar: order: 4 --- @@ -13,9 +13,9 @@ With Cloudflare Zero Trust, you can configure Zero Trust policies that rely on a Setup instructions and requirements vary depending on the device posture attribute. Refer to the links below to view the setup guide for your provider. -- [WARP client checks](/cloudflare-one/identity/devices/warp-client-checks/) are performed by the Cloudflare WARP client. +- [WARP client checks](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/) are performed by the Cloudflare WARP client. - [Service-to-service checks](/cloudflare-one/integrations/service-providers/) are performed by third-party device posture providers. -- [Access integration checks](/cloudflare-one/identity/devices/access-integrations/) are only configurable for Access applications. These attributes cannot be used in Gateway policies. +- [Access integration checks](/cloudflare-one/reusable-components/posture-checks/access-integrations/) are only configurable for Access applications. These attributes cannot be used in Gateway policies. ## 2. Verify device posture checks @@ -32,12 +32,12 @@ You can now use your device posture check in an [Access policy](/cloudflare-one/ :::caution[Gateway policy limitation] -Gateway does not support device posture checks for the [Tanium Access integration](/cloudflare-one/identity/devices/access-integrations/tanium/). +Gateway does not support device posture checks for the [Tanium Access integration](/cloudflare-one/reusable-components/posture-checks/access-integrations/tanium/). ::: ## 4. Ensure traffic is going through WARP -[WARP client](/cloudflare-one/identity/devices/warp-client-checks/) and [service-to-service](/cloudflare-one/integrations/service-providers/) posture checks rely on traffic going through WARP to detect posture information for a device. In your [Split Tunnel configuration](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/), ensure that the following domains are included in WARP: +[WARP client](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/) and [service-to-service](/cloudflare-one/integrations/service-providers/) posture checks rely on traffic going through WARP to detect posture information for a device. In your [Split Tunnel configuration](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels/), ensure that the following domains are included in WARP: - The IdP used to authenticate to Cloudflare Zero Trust if posture check is part of an Access policy. - `.cloudflareaccess.com` if posture check is part of an Access policy. diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/application-check.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/application-check.mdx similarity index 98% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/application-check.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/application-check.mdx index 549bbf0accdaa8..11ab319554c4c2 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/application-check.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/application-check.mdx @@ -16,7 +16,7 @@ The Application Check device posture attribute checks that a specific applicatio product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/carbon-black.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/carbon-black.mdx similarity index 95% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/carbon-black.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/carbon-black.mdx index 54d3eb34f62296..e6887f42269269 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/carbon-black.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/carbon-black.mdx @@ -17,7 +17,7 @@ Cloudflare Zero Trust can check if [Carbon Black](https://www.carbonblack.com/) product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/client-certificate.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/client-certificate.mdx similarity index 98% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/client-certificate.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/client-certificate.mdx index 10ec0e1b04c9de..b9b4ec561cb833 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/client-certificate.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/client-certificate.mdx @@ -44,7 +44,7 @@ The Client Certificate device posture attribute checks if the device has a valid :::note -To generate a sample root CA for testing, refer to [Generate mTLS certificates](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#generate-mtls-certificates). +To generate a sample root CA for testing, refer to [Generate mTLS certificates](/cloudflare-one/reusable-components/posture-checks/access-integrations/mutual-tls-authentication/#generate-mtls-certificates). ::: ## Configure the client certificate check @@ -73,9 +73,9 @@ To generate a sample root CA for testing, refer to [Generate mTLS certificates]( - User trust store
- + - System keychain - +
- NSSDB (`/etc/pki/nssdb`) - To search a custom location, enter the diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/corp-device.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/corp-device.mdx similarity index 93% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/corp-device.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/corp-device.mdx index 2259325be4ed17..31743a2e6f3273 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/corp-device.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/corp-device.mdx @@ -16,7 +16,7 @@ Cloudflare Zero Trust allows you to build Zero Trust rules based on device seria product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> @@ -71,4 +71,4 @@ You can use the following commands to check the serial number of your device. Th ### iOS, Android and ChromeOS -Serial number checks are not supported on mobile devices. You can identify mobile devices by a [unique client ID](/cloudflare-one/identity/devices/warp-client-checks/device-uuid) instead of by serial number. +Serial number checks are not supported on mobile devices. You can identify mobile devices by a [unique client ID](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/device-uuid) instead of by serial number. diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/device-uuid.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/device-uuid.mdx similarity index 91% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/device-uuid.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/device-uuid.mdx index 10b77ef0fe02e5..51182bcbf9604f 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/device-uuid.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/device-uuid.mdx @@ -16,7 +16,7 @@ Cloudflare Zero Trust allows you to build Zero Trust rules based on device UUIDs product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> @@ -64,6 +64,6 @@ Hyphens are automatically stripped from UUIDs. For example, the posture check wi 5. Select **Save**. -6. [Verify](/cloudflare-one/identity/devices/#2-verify-device-posture-checks) that the posture check is returning the expected results. +6. [Verify](/cloudflare-one/reusable-components/posture-checks/#2-verify-device-posture-checks) that the posture check is returning the expected results. You can now create an Access or Gateway device posture policy that checks if the device presents a UUID on your list. diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/disk-encryption.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/disk-encryption.mdx similarity index 97% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/disk-encryption.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/disk-encryption.mdx index 264d257429e082..73ce91ae193320 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/disk-encryption.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/disk-encryption.mdx @@ -19,7 +19,7 @@ The Disk Encryption device posture attribute ensures that disks are encrypted on product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/domain-joined.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/domain-joined.mdx similarity index 94% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/domain-joined.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/domain-joined.mdx index a3b0651fe65101..406b8dada7c2c0 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/domain-joined.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/domain-joined.mdx @@ -19,7 +19,7 @@ The Domain Joined device posture attribute ensures that a user is a member of a product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/file-check.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/file-check.mdx similarity index 67% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/file-check.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/file-check.mdx index 7b98f340a132d8..3a1f62ae76bea1 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/file-check.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/file-check.mdx @@ -16,7 +16,7 @@ The File Check device posture attribute checks for the presence of a file on a d product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> @@ -32,8 +32,8 @@ The File Check device posture attribute checks for the presence of a file on a d 1. **Name**: Enter a unique name for this device posture check. 2. **Operating system**: Select your operating system. 3. **File Path**: Enter a file path (for example, `c:\my folder\myfile.exe`). - 4. **Signing certificate thumbprint (recommended)**: Enter the [thumbprint](/cloudflare-one/identity/devices/warp-client-checks/application-check/#determine-the-signing-thumbprint) of the publishing certificate used to sign the file. Adding this information will enable the check to ensure that the file was signed by the expected software developer. - 5. **SHA-256 (optional)**: Enter the [SHA-256 value](/cloudflare-one/identity/devices/warp-client-checks/application-check/#determine-the-sha-256-value) of the file. This is used to ensure the integrity of the file on the device. + 4. **Signing certificate thumbprint (recommended)**: Enter the [thumbprint](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/application-check/#determine-the-signing-thumbprint) of the publishing certificate used to sign the file. Adding this information will enable the check to ensure that the file was signed by the expected software developer. + 5. **SHA-256 (optional)**: Enter the [SHA-256 value](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/application-check/#determine-the-sha-256-value) of the file. This is used to ensure the integrity of the file on the device. 5. Select **Save**. diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/firewall.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/firewall.mdx similarity index 95% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/firewall.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/firewall.mdx index 412a58c10b4117..537a2ff8f470a6 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/firewall.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/firewall.mdx @@ -19,7 +19,7 @@ The Firewall device posture attribute ensures that a firewall is running on a de product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/index.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/index.mdx new file mode 100644 index 00000000000000..4ebe78397f841b --- /dev/null +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/index.mdx @@ -0,0 +1,33 @@ +--- +pcx_content_type: navigation +title: WARP client checks +sidebar: + order: 1 + +--- + +These device posture checks are performed by the [Cloudflare WARP client](/cloudflare-one/team-and-resources/devices/warp/). To use this feature, you must [deploy the WARP client](/cloudflare-one/team-and-resources/devices/warp/deployment/) to your devices and enable the desired posture checks. + +## Supported WARP modes + +* Gateway with WARP +* Secure Web Gateway without DNS filtering +* Device Information Only + +## Supported operating systems + +| Device posture check | macOS | Windows | Linux | iOS | Android/ChromeOS | +| --------------------------------------------------------------------------------------------- | ----- | ------- | ----------- | --- | ---------------- | +| [Application check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/application-check/) | ✅ | ✅ | ✅ | ❌ | ❌ | +| [Carbon Black](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/carbon-black/) | ✅ | ✅ | ✅ | ❌ | ❌ | +| [Client certificate](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/client-certificate/) | ✅ | ✅ | ✅ | ❌ | ❌ | +| [Device serial numbers](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/corp-device/) | ✅ | ✅ | ✅ | ❌ | ❌ | +| [Device UUID](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/device-uuid/) | ❌ | ❌ | ❌ | ✅ | ✅ | +| [Disk encryption](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/disk-encryption/) | ✅ | ✅ | ✅ | ❌ | ❌ | +| [Domain joined](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/domain-joined/) | ❌ | ✅ | ❌ | ❌ | ❌ | +| [File check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/file-check/) | ✅ | ✅ | ✅ | ❌ | ❌ | +| [Firewall](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/firewall/) | ✅ | ✅ | ❌ | ❌ | ❌ | +| [OS version](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/os-version/) | ✅ | ✅ | ✅ | ✅ | ✅ | +| [Require Gateway](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-gateway/) | ✅ | ✅ | ✅ | ✅ | ✅ | +| [Require WARP](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-warp/) | ✅ | ✅ | ✅ | ✅ | ✅ | +| [SentinelOne](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/sentinel-one/) | ✅ | ✅ | ✅ | ❌ | ❌ | diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/os-version.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/os-version.mdx similarity index 98% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/os-version.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/os-version.mdx index b0666478624488..3c51d0691249ca 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/os-version.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/os-version.mdx @@ -16,7 +16,7 @@ The OS Version device posture attribute checks whether the version of a device's product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/require-gateway.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-gateway.mdx similarity index 71% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/require-gateway.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-gateway.mdx index 0828e4ea9d7425..f75d69f5ae0ac6 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/require-gateway.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-gateway.mdx @@ -10,7 +10,7 @@ head: import { Render } from "~/components"; -With Require Gateway, you can allow access to your applications only to devices enrolled in your Zero Trust organization. Unlike [Require WARP](/cloudflare-one/identity/devices/warp-client-checks/require-warp/), which will check for any WARP instance (including the consumer version), Require Gateway will only allow requests coming from devices whose traffic is filtered by your organization's Cloudflare Gateway configuration. This policy is best used when you want to protect company-owned assets by only allowing access to employees. +With Require Gateway, you can allow access to your applications only to devices enrolled in your Zero Trust organization. Unlike [Require WARP](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-warp/), which will check for any WARP instance (including the consumer version), Require Gateway will only allow requests coming from devices whose traffic is filtered by your organization's Cloudflare Gateway configuration. This policy is best used when you want to protect company-owned assets by only allowing access to employees. ## Prerequisites @@ -19,7 +19,7 @@ With Require Gateway, you can allow access to your applications only to devices product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/require-warp.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-warp.mdx similarity index 94% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/require-warp.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-warp.mdx index 9b69e34f5638f6..528533f4cc841a 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/require-warp.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/require-warp.mdx @@ -25,7 +25,7 @@ Cloudflare Zero Trust enables you to restrict access to your applications to dev product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/sentinel-one.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/sentinel-one.mdx similarity index 96% rename from src/content/docs/cloudflare-one/identity/devices/warp-client-checks/sentinel-one.mdx rename to src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/sentinel-one.mdx index 46e554f8445dff..1a7ed0426d4b06 100644 --- a/src/content/docs/cloudflare-one/identity/devices/warp-client-checks/sentinel-one.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/warp-client-checks/sentinel-one.mdx @@ -20,7 +20,7 @@ Cloudflare Zero Trust can check if [SentinelOne](https://www.sentinelone.com/) i product="cloudflare-one" params={{ name: "WARP Client Checks", - link: "/cloudflare-one/identity/devices/warp-client-checks/", + link: "/cloudflare-one/reusable-components/posture-checks/warp-client-checks/", }} /> diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment.mdx index 6c010e49aeab9e..d6dc9ae89a15a9 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment.mdx @@ -177,7 +177,7 @@ Windows offers two locations to install the certificate, each impacting which us The root certificate is now installed and ready to be used. :::caution -If your certificate is installed in the **Local Machine Store**, the [device posture check](/cloudflare-one/identity/devices/warp-client-checks/) looking for a certificate will fail. Install the certificate in the **Current User Store** to ensure a successful posture device check. +If your certificate is installed in the **Local Machine Store**, the [device posture check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/) looking for a certificate will fail. Install the certificate in the **Current User Store** to ensure a successful posture device check. ::: ### Linux diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles.mdx index 72895aee4bc630..2386a5ddd2771f 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/device-profiles.mdx @@ -186,7 +186,7 @@ Apply a device profile based on the operating system of the device. ### Operating system version -Apply a device profile based on the [OS version](/cloudflare-one/identity/devices/warp-client-checks/os-version/#determine-the-os-version) of the device. +Apply a device profile based on the [OS version](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/os-version/#determine-the-os-version) of the device. | UI name | API example | | ------------------------ | ------------------------- | diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels.mdx index e4606ede02ef59..1d50b410a56b2e 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/split-tunnels.mdx @@ -34,7 +34,7 @@ Do not exclude a site from Split Tunnels if you want to see the traffic in your ## Routes for Split Tunnels Include mode -Many Cloudflare Zero Trust services rely on traffic going through WARP, such as [device posture checks](/cloudflare-one/identity/devices/) and [WARP session durations](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions/). If you are using Split Tunnels in Include mode, you will need to manually add Cloudflare Zero Trust domains and IPs in order for these features to function. +Many Cloudflare Zero Trust services rely on traffic going through WARP, such as [device posture checks](/cloudflare-one/reusable-components/posture-checks/) and [WARP session durations](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-sessions/). If you are using Split Tunnels in Include mode, you will need to manually add Cloudflare Zero Trust domains and IPs in order for these features to function. ### Cloudflare Zero Trust domains diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only.mdx index 999a426f216d7e..248f5f382efe4a 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only.mdx @@ -118,7 +118,7 @@ To block traffic from devices that do not have a valid client certificate: | Hostname | equals | `app.mycompany.com` | | | 5. Select **Deploy**. -Device Information Only mode is now enabled on the device. To start enforcing device posture, set up a [WARP client check](/cloudflare-one/identity/devices/warp-client-checks/) and add a _Require_ device posture rule to your [Access policy](/cloudflare-one/access-controls/policies/). When the device connects to the Access application for the first time, the browser will ask to use the client certificate installed by WARP. +Device Information Only mode is now enabled on the device. To start enforcing device posture, set up a [WARP client check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/) and add a _Require_ device posture rule to your [Access policy](/cloudflare-one/access-controls/policies/). When the device connects to the Access application for the first time, the browser will ask to use the client certificate installed by WARP. ![Browser prompts for client diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/index.mdx index 77251121c7822f..e150a4c2776113 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/index.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/index.mdx @@ -56,7 +56,7 @@ Proxy mode is best suited for organizations that want to filter traffic directed ## Device Information Only -This mode is best suited for organizations that only want to enforce [WARP client device posture checks](/cloudflare-one/identity/devices/warp-client-checks/) for zones in your account. DNS, Network and HTTP traffic is handled by the default mechanisms on your devices. To setup Device Information Only mode, refer to the [dedicated page](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only/). +This mode is best suited for organizations that only want to enforce [WARP client device posture checks](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/) for zones in your account. DNS, Network and HTTP traffic is handled by the default mechanisms on your devices. To setup Device Information Only mode, refer to the [dedicated page](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/device-information-only/). | DNS filtering | Network filtering | HTTP filtering | Features enabled | | ------------- | ----------------- | -------------- | ------------------------------------------------------------------------------------ | diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment.mdx index ae9274ac6959c5..68cfd7796d22c4 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment.mdx @@ -29,7 +29,7 @@ You can verify which devices have enrolled by going to **My Team** > **Devices** ### Check for mTLS certificate -Enterprise customers can enforce [mutual TLS authentication](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/) during device enrollment. +Enterprise customers can enforce [mutual TLS authentication](/cloudflare-one/reusable-components/posture-checks/access-integrations/mutual-tls-authentication/) during device enrollment. diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters.mdx index 8101e6b762d74f..2b80ba8951b1c4 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters.mdx @@ -19,7 +19,7 @@ Most of the parameters listed below are also configurable in Zero Trust under ** ## Required for full Cloudflare Zero Trust features -For the majority of Cloudflare Zero Trust features to work, you need to specify a team name. Examples of Cloudflare Zero Trust features which depend on the team name are [HTTP policies](/cloudflare-one/traffic-policies/http-policies/), [Browser Isolation](/cloudflare-one/remote-browser-isolation/), and [device posture](/cloudflare-one/identity/devices/). +For the majority of Cloudflare Zero Trust features to work, you need to specify a team name. Examples of Cloudflare Zero Trust features which depend on the team name are [HTTP policies](/cloudflare-one/traffic-policies/http-policies/), [Browser Isolation](/cloudflare-one/remote-browser-isolation/), and [device posture](/cloudflare-one/reusable-components/posture-checks/). ### `organization` @@ -239,7 +239,7 @@ This parameter replaces the old `enabled` property, which can no longer be used Only valid for iOS and Android/ChromeOS. ::: -Assigns a unique identifier to the device for the [device UUID posture check](/cloudflare-one/identity/devices/warp-client-checks/device-uuid). +Assigns a unique identifier to the device for the [device UUID posture check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/device-uuid). **Value Type:** `string` diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/intune.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/intune.mdx index 27012438f3b733..d56f385614e1a3 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/intune.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/partners/intune.mdx @@ -325,7 +325,7 @@ By completing this step, you deliver the WARP client to targeted macOS devices, Refer to the [generic instructions for iOS](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/#ios). -Intune allows you to insert [predefined variables](https://learn.microsoft.com/en-us/mem/intune/apps/app-configuration-policies-use-ios#tokens-used-in-the-property-list) into the XML configuration file. For example, you can set the [`unique_client_id`](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/#unique_client_id) key to `{{deviceid}}` for a [device UUID posture check](/cloudflare-one/identity/devices/warp-client-checks/device-uuid/) deployment. +Intune allows you to insert [predefined variables](https://learn.microsoft.com/en-us/mem/intune/apps/app-configuration-policies-use-ios#tokens-used-in-the-property-list) into the XML configuration file. For example, you can set the [`unique_client_id`](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters/#unique_client_id) key to `{{deviceid}}` for a [device UUID posture check](/cloudflare-one/reusable-components/posture-checks/warp-client-checks/device-uuid/) deployment. ### Per-app VPN for iOS diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/index.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/index.mdx index 368a9391dae297..b83b538a6ea532 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/index.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/index.mdx @@ -12,7 +12,7 @@ import { Render, Stream } from "~/components" ## About Cloudflare WARP -The Cloudflare WARP client allows you to protect corporate devices by securely and privately sending traffic from those devices to Cloudflare's global network, where [Cloudflare Gateway](/cloudflare-one/traffic-policies/) can apply advanced web filtering. The WARP client also makes it possible to apply advanced [Zero Trust policies](/cloudflare-one/identity/devices/) that check for a device's health before it connects to corporate applications. +The Cloudflare WARP client allows you to protect corporate devices by securely and privately sending traffic from those devices to Cloudflare's global network, where [Cloudflare Gateway](/cloudflare-one/traffic-policies/) can apply advanced web filtering. The WARP client also makes it possible to apply advanced [Zero Trust policies](/cloudflare-one/reusable-components/posture-checks/) that check for a device's health before it connects to corporate applications. ## How WARP works @@ -59,7 +59,7 @@ Deploying the WARP client significantly enhances your organization's security an - **Application and device-specific insights**: With WARP installed on your corporate devices, you can view detailed application and user-level activity on the [Zero Trust Shadow IT Discovery](/cloudflare-one/insights/analytics/shadow-it-discovery/) page, while also monitoring device and network performance with [Digital Experience Monitoring (DEX)](/cloudflare-one/insights/dex/) to proactively detect and resolve issues. -- **Device posture checks**: The WARP client provides advanced Zero Trust protection by making it possible to check for [device posture](/cloudflare-one/identity/devices/). By setting up device posture checks, you can build Zero Trust policies that check for a device's location, disk encryption status, OS version, and more. +- **Device posture checks**: The WARP client provides advanced Zero Trust protection by making it possible to check for [device posture](/cloudflare-one/reusable-components/posture-checks/). By setting up device posture checks, you can build Zero Trust policies that check for a device's location, disk encryption status, OS version, and more. - **Secure private and infrastructure access**: WARP lets devices connect to [private networks](/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/) over Cloudflare Tunnel and is required for [Access for Infrastructure](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/), enabling secure SSH with short-lived certificates and detailed logging. diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs.mdx index 3845c1a0c3200f..6599e971139e05 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs.mdx @@ -113,7 +113,7 @@ The `warp-debugging-info--