[pull] production from cloudflare:production

products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/setup.md

@@ -1,6 +1,7 @@
 ---
 order: 2
 pcx-content-type: how-to
+hidden: true
 ---
 
 # Authenticate `cloudflared`

products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/tunnel-guide.md

@@ -6,7 +6,8 @@ pcx-content-type: how-to
 
 # Set up your first tunnel
 
-Follow this step-by-step guide to getting your first tunnel up and running. Before you start, make sure you:
+Follow this step-by-step guide to get your first tunnel up and running. Before you start, make sure you:
+
 1. [Add a website to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/201720164-Creating-a-Cloudflare-account-and-adding-a-website)
 1. [Change your domain nameservers to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/205195708)
 

products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/deploy-cloudflared-replicas.md

@@ -13,29 +13,29 @@ To deploy multiple `cloudflared` replicas:
 
 1. Run the following command:
 
-  ```sh
+  ```bash
   $ cloudflared tunnel create <NAME>
   ```
 
 1. Next, run your newly created Named Tunnel.
 
- ```sh
+ ```bash
  $ cloudflared tunnel run <NAME>
  ```
 
  This will generate a unique `connector_id` for `cloudflared`.
 
 1. In a separate window, run the same command to initialize another `cloudflared` instance:
 
- ```sh
+ ```bash
  $ cloudflared tunnel run <NAME>
  ```
 
  This will also generate a unique `connector_id` for `cloudflared`.
 
 1. Next, run `tunnel info` to show each `cloudflared` running your tunnel:
 
- ```sh
+ ```bash
  $ cloudflared tunnel info <NAME>
  ```
 

products/cloudflare-one/src/content/connections/connect-apps/tunnel-useful-terms.md

@@ -15,13 +15,13 @@ A tunnel UUID is an alpha-numeric, unique ID assigned to a tunnel. The tunnel UU
 The `cloudflared tunnel create <NAME>` command creates a tunnel and assigns it a name. Once named, a tunnel is a persistent pathway within which you can stop and start as many [connectors](#connector) as needed, adding stability and ease of use to your tunnel experience. Tunnel names do not need to be hostnames; for example, you can assign your tunnel a name that represents your application/network, a particular server, or the cloud environment where it runs. A human-readable identifier lets you easily reference a tunnel whenever you need.
 
 ## Connector
-Users can create and configure a tunnel once and run it as multiple different `cloudflared` processes. These processes are known as connectors, or replicas. DNS records and Cloudflare Load Balancers can still point to the tunnel and its UUID, while that tunnel sends traffic to the multiple instances of cloudflared that run through it. Using multiple connectors provides tunnels with high availability, scalability, and elasticity.
+Users can create and configure a tunnel once and run it as multiple different `cloudflared` processes. These processes are known as connectors. DNS records and Cloudflare Load Balancers can still point to the tunnel and its UUID, while that tunnel sends traffic to the multiple instances of cloudflared that run through it. Using multiple connectors provides tunnels with high availability, scalability, and elasticity.
 
 ## Configuration file
 This is a `.yaml` file that functions as the operating manual for `cloudflared`. By creating a configuration file, you can have fine-grained control over how their instance of cloudflared will operate. This includes operations like what you want `cloudflared` to do with traffic (for example, proxy websockets to port `xxxx`, or ssh to port `yyyy`), where `cloudflared` should search for authorization (credentials file, tunnel token), and what mode it should run in (for example, [`warp-routing`](/connections/connect-networks/private-net/create-tunnel#configure-the-tunnel)). In the absence of a configuration file, cloudflared will proxy outbound traffic through port `8080`.
 
 ## Cert.pem
-This is the certificate file issued by Cloudflare when you run `cloudflared tunnel login`. This file is required when you create new tunnels, delete existing tunnels, change DNS records, or configure tunnel routing from cloudflared. This file is not required to perform actions such as running an existing tunnel or managing tunnel routing from the Cloudflare dashboard. The cert.pem origin certificate is valid for at least 10 years, and the service token it contains is valid until revoked.
+This is the certificate file issued by Cloudflare when you run `cloudflared tunnel login`. This file uses a certificate to authenticate your instance of `cloudflared` and it is required when you create new tunnels, delete existing tunnels, change DNS records, or configure tunnel routing from cloudflared. This file is not required to perform actions such as running an existing tunnel or managing tunnel routing from the Cloudflare dashboard. The cert.pem origin certificate is valid for at least 10 years, and the service token it contains is valid until revoked. 
 
 ## Credentials file
 This file is created when you run `cloudflared tunnel create <NAME>`. It stores your tunnel’s credentials in a `.json` format, and is unique to each tunnel. This file functions as a token authenticating the tunnel it is associated with.

products/cloudflare-one/src/content/connections/connect-networks/private-net/create-tunnel/index.md

@@ -13,8 +13,8 @@ pcx-content-type: how-to
 
 To create a Tunnel, run the following command:
 
-```sh
-cloudflared tunnel create <NAME>
+```bash
+$ cloudflared tunnel create <NAME>
 ```
 
 Replace `<NAME>` with the name you want to give to the Tunnel. The name assigned can be any string and does not need to relate to a hostname or your account name.
@@ -31,8 +31,8 @@ You can also view and manage the Tunnels generated. Click [here](/connections/co
 
 To map the Tunnel to a range of IPs, run the following command:
 
-```sh
-cloudflared tunnel route ip add <CIDR> <NAME>
+```bash
+$ cloudflared tunnel route ip add <CIDR> <NAME>
 ```
 
 Replace `<CIDR>` with the range of IPs that this Tunnel represents, for example `10.1.2.40/29`. The IP addresses used can include RFC 1918 ranges. The `<NAME>` value should be the name of a Tunnel already created.
@@ -44,15 +44,15 @@ This command will tell Cloudflare to send traffic from users in your organizatio
 Confirm the routes enrolled with the following command:
 
 ```bash
-cloudflared tunnel route ip show
+$ cloudflared tunnel route ip show
 ```
 
 ![IP List](../../../../static/secure-origin-connections/warp-to-tunnel/ip-list.png)
 
 You can test the routing configuration with the following command as well:
 
 ```bash
-cloudflared tunnel route ip get 100.64.0.1
+$ cloudflared tunnel route ip get 100.64.0.1
 ```
 
 ## Configure the Tunnel

products/cloudflare-one/src/content/faq/teams-policies-faq.md

@@ -20,7 +20,7 @@ Wildcard-based policies in Cloudflare Access only cover the level where they are
 
 ## Can I use regular expressions to build policies?
 
-You can use wildcards when setting up Zero Trust policies. Wildcards are useful when specifying application paths you want to protect. For more information, see our guide for [Using wildcards in subdomains and path](/applications/configure-apps/app-paths#using-wildcards-in-subdomains-and-paths).
+You can use wildcards when setting up Zero Trust policies. Wildcards are useful when specifying application paths you want to protect. For more information, see our guide for [Using wildcards in subdomains and path](/policies/zero-trust/app-paths#using-wildcards-in-subdomains-and-paths).
 
 Gateway uses Rust to evaluate regular expressions. The Rust implementation is slightly different than regex libraries used elsewhere. For example, if you want to match multiple domains, you could use the pipe symbol (`|`) as an OR operator. In Gateway, you do not need to use an escape character (`\`) before the pipe symbol. Let's say you want to block requests to two hosts if either appears in a request header. A regex for such a rule would look like this:
 

products/cloudflare-one/src/content/identity/idp-integration/adfs.md

@@ -114,10 +114,7 @@ The **Edit Claim Rules for CF Login** screen automatically displays.
 
 Now create 2 Claim Rules so that ADFS can take information from Cloudflare and return it to create [Zero Trust policies](/policies/zero-trust).
 
-<Aside>
-
-If you closed the Add Relying Trust wizard, use Explorer to find the <strong>Relying Party Trusts</strong> folder, select the newly created RPT file, and click <strong>Edit Claim Rules</strong> the <strong>Action\*/</strong> sidebar.
-</Aside>
+If you closed the Add Relying Trust wizard, use Explorer to find the **Relying Party Trusts** folder, select the newly created RPT file, and click **Edit Claim Rules** in the **Action** sidebar.
 
 To create Claim Rules:
 

products/cloudflare-one/src/content/identity/idp-integration/citrixadc-saml.md

@@ -12,13 +12,7 @@ Cloudflare for Teams can integrate with Citrix ADC (formerly Citrix NetScaler AD
 To set up Citrix ADC (SAML) as your identity provider:
 
 1. First, you'll need to configure 2 SAML certificates:
-   * A certificate to **terminate TLS at the vServer**.
-
-        <Aside>
-
-        Ensure that the certificate is issued by a publicly trusted CA.
-        </Aside>
-
+   * A certificate to **terminate TLS at the vServer**. Ensure that the certificate is issued by a publicly trusted CA.
    * A certificate for **signing SAML assertions**.
 
  If you do not already have a certificate for signing SAML assertions, you can use a self-signed certificate generated on Citrix ADC by following these steps:

products/cloudflare-one/src/content/identity/idp-integration/github.md

@@ -48,11 +48,8 @@ To configure GitHub access in both GitHub and Cloudflare for Teams:
 
 1. Click **Save**.
 
-To test that your connection is working, navigate to **Authentication > Login methods** and click **Test** next to GitHub.
-
-<Aside>
+To test that your connection is working, navigate to **Authentication > Login methods** and click **Test** next to GitHub. 
 If you have GitHub two-factor authentication enabled, you will need to first login to GitHub directly and return to Access.
-</Aside>
 
 ## Example API Configuration
 

products/cloudflare-one/src/content/identity/idp-integration/google.md

@@ -5,14 +5,10 @@ pcx-content-type: how-to
 
 # Google
 
-<Aside header="Note">
-
-You don't need to be a Google Cloud Platform user to integrate Google Suite as an identity provider with Cloudflare for Teams. You will only need to open the Google Cloud Platform to access settings for your OIDC identity provider.
-
-</Aside>
-
 You can integrate Google authentication with Cloudflare Access without a Google Workspace account. The integration will allow any user with a Google account to login (if the [Zero Trust policy](/policies/zero-trust) allows them to reach the resource). Unlike the instructions for [Google Workspace](/identity/idp-integration/gsuite), the steps below will not allow you to pull group membership information from a Google Workspace account.
 
+Please note that you don't need to be a Google Cloud Platform user to integrate Google Suite as an identity provider with Cloudflare for Teams. You will only need to open the Google Cloud Platform to access settings for your OIDC identity provider.
+
 1. Visit the Google Cloud Platform console. Create a new project.
 
  ![Create Project](../../static/documentation/identity/google/create-project.png)

products/cloudflare-one/src/content/identity/idp-integration/gsuite.md

@@ -5,16 +5,12 @@ pcx-content-type: how-to
 
 # Google Workspace
 
-<Aside header="Note">
-
-You don't need to be a Google Cloud Platform user to integrate Google Workspace as an identity provider with Cloudflare for Teams. You will only need to open the Google Cloud Platform to access settings for your OIDC identity provider.
-
-</Aside>
-
 You can integrate a Google Workspace (formerly Google Suite) account with Cloudflare Access. Unlike the instructions for [generic Google authentication](/identity/idp-integration/google), the steps below will allow you to pull group membership information from your Google Workspace account.
 
 Once integrated, users will login with their Google Workspace credentials to reach resources protected by Cloudflare Access or to enroll their device into Cloudflare Gateway.
 
+Please note that you don't need to be a Google Cloud Platform user to integrate Google Suite as an identity provider with Cloudflare for Teams. You will only need to open the Google Cloud Platform to access settings for your OIDC identity provider.
+
 1. Log into the Google Cloud Platform [console](https://console.cloud.google.com/). This is separate from your Google Workspace console.
 
  ![GCP Console](../../static/documentation/identity/gsuite/gcp-home.png)

products/cloudflare-one/src/content/identity/idp-integration/onelogin-saml.md

@@ -56,15 +56,10 @@ To set up OneLogin (SAML) as your identity provider:
 
 1. Select SAML.
 
-1. Input the details from your OneLogin account in the fields.
+1. Input the details from your OneLogin account in the fields. We suggest that you name the attributes the same in both OneLogin and Cloudflare.
 
     If other headers and SAML attribute names were added to OneLogin, be sure to add them to Cloudflare under **SAML attributes** and **SAML header attributes** in the **Optional configurations** menu.
 
-    <Aside>
-    We suggest that you name the attributes the same in both OneLogin and Cloudflare.
-
-    </Aside>
-
 1. Click **Save**.
 
 To test that your connection is working, navigate to **Authentication > Login methods** and click **Test** next to the login method you want to test.

products/cloudflare-one/src/content/identity/idp-integration/signed_authn.md

@@ -29,11 +29,8 @@ To set up Signed AuthN requests:
     https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/public-cert
     ```
 
-    <Aside>
     Ensure that your IdP validation uses the most recent certificate. Cloudflare Access routinely rotates the public key as a security measure.
 
-    </Aside>
-
     Cloudflare Access uses a certificate that includes the following 2 distinguished name fields:
 
    * **Issuer Distinguished Name** – `CN=cloudflareaccess.com, C=US, ST=Texas, L=Austin, O=Cloudflare`

products/cloudflare-one/src/content/policies/filtering/applications-changelog.md

@@ -1,6 +1,7 @@
 ---
 order: 10
 pcx-content-type: reference
+hidden: true
 ---
 
 # Applications changelog

products/cloudflare-one/src/content/policies/filtering/dns-policies/index.md

@@ -1,6 +1,7 @@
 ---
 order: 2
 pcx-content-type: concept
+hidden: true
 ---
 
 # DNS policies

products/cloudflare-one/src/content/policies/filtering/http-policies/tenant-control.md

@@ -39,26 +39,52 @@ Your Allow policy is now displayed in the list of HTTP rules. When an end user a
 
 This section covers policy configurations for common SaaS applications. 
 
-## Dropbox
+### Microsoft 365
+
+<TableWrap>
 
 | Selector | Operator | Value | Action | Header name |
 | -- | -- | -- | -- | -- |
-| Application | In | Dropbox | Allow | `X-Dropbox-allowed-Team-Ids` |
+| Application | In | Microsoft Office365 | Allow | `Restrict-Access-To-Tenants`, `Restrict-Access-Context` |
+
+</TableWrap>
+
+### Slack
+
+<TableWrap>
+
+| Selector | Operator | Value | Action | Header name |
+| -- | -- | -- | -- | -- |
+| Application | In | Slack | Allow | `X-Slack-Allowed-Workspaces-Requester`, `X-Slack-Allowed-Workspaces` | 
 
-## G Suite
+</TableWrap>
+
+### G Suite
+
+<TableWrap>
 
 | Selector | Operator | Value | Action | Header name |
 | -- | -- | -- | -- | -- |
 | Application | In | Google Workspace | Allow | `X-GooGApps-Allowed-Domains` |
 
-## Microsoft 365
+</TableWrap>
+
+### Dropbox
+
+<TableWrap>
 
 | Selector | Operator | Value | Action | Header name |
 | -- | -- | -- | -- | -- |
-| Application | In | Microsoft Office365 | Allow | `Restrict-Access-To-Tenants`, `Restrict-Access-Context` |
+| Application | In | Dropbox | Allow | `X-Dropbox-allowed-Team-Ids` |
+
+</TableWrap>
 
-## YouTube
+### YouTube
+
+<TableWrap>
 
 | Selector | Operator | Value | Action | Header name |
 | -- | -- | -- | -- | -- |
 | Application | In | YouTube | Allow | `YouTube-Restrict` |
+
+</TableWrap>

products/cloudflare-one/src/content/tutorials/block-tld.md

@@ -28,7 +28,7 @@ Visit the Cloudflare for Teams dashboard. Open the `Policies` page in the Gatewa
 
 Click **Create a policy**. In the policy builder, name the policy and optionally provide a description.
 
-Choose `DNS Domain` in the Selector, `matches regex`, in the Operator, and input the following value:
+Choose `Domain` in the Selector, `matches regex` in the Operator, and input the following value:
 
 ```
 [.]fail
@@ -46,6 +46,12 @@ Finish the policy by clicking **Create policy**.
 
 Input the TLD you need to block. If you need to block `.fail` remove the leading `.` and only input `fail`. Click **Add to policy** and save the policy.
 
+<Aside type="note">
+
+For more information on how policies work with regular expressions, refer to [Can I use regular expressions to build policies?](/faq/teams-policies-faq#can-i-use-regular-expressions-to-build-policies)
+
+</Aside>
+
 ## Review logs
 
 You can test your policy by attempting to visit a domain with the blocked TLD. To review logs of the block, navigate to the `Logs` section of the Cloudflare for Teams dashboard, select `Gateway`, and choose the `DNS` tab.

products/cloudflare-one/src/content/tutorials/do-not-decrypt.md

@@ -11,7 +11,7 @@ You can configure Cloudflare for Teams to skip inspection for certain groups of
 
 By default, Cloudflare Gateway creates a rule that includes the hostnames used by certain client applications, like Zoom or Apple's services, that rely on certificate pinning. The TLS inspection performed by a service like Cloudflare Gatway will cause errors when users visit those applications.
 
-This tutorial skips inspection for additional appilcations beyond those in the list curated by Cloudflare.
+This tutorial skips inspection for additional applications beyond those in the list curated by Cloudflare.
 
 **🗺️ This walkthrough covers how to:**
 

products/cloudflare-one/src/content/tutorials/secure-dns-network.md

@@ -77,6 +77,6 @@ The default toggle presented will be `Router`. Follow the instructions on the pa
 
 ## Review events
 
-Once configured, you can review DNS queries made from your network in the Gateway overview page.
+Once configured, you can review DNS queries made from your network in the **Analytics** > **Gateway** page.
 
-![Gateway Overview](../static/secure-web-gateway/secure-dns-network/gateway-overview.png)
+![Gateway Analytics](../static/secure-web-gateway/secure-dns-network/gateway-analytics.png)

products/magic-transit/src/content/about/probe-construction.md

@@ -59,6 +59,10 @@ The values for failure penalties are intentionally extreme so that they always e
 
 Applying a penalty instead of removing the route altogether preserves redundancy and maintains options for customers with only one tunnel. Penalties also support the case when multiple tunnels are unhealthy.
 
+### Cloudflare data centers and tunnels
+
+In the event a Cloudflare data center is down, Cloudflare's edge network does not advertise your prefixes, and your packets are routed to the next closest data center. To check the system status for Cloudflare's edge network and dashboard, refer to [Cloudflare System Status](https://www.cloudflarestatus.com/).
+
 ## Recovery
 
 Once a tunnel is in the **Down** state, edge servers continue to emit probes every 60 seconds. When a probe returns **Healthy**, the edge server that received the healthy packet immediately sends two more probes. If the two probes return **Healthy**, Magic Transit sets the tunnel status to **Degraded**.

products/magic-wan/src/content/get-started/configure-tunnels/assign-tunnel-priorities.md

@@ -1,6 +1,6 @@
 ---
-title: Assign tunel properties
-order: 5
+title: Create static routes
+order: 
 pcx-content-type: how-to
 ---
 

products/magic-wan/src/content/get-started/configure-tunnels/specify-ip-addresses.md

@@ -1,6 +1,6 @@
 ---
 title: Specify IP address for endpoint health checks
-order: 7
+order: 
 pcx-content-type: how-to
 ---
 

products/magic-wan/src/content/get-started/configure-tunnels/specify-tunnel-endpoints.md

@@ -1,6 +1,6 @@
 ---
 title: Specify tunnel endpoints
-order: 4
+order: 
 pcx-content-type: how-to
 ---