diff --git a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/setup.md b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/setup.md index a2eb2b784a0..e3afa63f7b5 100644 --- a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/setup.md +++ b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/setup.md @@ -1,6 +1,7 @@ --- order: 2 pcx-content-type: how-to +hidden: true --- # Authenticate `cloudflared` diff --git a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/tunnel-guide.md b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/tunnel-guide.md index 3a03d50175a..0d42d532ad7 100644 --- a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/tunnel-guide.md +++ b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/tunnel-guide.md @@ -6,7 +6,8 @@ pcx-content-type: how-to # Set up your first tunnel -Follow this step-by-step guide to getting your first tunnel up and running. Before you start, make sure you: +Follow this step-by-step guide to get your first tunnel up and running. Before you start, make sure you: + 1. [Add a website to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/201720164-Creating-a-Cloudflare-account-and-adding-a-website) 1. [Change your domain nameservers to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/205195708) diff --git a/products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/deploy-cloudflared-replicas.md b/products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/deploy-cloudflared-replicas.md index e4723ceffdb..a1aa1ffd8dc 100644 --- a/products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/deploy-cloudflared-replicas.md +++ b/products/cloudflare-one/src/content/connections/connect-apps/run-tunnel/deploy-cloudflared-replicas.md @@ -13,13 +13,13 @@ To deploy multiple `cloudflared` replicas: 1. Run the following command: - ```sh + ```bash $ cloudflared tunnel create ``` 1. Next, run your newly created Named Tunnel. - ```sh + ```bash $ cloudflared tunnel run ``` @@ -27,7 +27,7 @@ To deploy multiple `cloudflared` replicas: 1. In a separate window, run the same command to initialize another `cloudflared` instance: - ```sh + ```bash $ cloudflared tunnel run ``` @@ -35,7 +35,7 @@ To deploy multiple `cloudflared` replicas: 1. Next, run `tunnel info` to show each `cloudflared` running your tunnel: - ```sh + ```bash $ cloudflared tunnel info ``` diff --git a/products/cloudflare-one/src/content/connections/connect-apps/tunnel-useful-terms.md b/products/cloudflare-one/src/content/connections/connect-apps/tunnel-useful-terms.md index 0023efa18c4..18d0eecbb37 100644 --- a/products/cloudflare-one/src/content/connections/connect-apps/tunnel-useful-terms.md +++ b/products/cloudflare-one/src/content/connections/connect-apps/tunnel-useful-terms.md @@ -15,13 +15,13 @@ A tunnel UUID is an alpha-numeric, unique ID assigned to a tunnel. The tunnel UU The `cloudflared tunnel create ` command creates a tunnel and assigns it a name. Once named, a tunnel is a persistent pathway within which you can stop and start as many [connectors](#connector) as needed, adding stability and ease of use to your tunnel experience. Tunnel names do not need to be hostnames; for example, you can assign your tunnel a name that represents your application/network, a particular server, or the cloud environment where it runs. A human-readable identifier lets you easily reference a tunnel whenever you need. ## Connector -Users can create and configure a tunnel once and run it as multiple different `cloudflared` processes. These processes are known as connectors, or replicas. DNS records and Cloudflare Load Balancers can still point to the tunnel and its UUID, while that tunnel sends traffic to the multiple instances of cloudflared that run through it. Using multiple connectors provides tunnels with high availability, scalability, and elasticity. +Users can create and configure a tunnel once and run it as multiple different `cloudflared` processes. These processes are known as connectors. DNS records and Cloudflare Load Balancers can still point to the tunnel and its UUID, while that tunnel sends traffic to the multiple instances of cloudflared that run through it. Using multiple connectors provides tunnels with high availability, scalability, and elasticity. ## Configuration file This is a `.yaml` file that functions as the operating manual for `cloudflared`. By creating a configuration file, you can have fine-grained control over how their instance of cloudflared will operate. This includes operations like what you want `cloudflared` to do with traffic (for example, proxy websockets to port `xxxx`, or ssh to port `yyyy`), where `cloudflared` should search for authorization (credentials file, tunnel token), and what mode it should run in (for example, [`warp-routing`](/connections/connect-networks/private-net/create-tunnel#configure-the-tunnel)). In the absence of a configuration file, cloudflared will proxy outbound traffic through port `8080`. ## Cert.pem -This is the certificate file issued by Cloudflare when you run `cloudflared tunnel login`. This file is required when you create new tunnels, delete existing tunnels, change DNS records, or configure tunnel routing from cloudflared. This file is not required to perform actions such as running an existing tunnel or managing tunnel routing from the Cloudflare dashboard. The cert.pem origin certificate is valid for at least 10 years, and the service token it contains is valid until revoked. +This is the certificate file issued by Cloudflare when you run `cloudflared tunnel login`. This file uses a certificate to authenticate your instance of `cloudflared` and it is required when you create new tunnels, delete existing tunnels, change DNS records, or configure tunnel routing from cloudflared. This file is not required to perform actions such as running an existing tunnel or managing tunnel routing from the Cloudflare dashboard. The cert.pem origin certificate is valid for at least 10 years, and the service token it contains is valid until revoked. ## Credentials file This file is created when you run `cloudflared tunnel create `. It stores your tunnel’s credentials in a `.json` format, and is unique to each tunnel. This file functions as a token authenticating the tunnel it is associated with. diff --git a/products/cloudflare-one/src/content/connections/connect-networks/private-net/create-tunnel/index.md b/products/cloudflare-one/src/content/connections/connect-networks/private-net/create-tunnel/index.md index 0c25a43774b..cef9f70962a 100644 --- a/products/cloudflare-one/src/content/connections/connect-networks/private-net/create-tunnel/index.md +++ b/products/cloudflare-one/src/content/connections/connect-networks/private-net/create-tunnel/index.md @@ -13,8 +13,8 @@ pcx-content-type: how-to To create a Tunnel, run the following command: -```sh -cloudflared tunnel create +```bash +$ cloudflared tunnel create ``` Replace `` with the name you want to give to the Tunnel. The name assigned can be any string and does not need to relate to a hostname or your account name. @@ -31,8 +31,8 @@ You can also view and manage the Tunnels generated. Click [here](/connections/co To map the Tunnel to a range of IPs, run the following command: -```sh -cloudflared tunnel route ip add +```bash +$ cloudflared tunnel route ip add ``` Replace `` with the range of IPs that this Tunnel represents, for example `10.1.2.40/29`. The IP addresses used can include RFC 1918 ranges. The `` value should be the name of a Tunnel already created. @@ -44,7 +44,7 @@ This command will tell Cloudflare to send traffic from users in your organizatio Confirm the routes enrolled with the following command: ```bash -cloudflared tunnel route ip show +$ cloudflared tunnel route ip show ``` ![IP List](../../../../static/secure-origin-connections/warp-to-tunnel/ip-list.png) @@ -52,7 +52,7 @@ cloudflared tunnel route ip show You can test the routing configuration with the following command as well: ```bash -cloudflared tunnel route ip get 100.64.0.1 +$ cloudflared tunnel route ip get 100.64.0.1 ``` ## Configure the Tunnel diff --git a/products/cloudflare-one/src/content/faq/teams-policies-faq.md b/products/cloudflare-one/src/content/faq/teams-policies-faq.md index 3d1286e78a2..c12f3a8b9e0 100644 --- a/products/cloudflare-one/src/content/faq/teams-policies-faq.md +++ b/products/cloudflare-one/src/content/faq/teams-policies-faq.md @@ -20,7 +20,7 @@ Wildcard-based policies in Cloudflare Access only cover the level where they are ## Can I use regular expressions to build policies? -You can use wildcards when setting up Zero Trust policies. Wildcards are useful when specifying application paths you want to protect. For more information, see our guide for [Using wildcards in subdomains and path](/applications/configure-apps/app-paths#using-wildcards-in-subdomains-and-paths). +You can use wildcards when setting up Zero Trust policies. Wildcards are useful when specifying application paths you want to protect. For more information, see our guide for [Using wildcards in subdomains and path](/policies/zero-trust/app-paths#using-wildcards-in-subdomains-and-paths). Gateway uses Rust to evaluate regular expressions. The Rust implementation is slightly different than regex libraries used elsewhere. For example, if you want to match multiple domains, you could use the pipe symbol (`|`) as an OR operator. In Gateway, you do not need to use an escape character (`\`) before the pipe symbol. Let's say you want to block requests to two hosts if either appears in a request header. A regex for such a rule would look like this: diff --git a/products/cloudflare-one/src/content/identity/idp-integration/adfs.md b/products/cloudflare-one/src/content/identity/idp-integration/adfs.md index fd57513b7f3..127a37bbabf 100644 --- a/products/cloudflare-one/src/content/identity/idp-integration/adfs.md +++ b/products/cloudflare-one/src/content/identity/idp-integration/adfs.md @@ -114,10 +114,7 @@ The **Edit Claim Rules for CF Login** screen automatically displays. Now create 2 Claim Rules so that ADFS can take information from Cloudflare and return it to create [Zero Trust policies](/policies/zero-trust). - +If you closed the Add Relying Trust wizard, use Explorer to find the **Relying Party Trusts** folder, select the newly created RPT file, and click **Edit Claim Rules** in the **Action** sidebar. To create Claim Rules: diff --git a/products/cloudflare-one/src/content/identity/idp-integration/citrixadc-saml.md b/products/cloudflare-one/src/content/identity/idp-integration/citrixadc-saml.md index 7d49469c10e..a55e472d18d 100644 --- a/products/cloudflare-one/src/content/identity/idp-integration/citrixadc-saml.md +++ b/products/cloudflare-one/src/content/identity/idp-integration/citrixadc-saml.md @@ -12,13 +12,7 @@ Cloudflare for Teams can integrate with Citrix ADC (formerly Citrix NetScaler AD To set up Citrix ADC (SAML) as your identity provider: 1. First, you'll need to configure 2 SAML certificates: - * A certificate to **terminate TLS at the vServer**. - - - + * A certificate to **terminate TLS at the vServer**. Ensure that the certificate is issued by a publicly trusted CA. * A certificate for **signing SAML assertions**. If you do not already have a certificate for signing SAML assertions, you can use a self-signed certificate generated on Citrix ADC by following these steps: diff --git a/products/cloudflare-one/src/content/identity/idp-integration/github.md b/products/cloudflare-one/src/content/identity/idp-integration/github.md index 83e2ed1cc77..7947aa83865 100644 --- a/products/cloudflare-one/src/content/identity/idp-integration/github.md +++ b/products/cloudflare-one/src/content/identity/idp-integration/github.md @@ -48,11 +48,8 @@ To configure GitHub access in both GitHub and Cloudflare for Teams: 1. Click **Save**. -To test that your connection is working, navigate to **Authentication > Login methods** and click **Test** next to GitHub. - - ## Example API Configuration diff --git a/products/cloudflare-one/src/content/identity/idp-integration/google.md b/products/cloudflare-one/src/content/identity/idp-integration/google.md index 10779216645..3fbb5f10162 100644 --- a/products/cloudflare-one/src/content/identity/idp-integration/google.md +++ b/products/cloudflare-one/src/content/identity/idp-integration/google.md @@ -5,14 +5,10 @@ pcx-content-type: how-to # Google - - You can integrate Google authentication with Cloudflare Access without a Google Workspace account. The integration will allow any user with a Google account to login (if the [Zero Trust policy](/policies/zero-trust) allows them to reach the resource). Unlike the instructions for [Google Workspace](/identity/idp-integration/gsuite), the steps below will not allow you to pull group membership information from a Google Workspace account. +Please note that you don't need to be a Google Cloud Platform user to integrate Google Suite as an identity provider with Cloudflare for Teams. You will only need to open the Google Cloud Platform to access settings for your OIDC identity provider. + 1. Visit the Google Cloud Platform console. Create a new project. ![Create Project](../../static/documentation/identity/google/create-project.png) diff --git a/products/cloudflare-one/src/content/identity/idp-integration/gsuite.md b/products/cloudflare-one/src/content/identity/idp-integration/gsuite.md index edc4cffad6a..95f44975b4a 100644 --- a/products/cloudflare-one/src/content/identity/idp-integration/gsuite.md +++ b/products/cloudflare-one/src/content/identity/idp-integration/gsuite.md @@ -5,16 +5,12 @@ pcx-content-type: how-to # Google Workspace - - You can integrate a Google Workspace (formerly Google Suite) account with Cloudflare Access. Unlike the instructions for [generic Google authentication](/identity/idp-integration/google), the steps below will allow you to pull group membership information from your Google Workspace account. Once integrated, users will login with their Google Workspace credentials to reach resources protected by Cloudflare Access or to enroll their device into Cloudflare Gateway. +Please note that you don't need to be a Google Cloud Platform user to integrate Google Suite as an identity provider with Cloudflare for Teams. You will only need to open the Google Cloud Platform to access settings for your OIDC identity provider. + 1. Log into the Google Cloud Platform [console](https://console.cloud.google.com/). This is separate from your Google Workspace console. ![GCP Console](../../static/documentation/identity/gsuite/gcp-home.png) diff --git a/products/cloudflare-one/src/content/identity/idp-integration/onelogin-saml.md b/products/cloudflare-one/src/content/identity/idp-integration/onelogin-saml.md index fbdc7f71a65..85bf63ed268 100644 --- a/products/cloudflare-one/src/content/identity/idp-integration/onelogin-saml.md +++ b/products/cloudflare-one/src/content/identity/idp-integration/onelogin-saml.md @@ -56,15 +56,10 @@ To set up OneLogin (SAML) as your identity provider: 1. Select SAML. -1. Input the details from your OneLogin account in the fields. +1. Input the details from your OneLogin account in the fields. We suggest that you name the attributes the same in both OneLogin and Cloudflare. If other headers and SAML attribute names were added to OneLogin, be sure to add them to Cloudflare under **SAML attributes** and **SAML header attributes** in the **Optional configurations** menu. - - 1. Click **Save**. To test that your connection is working, navigate to **Authentication > Login methods** and click **Test** next to the login method you want to test. diff --git a/products/cloudflare-one/src/content/identity/idp-integration/signed_authn.md b/products/cloudflare-one/src/content/identity/idp-integration/signed_authn.md index e565f2f595d..45fcd3ec315 100644 --- a/products/cloudflare-one/src/content/identity/idp-integration/signed_authn.md +++ b/products/cloudflare-one/src/content/identity/idp-integration/signed_authn.md @@ -29,11 +29,8 @@ To set up Signed AuthN requests: https://.cloudflareaccess.com/cdn-cgi/access/public-cert ``` - - Cloudflare Access uses a certificate that includes the following 2 distinguished name fields: * **Issuer Distinguished Name** – `CN=cloudflareaccess.com, C=US, ST=Texas, L=Austin, O=Cloudflare` diff --git a/products/cloudflare-one/src/content/policies/filtering/applications-changelog.md b/products/cloudflare-one/src/content/policies/filtering/applications-changelog.md index 2d1a80c666b..1cbcc7ceee5 100644 --- a/products/cloudflare-one/src/content/policies/filtering/applications-changelog.md +++ b/products/cloudflare-one/src/content/policies/filtering/applications-changelog.md @@ -1,6 +1,7 @@ --- order: 10 pcx-content-type: reference +hidden: true --- # Applications changelog diff --git a/products/cloudflare-one/src/content/policies/filtering/dns-policies/index.md b/products/cloudflare-one/src/content/policies/filtering/dns-policies/index.md index eaa556004c0..fb751895a85 100644 --- a/products/cloudflare-one/src/content/policies/filtering/dns-policies/index.md +++ b/products/cloudflare-one/src/content/policies/filtering/dns-policies/index.md @@ -1,6 +1,7 @@ --- order: 2 pcx-content-type: concept +hidden: true --- # DNS policies diff --git a/products/cloudflare-one/src/content/policies/filtering/http-policies/tenant-control.md b/products/cloudflare-one/src/content/policies/filtering/http-policies/tenant-control.md index 4da7155c030..a9dc209a8d3 100644 --- a/products/cloudflare-one/src/content/policies/filtering/http-policies/tenant-control.md +++ b/products/cloudflare-one/src/content/policies/filtering/http-policies/tenant-control.md @@ -39,26 +39,52 @@ Your Allow policy is now displayed in the list of HTTP rules. When an end user a This section covers policy configurations for common SaaS applications. -## Dropbox +### Microsoft 365 + + | Selector | Operator | Value | Action | Header name | | -- | -- | -- | -- | -- | -| Application | In | Dropbox | Allow | `X-Dropbox-allowed-Team-Ids` | +| Application | In | Microsoft Office365 | Allow | `Restrict-Access-To-Tenants`, `Restrict-Access-Context` | + + + +### Slack + + + +| Selector | Operator | Value | Action | Header name | +| -- | -- | -- | -- | -- | +| Application | In | Slack | Allow | `X-Slack-Allowed-Workspaces-Requester`, `X-Slack-Allowed-Workspaces` | -## G Suite + + +### G Suite + + | Selector | Operator | Value | Action | Header name | | -- | -- | -- | -- | -- | | Application | In | Google Workspace | Allow | `X-GooGApps-Allowed-Domains` | -## Microsoft 365 + + +### Dropbox + + | Selector | Operator | Value | Action | Header name | | -- | -- | -- | -- | -- | -| Application | In | Microsoft Office365 | Allow | `Restrict-Access-To-Tenants`, `Restrict-Access-Context` | +| Application | In | Dropbox | Allow | `X-Dropbox-allowed-Team-Ids` | + + -## YouTube +### YouTube + + | Selector | Operator | Value | Action | Header name | | -- | -- | -- | -- | -- | | Application | In | YouTube | Allow | `YouTube-Restrict` | + + \ No newline at end of file diff --git a/products/cloudflare-one/src/content/static/documentation/connections/proxy.png b/products/cloudflare-one/src/content/static/documentation/connections/proxy.png new file mode 100644 index 00000000000..7cfba72daff Binary files /dev/null and b/products/cloudflare-one/src/content/static/documentation/connections/proxy.png differ diff --git a/products/cloudflare-one/src/content/tutorials/block-tld.md b/products/cloudflare-one/src/content/tutorials/block-tld.md index 4dfaa3a6be3..169eb5ddfa1 100644 --- a/products/cloudflare-one/src/content/tutorials/block-tld.md +++ b/products/cloudflare-one/src/content/tutorials/block-tld.md @@ -28,7 +28,7 @@ Visit the Cloudflare for Teams dashboard. Open the `Policies` page in the Gatewa Click **Create a policy**. In the policy builder, name the policy and optionally provide a description. -Choose `DNS Domain` in the Selector, `matches regex`, in the Operator, and input the following value: +Choose `Domain` in the Selector, `matches regex` in the Operator, and input the following value: ``` [.]fail @@ -46,6 +46,12 @@ Finish the policy by clicking **Create policy**. Input the TLD you need to block. If you need to block `.fail` remove the leading `.` and only input `fail`. Click **Add to policy** and save the policy. + + ## Review logs You can test your policy by attempting to visit a domain with the blocked TLD. To review logs of the block, navigate to the `Logs` section of the Cloudflare for Teams dashboard, select `Gateway`, and choose the `DNS` tab. diff --git a/products/cloudflare-one/src/content/tutorials/do-not-decrypt.md b/products/cloudflare-one/src/content/tutorials/do-not-decrypt.md index b6f0ef500cf..2807dc95cb7 100644 --- a/products/cloudflare-one/src/content/tutorials/do-not-decrypt.md +++ b/products/cloudflare-one/src/content/tutorials/do-not-decrypt.md @@ -11,7 +11,7 @@ You can configure Cloudflare for Teams to skip inspection for certain groups of By default, Cloudflare Gateway creates a rule that includes the hostnames used by certain client applications, like Zoom or Apple's services, that rely on certificate pinning. The TLS inspection performed by a service like Cloudflare Gatway will cause errors when users visit those applications. -This tutorial skips inspection for additional appilcations beyond those in the list curated by Cloudflare. +This tutorial skips inspection for additional applications beyond those in the list curated by Cloudflare. **🗺️ This walkthrough covers how to:** diff --git a/products/cloudflare-one/src/content/tutorials/secure-dns-network.md b/products/cloudflare-one/src/content/tutorials/secure-dns-network.md index 80381476edf..466cd48202e 100755 --- a/products/cloudflare-one/src/content/tutorials/secure-dns-network.md +++ b/products/cloudflare-one/src/content/tutorials/secure-dns-network.md @@ -77,6 +77,6 @@ The default toggle presented will be `Router`. Follow the instructions on the pa ## Review events -Once configured, you can review DNS queries made from your network in the Gateway overview page. +Once configured, you can review DNS queries made from your network in the **Analytics** > **Gateway** page. -![Gateway Overview](../static/secure-web-gateway/secure-dns-network/gateway-overview.png) \ No newline at end of file +![Gateway Analytics](../static/secure-web-gateway/secure-dns-network/gateway-analytics.png) \ No newline at end of file