diff --git a/.gitignore b/.gitignore index b68780a03c4..004470e63d0 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,4 @@ CLAUDE.md .cursor/ .github/prompts/ .github/agents/ +agents/ diff --git a/src/content/docs/cloudflare-one/implementation-guides/index.mdx b/src/content/docs/cloudflare-one/implementation-guides/index.mdx index 978726414e5..ccef3c2f6f5 100644 --- a/src/content/docs/cloudflare-one/implementation-guides/index.mdx +++ b/src/content/docs/cloudflare-one/implementation-guides/index.mdx @@ -14,28 +14,30 @@ Implementation guides cover deployment steps and best practices for specific Clo - Provide your users and networks with a secure, performant, and flexible path - to the Internet. + Inspect and filter all Internet-bound traffic from your users to block + threats, enforce acceptable use policies, and prevent data loss. - Give users secure, auditable network and application access. + Connect remote users to internal applications and services through a secure + connection. Best for remote access to private networks. - Secure access to internal web applications without a device client. + Provide browser-based access to internal web applications, SSH servers, and + RDP sessions without installing software on user devices. - -Welcome to Cloudflare Zero Trust! You can now explore a list of one-click actions we have designed to help you kickstart your experience. - -## Install the WARP client on your devices - -If you want to enable security features such as Browser Isolation, HTTP filtering, AV scanning, and device posture, or connect networks to Cloudflare, here are the next steps you need to take: - -1. **Set up a login method.** Configure [One-time PIN](/cloudflare-one/integrations/identity-providers/one-time-pin/) or connect a [third-party identity provider](/cloudflare-one/integrations/identity-providers/) in Cloudflare Zero Trust. This is the login method your users will utilize when authenticating to add a new device to your Cloudflare Zero Trust setup. - -2. **Next, define [device enrollment permissions](/cloudflare-one/team-and-resources/devices/warp/deployment/device-enrollment/)**. Create device enrollment rules to define which users in your organization should be able to connect devices to your organization's Cloudflare Zero Trust setup. As you create your rule, you will be asked to select which login method you would like users to authenticate with. - -3. **Install the [Cloudflare root certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) on your devices.** Advanced security features including HTTP traffic inspection require users to install and trust the Cloudflare root certificate on their machine or device. If you are installing certificates manually on all your devices, these steps will need to be performed on each new device that is to be subject to HTTP filtering. - -4. **[Download](/cloudflare-one/team-and-resources/devices/warp/download-warp/) and deploy the WARP client to your devices**. Choose one of the [different ways](/cloudflare-one/team-and-resources/devices/warp/deployment/) to deploy the WARP client, depending on what works best for your organization. - -5. **Log in to your organization's Cloudflare Zero Trust instance from your devices**. On your device, go to the Settings section in the WARP client and insert your organization's team name. - -Your devices are now connected to Cloudflare Zero Trust through the WARP client. You can go to **Team & Resources** > **Devices** to find a list of your enrolled devices, when they were last seen, and the WARP client version they are running. - -Next, [enforce security policies](/cloudflare-one/traffic-policies/) on your traffic and access requests. diff --git a/src/content/docs/cloudflare-one/setup/index.mdx b/src/content/docs/cloudflare-one/setup/index.mdx new file mode 100644 index 00000000000..ab33a2f8952 --- /dev/null +++ b/src/content/docs/cloudflare-one/setup/index.mdx @@ -0,0 +1,72 @@ +--- +pcx_content_type: get-started +title: Get started +sidebar: + order: 2 +description: Set up Cloudflare Zero Trust for your organization. Choose a use case to get started with a guided quick-start. +--- + +import { CardGrid, LinkTitleCard, Render } from "~/components"; + +Set up Cloudflare Zero Trust to protect your users, devices, and networks. Complete the prerequisites below, then choose a use case to get started. + +## Prerequisites + +Before you begin any use case, you need a Cloudflare account and a Zero Trust organization. + +### 1. Create a Cloudflare account + +Sign up for a [Cloudflare account](https://dash.cloudflare.com/sign-up) and enable two-factor authentication. + +### 2. Create a Zero Trust organization + + + +## What would you like to do? + +These use cases match the guided onboarding in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). To follow along in the dashboard, select **Get Started**. + + + + + Give remote users, offices, and devices secure access to private networks and + applications without a traditional VPN. + + + + Provide browser-based access to internal web applications, SSH servers, and + RDP sessions without installing software on user devices. + + + + Set up DNS filtering to block malware, phishing, and unwanted content across + your network in minutes. + + + + Inspect and filter all Internet-bound traffic from your users to block + threats, enforce acceptable use policies, and prevent data loss. + + + + +:::note + +For in-depth deployment guides that cover policy design and advanced configuration, refer to [Implementation guides](/cloudflare-one/implementation-guides/). +::: diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx new file mode 100644 index 00000000000..0e2b2f6cf95 --- /dev/null +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx @@ -0,0 +1,122 @@ +--- +pcx_content_type: get-started +title: "Device to network" +sidebar: + order: 1 + label: Device to network +description: Connect a remote device to a private network using Cloudflare Tunnel and the WARP client. +products: + - cloudflare-one +--- + +import { GlossaryTooltip } from "~/components"; + +Connect a remote device to a private network so your users can securely access internal applications and services from anywhere, without the security risks and performance bottlenecks of a traditional VPN. + +To explore other connection scenarios, refer to [Replace your VPN](/cloudflare-one/setup/replace-vpn/). + +This guide follows the same steps as the **Get Started** onboarding wizard in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). + +## How it works + +[Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/) is a network connector that creates an outbound-only connection between your private network and Cloudflare. No open inbound ports or firewall changes are required. + +The [WARP client](/cloudflare-one/team-and-resources/devices/warp/) is an app that you install on each user's device. It routes traffic through Cloudflare and into the tunnel, so users can reach internal resources from anywhere. + +## Prerequisites + +- A Cloudflare account with a Zero Trust organization. If you have not set this up, refer to [Get started](/cloudflare-one/setup/). +- A Linux, Windows, or macOS device on your private network to run the tunnel. +- A Linux, Windows, or macOS device to install the WARP client on. + +## Step 1: Assign a Tunnel + +Cloudflare Tunnel establishes an outbound connection between your resources and Cloudflare. This is how new devices can reach your private network. You can install Tunnel on any Windows, Mac, or Linux device currently in your private network. + +1. In [Cloudflare One](https://one.dash.cloudflare.com), select the **Get Started** tab. +2. For **Replace my client-based or site-to-site VPN**, select **Get started**. +3. For **Device to network**, select **Continue**. +4. On the **Connect a remote device to a private network** screen, select **Continue**. +5. On the **Assign a Tunnel** screen, use the dropdown to choose an existing tunnel or create a new one. +6. Select **Continue**. + +## Step 2: Set your Tunnel's IP range + +Add the IP range of your private network to the tunnel. This defines which internal resources your remote users can reach. Your tunnel accepts traffic to this range from devices enrolled in your Zero Trust organization. + +1. Enter your IP range (for example, `10.0.1.0/24`). +2. Select **Continue**. + +:::note +If you are not sure of your IP range, check your router or network settings. Common private network ranges include `10.0.0.0/8`, `172.16.0.0/12`, and `192.168.0.0/16`. +::: + +## Step 3: Deploy your Tunnel + +Install the `cloudflared` connector on a device in your private network and run the tunnel. This service creates the secure connection between your network and Cloudflare. + +1. Select your device's operating system and architecture. +2. Copy the install command and run it on your device. For Windows, open Command Prompt as an administrator. For all other operating systems, use a terminal window. + + For macOS, the command looks similar to: + + ```sh + brew install cloudflared && sudo cloudflared service install + ``` + + For Windows and Linux, the dashboard provides a download link and install command for your selected architecture. For more download options, refer to [Downloads](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/). + +3. After `cloudflared` connects, the dashboard confirms the tunnel is active. +4. Select **Continue**. + +## Step 4: Enroll your devices + +Device enrollment controls which users can connect their devices to your private network through Cloudflare. In this step, you register your first device by providing an email address and installing the WARP client. + +1. Enter the email you want to use to enroll your first device. +2. Select your device's operating system. +3. Select **Download to continue** to download the WARP client, or copy the download link to send to a different device. +4. Select **Continue**. + +:::note +You can manage device enrollment permissions later in **Team & Resources** > **Devices**. +::: + +## Step 5: Complete WARP setup + +On your device, complete the WARP installation wizard. Then connect WARP to your Zero Trust organization. For comprehensive OS-specific instructions, refer to [Manual deployment](/cloudflare-one/team-and-resources/devices/warp/deployment/manual-deployment/). + +1. Open the WARP client. On macOS, select the Cloudflare icon in your status bar. On Windows, select the Cloudflare icon in your system tray. +2. Go to **Preferences** > **Account** > **Login to Cloudflare Zero Trust**. +3. Enter your team name when prompted. Your team name is the unique identifier for your Zero Trust organization and was set when the organization was created. The dashboard displays your team name on this screen for easy reference. + + :::note + To find or change your team name, go to **Settings** > **Team name** and select **Edit**. + ::: + +4. Complete the authentication steps. +5. The WARP client should show as **Connected**. +6. Select **Continue** in the dashboard. + +## Step 6: Verify your connection + +The dashboard confirms that you are securely connected. You now have remote access between your device and your private network resources. + +To verify connectivity, try reaching a resource on your private network (for example, `http://10.0.1.100` or `ssh 10.0.1.50`). + +## Recommended next steps + +After verifying your connection, consider securing your private network with policies and access controls: + +- **Set up Gateway policies**: By default, all enrolled devices can reach your entire private network. Gateway policies let you inspect traffic and control access based on user identity and network attributes. For more information, refer to [DNS policies](/cloudflare-one/traffic-policies/dns-policies/) and [Network policies](/cloudflare-one/traffic-policies/network-policies/). +- **Create an Access application**: Restrict access to specific applications or hostnames on your private network with identity-based rules. For more information, refer to [Secure a private IP or hostname](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). +- **Explore more with Zero Trust**: Review your tunnel, policies, and connected devices in the [Cloudflare One dashboard](https://one.dash.cloudflare.com). + +For in-depth guidance on policy design and device posture checks, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). + +## Troubleshoot + +If you have issues connecting, refer to these resources: + +- [Troubleshoot WARP](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/): resolve WARP client connection and enrollment issues. +- [Troubleshoot tunnels](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/): diagnose tunnel connectivity and routing problems. diff --git a/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx b/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx new file mode 100644 index 00000000000..a91344ec4f5 --- /dev/null +++ b/src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx @@ -0,0 +1,31 @@ +--- +pcx_content_type: navigation +title: Replace your VPN +sidebar: + order: 1 +description: Replace your traditional VPN with Cloudflare Zero Trust. Choose a connection scenario to get started. +--- + +import { CardGrid, LinkTitleCard } from "~/components"; + +Cloudflare One uses Cloudflare's global network and Zero Trust Network Access (ZTNA) to replace traditional VPNs. After you securely connect your devices and resources to Cloudflare, you can set policies to verify every request based on identity and context, reducing your attack surface and improving performance for remote users. For more background, refer to [Why should you replace your VPN?](/learning-paths/replace-vpn/concepts/why-vpn/) + +How you set this up depends on what needs to connect to what. Choose the scenario that matches your use case: + + + + + Connect remote users to internal applications and services through a secure + connection. Best for remote access to private networks. + + + + +:::note + +For in-depth guidance on policy design and device posture checks, refer to the [Replace your VPN learning path](/learning-paths/replace-vpn/concepts/). +:::