[Cloudflare One] Add device-to-device replace VPN quick-start#28803
Conversation
Refactor the Get Started page from a flat generic setup page into an intent-based router matching the CF1 dashboard onboarding UX. - Convert setup.mdx to setup/index.mdx with universal prereqs + use-case cards - Add Replace VPN decision page with 3 scenario cards - Add full Device to Network quick-start (PCX-20915) - Add skeleton pages for Network to Network (PCX-20917) and Device to Device (PCX-20916) - Preserves /cloudflare-one/setup/ URL (directory index)
Bridge uncertain users to existing conceptual content without adding positioning copy to the get-started flow.
MDX parses <!-- --> as invalid JSX. Use {/* */} syntax instead.
- high-availability → configure-tunnels/tunnel-availability - private-dns → private-net/cloudflared/private-dns - gateway-inspection → http-policies/tls-decryption
… page Bridge returning users from the Overview tab to the onboarding flows.
…ck-start Both sidebar entries now land users on the same decision page. The quick-start page links to the full learning path for deeper content.
…wizard (PCX-20915) - Rewrote device-to-network.mdx to mirror the exact 6-step Get Started onboarding flow in the Cloudflare One dashboard - Removed production-oriented steps (IdP config, Split Tunnels, Gateway proxy, access policies) that belong in the learning path, not the quick-start - Updated setup landing page: moved dashboard reference from intro to card section, aligned heading with dashboard UX, removed production hardening language
- Remove skeleton pages for network-to-network and device-to-device (will be added in follow-up PRs) - Remove corresponding cards and Details accordion from replace-vpn navigation page - Keep setup landing page cards as-is (all link to existing content)
- Align implementation guides card titles with get-started landing page - Replace code block flow diagram with prose in How it works section - Promote 'You need' list to standard Prerequisites heading - Fix future tense to present tense throughout - Break multi-page navigation into separate procedural steps - Genericize tunnel token placeholder in install command example - Replace AI-generated troubleshooting with links to canonical docs - Use standard 'refer to' link pattern for recommended next steps - Remove unused Details component import
- Add value framing to intro (VPN security risks and performance) - Explain why outbound-only tunnel matters (no inbound ports) - Link WARP client on first mention - Add context for IP range step and helper note for SMB users - Define cloudflared as connector software - Rewrite enrollment step to replace jargon with plain language - Add context for team name (what it is, where it came from) - Replace em dashes with colons throughout
- Rewrite replace-vpn intro to use Cloudflare One branding and ZTNA framing - Align card descriptions across replace-vpn and implementation-guides pages - Expand How it works with network connector and device agent definitions - Add team name Settings path for discoverability - Add Windows system tray reference and manual deployment link in Step 5 - Rewrite next steps with why context instead of dashboard-suggests framing
- Add architecture selection (dashboard has OS + architecture dropdowns) - Remove incorrect winget/package manager claims for Windows/Linux - Accurately describe dashboard behavior: download link + install command - Keep Windows Command Prompt and terminal window text matching dashboard verbatim - Link to Downloads page for comprehensive reference
- Use 'service' instead of 'software' for cloudflared description - Move team name Settings path to note callout under Step 5 - Reorder Step 6 sentence for clarity
|
This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:
|
…oss-link to device-to-network - Add GlossaryTooltip for Cloudflare Tunnel and WARP client on first mention - Change 'device agent' to 'app' for plain language consistency - Break 4-sentence How it works paragraph into two 2-sentence paragraphs - Add Cloudflare account prerequisite with link to parent setup page - Add parent cross-link for other connection scenarios (scales to future flows) - Replace 'device posture' with 'network attributes' in Gateway policies description - Remove inaccurate 'multi-site deployments' from learning path references
479b499 to
33592e7
Compare
- Add concrete use case and cross-link to device-to-network sibling page - Replace technical jargon (TCP/UDP/ICMP, overlay network) with plain examples - Add GlossaryTooltip components for WARP client and WARP CGNAT IP - Add Cloudflare account prerequisite with link to parent setup page - Clarify enrollment email purpose and add practical send suggestion - Add anchor link from Step 3 back to Step 2 for second device setup - Add post-setup guidance in Step 4 (where to find virtual IPs) - Surface Windows Firewall issue in Troubleshoot section - Replace undefined 'device mesh' jargon with 'connected devices' - Break long paragraphs into 2-sentence chunks per style guide - Remove inaccurate 'multi-site deployments' from index.mdx note
…ice-to-device intro Replace direct link to device-to-network with link to parent Replace your VPN index page. This pattern scales as more onboarding flows are added without requiring updates to every sibling page.
33592e7 to
66aeb4a
Compare
…t-started-device-to-device # Conflicts: # src/content/docs/cloudflare-one/setup/replace-vpn/device-to-network.mdx # src/content/docs/cloudflare-one/setup/replace-vpn/index.mdx
|
@alexamavrogianis — requesting your review on the device-to-device page, same flow as #28716. |
|
|
||
| ## Step 1: Enroll your first device | ||
|
|
||
| In this step, you set an enrollment email and download the WARP client. The email you provide becomes the first allowed login for your organization, and anyone with that email address can enroll a device. |
There was a problem hiding this comment.
May be worth adding a line that enrollment permissions determine who can connect devices to your account
There was a problem hiding this comment.
Added a sentence at the top of the Step 1 intro introducing enrollment permissions as a concept: "Enrollment permissions control which users can connect devices to your account." The existing note below still points to where these can be managed later.
|
|
||
| After verifying your connection, consider securing your connected devices with policies and access controls: | ||
|
|
||
| - **Set up Gateway policies**: By default, all enrolled devices can reach each other over the virtual IP space. Gateway policies let you inspect traffic and control access based on user identity and network attributes. For more information, refer to [DNS policies](/cloudflare-one/traffic-policies/dns-policies/) and [Network policies](/cloudflare-one/traffic-policies/network-policies/). |
There was a problem hiding this comment.
Might have missed this in the other one, but we should probably frame this as "scan, filter, and log traffic" and also make sure we don't leave out HTTP policies.
There was a problem hiding this comment.
Updated to use "scan, filter, and log traffic" framing and added HTTP policies link alongside DNS and Network policies.
| After verifying your connection, consider securing your connected devices with policies and access controls: | ||
|
|
||
| - **Set up Gateway policies**: By default, all enrolled devices can reach each other over the virtual IP space. Gateway policies let you inspect traffic and control access based on user identity and network attributes. For more information, refer to [DNS policies](/cloudflare-one/traffic-policies/dns-policies/) and [Network policies](/cloudflare-one/traffic-policies/network-policies/). | ||
| - **Create an Access application**: Restrict access to specific services running on your devices with identity-based rules. For more information, refer to [Secure a private IP or hostname](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). |
There was a problem hiding this comment.
The services don't have to be running on their devices, you can put Access policies in front of a variety of different destinations.
There was a problem hiding this comment.
Good catch — removed "services running on your devices" since Access applications can protect any destination reachable through the connection. Now reads "Restrict access to specific destinations with identity-based rules."
- Add enrollment permissions concept to Step 1 intro - Reframe Gateway policies as 'scan, filter, and log traffic' and add HTTP policies link - Broaden Access application description to not limit scope to device-hosted services
Specify 'on enrolled devices' to align with the more concrete pattern used on device-to-network and network-to-network sibling pages.
|
CC @caley-b for viz |
Resolve conflict in device-to-network.mdx: keep the Render partial (branch version) over inline content (production version). The partial extraction was an intentional refactor in this branch.
Align with network-to-network sibling page tags added by Caley.
| @@ -0,0 +1,96 @@ | |||
| --- | |||
| pcx_content_type: get-started | |||
| title: "Device to device" | |||
There was a problem hiding this comment.
Does this make sense in the context of the right-side index? I would add more context even if that's true, because "Device do device" seems a bit shallow?
There was a problem hiding this comment.
Thanks for flagging. I went with short titles here to match the dashboard wizard labels and keep the sibling pages consistent (Device to network, Network to network). The parent label "Replace your VPN" in the sidebar provides additional context, similar to how the WARP Connector reference pages use "Site-to-site" and "User-to-site." The description frontmatter field adds more context for search and the page index.
| ## Step 2: Set your Tunnel's IP range | ||
|
|
||
| Add the IP range of your private network to the tunnel. This defines which internal resources your remote users can reach. Your tunnel accepts traffic to this range from devices enrolled in your Zero Trust organization. | ||
| Add the IP range of your private network to the Tunnel. This defines which internal resources your remote users can reach. Your Tunnel accepts traffic to this range from devices enrolled in your Zero Trust organization. |
There was a problem hiding this comment.
This here seems like it's referring to the generic "tunnel" that Cloudflare Tunnel creates. I think it should stay lowercase tunnel. If you want to refer to the product, maybe it's better to change the sentence to Add the IP range of your private network to Tunnel - although this seems weird, and doesn't make sense?
Same comment on the next sentence: Your Tunnel accepts traffic to this range should probably be Tunnel accepts traffic to this range or Your configured tunnel accepts traffic to this range
There was a problem hiding this comment.
Thanks for the catch. You're right that this refers to the tunnel instance, not the product name. Reverted to lowercase.
Refers to the tunnel instance, not the Cloudflare Tunnel product name. Reverts to match production.
Align with sibling pages. Matches the tagging pattern used across the WARP Connector reference docs.
Resolve conflict in replace-vpn index.mdx: keep both the device-to-device card (from this branch) and the network-to-network card (from production).
4 participants
Adds a device-to-device (WARP-to-WARP) quick-start page for the Replace VPN flow, mirroring the Cloudflare One dashboard onboarding wizard. Follows up on #28716 (device-to-network). Part of the CF1 Get Started docs effort (PCX-20916).
device-to-device.mdx— 4-step quick-start matching the dashboard wizard (enroll first device, complete WARP setup, enroll second device, verify connection). Includes Windows Firewall troubleshooting callout specific to WARP-to-WARP traffic.warp/complete-warp-setup.mdx— extracted the WARP install and enrollment steps shared between device-to-network and device-to-device, parameterized withdevice("your" vs "your first").device-to-network.mdx: replaced inline WARP setup steps with the new partial. Also capitalized "Tunnel" as a product name in Step 2 per Marcio's post-merge feedback on [Cloudflare One] Get Started: Replace VPN — Device to Network quick-start (PCX-20915) #28716.replace-vpn/index.mdx: added a card for the new device-to-device page.