domains / families / security / deploying-cloudflare-access-for-zero-trust

deploying-cloudflare-access-for-zero-trust

separate

Deploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-aware policies, device posture checks, and WARP client enrollment as a VPN replacement. Use when replacing VPN with Cloudflare One, exposing internal apps without open inbound ports, or securing contractor/third-party access to specific applications.

When to use

• When replacing VPN infrastructure with identity-aware application access using Cloudflare One
• When exposing self-hosted internal applications through Cloudflare Tunnel without opening inbound ports
• When implementing ZTNA for a distributed workforce accessing web applications, SSH, and RDP services
• When needing a cost-effective zero trust solution with integrated DLP, CASB, and SWG capabilities
• When securing contractor and third-party access to specific applications without full network access

When not to use

• applications requiring persistent UDP connections not supported by Cloudflare Tunnel
• environments requiring air-gapped or fully on-premises access control
• regulatory requirements prohibiting routing traffic through third-party cloud infrastructure

Skill page

Source