Background on Cloudflare One (Cloudflare's Zero Trust / SASE platform), built through pre-bootcamp online training. The bootcamp itself is upcoming: Cloudflare One bootcamp (London, 28 Sep 2026). No adoption plan exists yet — the phases below are Cloudflare's suggested implementation approach, which could form the basis of a proposal if a relevant conversation arises. Training: completed courses · to do (Advanced learning path).
Cloudflare's suggested implementation plan
Phase 1: Secure a few critical apps with Access (VPN replacement pilot)
Publish the pilot apps with Cloudflare Tunnel (cloudflared) — outbound-only connections to Cloudflare's edge, so no public IP and no inbound firewall ports; the origin stays hidden. Then gate each app with Access (ZTNA): users authenticate via identity + device/context policy instead of a VPN. That combination (Tunnel + Access) is the VPN replacement.
Phase 2: Roll out the device client to remote workers (SWG + device posture)
Roll out the WARP device client to remote workers, enrolled to the org, so their traffic routes through Gateway (SWG) — DNS/URL filtering, malware blocking, inline DLP, and RBI for risky sites. Enforce device posture (OS/patch level, disk encryption, running security agent, client certificate, etc.) as a condition of access, so only healthy devices reach apps.
Phase 3: Connect branch offices with Magic WAN
Connect branch offices with Magic WAN — Anycast IPsec or GRE tunnels from each site's router/firewall, or the Magic WAN Connector appliance (physical/virtual) for near plug-and-play onboarding (SD-WAN, automatic tunnels). Inter-site traffic then rides Cloudflare's fabric and is secured inline by the same SSE stack (Gateway/SWG, firewall). Replaces MPLS / hub-and-spoke back-haul.
Phase 4: Add advanced features (CASB, DLP, RBI, Email) as needed
Terms
- Access: Cloudflare's per-app Zero Trust access product (reverse-proxy/identity-gated). See ZTNA below.
- WARP (device client): Cloudflare's endpoint agent — routes enrolled device traffic through Gateway/SWG.
- SWG (Secure Web Gateway): a cloud proxy between users and the internet — URL/category filtering, malware and malicious-site blocking, TLS inspection, and acceptable-use / DLP enforcement on outbound web traffic.
- Magic WAN: Cloudflare-fabric WAN/branch connectivity — Anycast IPsec or GRE tunnels from site routers/firewalls, or the Magic WAN Connector appliance. Replaces MPLS / hub-and-spoke back-haul.
- RBI (Remote Browser Isolation): runs the browsing session in an isolated cloud container and streams only a safe render to the device, so web code never executes locally — defends against web malware, phishing and zero-days, and can lock down copy/paste/print/upload on risky or untrusted sites.
- ZTNA (Zero Trust Network Access): brokers per-application access on a default-deny basis — a verified user/device reaches only the specific apps it's authorised for (not the whole network), with identity, device posture and context checked on every request. Replaces VPNs; apps stay hidden behind a broker/connector instead of being exposed to the internet.
- CASB (Cloud Access Security Broker): sits between users and cloud/SaaS apps for visibility and control — discovers sanctioned and shadow-IT usage, enforces access/sharing/DLP policy on SaaS data, and flags misconfiguration, risky sharing and anomalous behaviour. Works inline (proxy) and/or via SaaS APIs (out-of-band scanning of e.g. M365, Google Workspace, Salesforce).
- DLP (Data Loss Prevention): detects and stops sensitive data (PII, PCI, PHI, secrets, source/IP) leaving the org — inspects content in web, email and SaaS traffic (and data at rest) using patterns, classifiers and fingerprints, then blocks, quarantines or logs risky uploads, downloads, shares or emails. Enforced across the SASE data path (SWG, CASB, email).
- Email: Cloudflare's email security product — inbound/outbound filtering, phishing and malware protection.
What is SASE?
SASE (Secure Access Service Edge; Gartner-coined, 2019) converges networking and network-security into a single, cloud-delivered, identity-driven service, enforced at distributed edge points close to users and apps — instead of backhauling traffic to a central data centre or over a VPN. Shorthand: SASE = SD-WAN (the network layer) + SSE (Security Service Edge — the security half: ZTNA, SWG, CASB, FWaaS, DLP, RBI); i.e. “SSE is SASE minus the SD-WAN”. Single-vendor SASE (Gartner) = one vendor delivering that converged networking + security across all edges. Cloudflare One is Cloudflare's SASE platform — the subject of this note.
- Cloud-native and edge-delivered, close to users/apps — no VPN backhaul, lower latency.
- Identity- and context-centric access (Zero Trust), based on who/what not network location.
- Converged: one platform and one policy engine — define once, enforce everywhere.
- Covers all edges: remote users, branch offices, data centres and cloud.
The Core Components of SASE
| Component | What it does | Why you need it |
|---|
| Network Services | SD-WAN, routing, load balancing, traffic optimization | Connect offices, data centres and cloud environments efficiently |
| Security Services | ZTNA, SWG, Email, CASB, DLP, Firewall, RBI | Protect users, devices and data from threats |
| Policy Engine | Centralized policy management | Define once, enforce everywhere |
| Operational Services | Logging, APIs, analytics | Visibility and control across your entire environment |
Cloudflare network scale (as of Sep 2026): 330+ cities across 120+ countries (Cloudflare's own figure). Passed 300 cities in 2023 and still expanding, so treat as “~330+ and growing”. Live count: cloudflare.com/network. Relevant to SASE: enforcement happens close to users at these edge locations.
How Gateway routes a request (on-ramps)
- User device sends a request (web browsing, application access, etc.).
- The request reaches Gateway via one of several “on-ramps” (below).
- Gateway inspects the request against the configured policies.
- If allowed, Gateway proxies the request onward to the destination.
- WARP client — device agent for laptops/phones.
- DNS resolver — point devices at Gateway's DNS.
- Proxy endpoints — PAC files for browser-based routing.
- Network tunnels — IPsec / GRE from entire offices/networks via Cloudflare (Magic WAN), or the WARP Connector.
Identity / SSO protocols (used by Access)
- SAML (Security Assertion Markup Language): XML-based SSO/federation standard — the identity provider (IdP) sends a signed XML “assertion” to the app (service provider) to authenticate the user. Established enterprise web SSO.
- OIDC (OpenID Connect): modern SSO/identity layer built on OAuth 2.0, using JSON/JWT ID tokens; common for web, mobile and API apps — lighter and newer than SAML.
- SCIM (System for Cross-domain Identity Management): automates identity provisioning — syncs user accounts and group memberships between systems (e.g. IdP → SaaS / Cloudflare), auto-creating, updating and de-provisioning users. (SAML/OIDC authenticate a login; SCIM keeps the accounts and groups in sync.)
Cloudflare course notes — Define scope (Module 10)