Current lab guide: WebDAV root PDF — 1 October 2026, 12:45. Local: /home/john/cloudflare/Cloudflare Zero Trust & SASE - Lab Guide.pdf; text: /home/john/cloudflare/lab-guide.txt. Supersedes the September 29 guide; old copies deleted. Team: unparalleled-quarterback. Bootcamp
| Lab | Status | Notes |
|---|---|---|
| Lab 1 — Identity & Account Baseline | Complete | SAML IdP, baseline settings, logs, domain registered |
| Lab 2 — Device Profile & Enrollment Setup | Complete | Lab-Profile created, enrollment policy, split tunnel |
| Lab 3 — Deploy Cloudflare One Client | Complete | MSI installed on Windows desktop (win-desktop), enrolled as itadmin@acmecorp.com |
| Lab 4 | Complete | |
| Lab 5 | Complete | Internal DNS zone cf1pslabs.int, lock-down behaviors verified |
| Lab 6 — Cloudflare Tunnel & Routing | Complete | Lab-Tunnel active, route 10.91.0.0/24 → Lab-Tunnel. TCP and ICMP both working. ICMP fix: net.ipv4.ping_group_range was inverted (1 0); set to 0 2147483647 in /etc/sysctl.d/99-cloudflared-icmp.conf and cloudflared restarted. |
| Lab 7 — DNS Location for Server-Side Filtering | Complete | Ubuntu Server DNS location created, dnsproxy forwarding to DoH endpoint, malware.testcategory.com query visible in DNS logs with no user email (location-based, not WARP identity). |
| Lab 8+ | Not started |
| Lab | Status | Notes |
|---|---|---|
| Lab 1 — Identity & Account Baseline | Complete | SAML IdP, baseline settings, logs, domain registered |
| Lab 2 — Device Profile & Enrollment Setup | Complete | Lab-Profile created, enrollment policy, split tunnel |
| Lab 3 — Deploy Cloudflare One Client | Complete | MSI installed on Windows desktop (win-desktop), enrolled as itadmin@acmecorp.com |
| Lab 4 | Complete | |
| Lab 5 | Complete | Internal DNS zone cf1pslabs.int, lock-down behaviors verified |
| Lab 6 — Cloudflare Tunnel & Routing | Complete (with caveat) | Lab-Tunnel active, route 10.91.0.0/24 → Lab-Tunnel. TCP to Ubuntu Server (10.91.0.91) confirmed working. ICMP (ping) does not work — see open issue below. |
| Lab 7+ | Not started |
Symptom: ping 10.91.0.91 from the Windows desktop times out. Test-NetConnection -ComputerName 10.91.0.91 -Port 80 succeeds (TcpTestSucceeded: True), confirming the tunnel routes TCP correctly.
What was checked and confirmed OK:• ICMP enabled in Traffic controls → Traffic settings → Proxy and inspection settings
• cap_net_raw=ep set on /usr/bin/cloudflared on the Ubuntu Server
• Ubuntu Server can self-ping 10.91.0.91
• cloudflared service running and healthy
• Route 10.91.0.0/24 → Lab-Tunnel present in dashboard
• 10.91.0.0/24 not in split-tunnel exclude list
• Duplicate device registration cleaned up (two win-desktop entries for itadmin@acmecorp.com; older one deleted)
• Gateway Network logs show Allow entries but no ICMP traffic visible
• tcpdump on Ubuntu Server shows zero ICMP packets — cloudflared is not receiving ICMP from Cloudflare edge
Likely cause: ICMP proxying from Cloudflare edge to cloudflared connector is not working in this environment. The edge is not forwarding ICMP packets to the tunnel even though TCP flows correctly. Possibly a known limitation or environment-specific quirk.
To investigate if returning to this:
• Enable debug logging on cloudflared (Lab 6 step 6.9) and re-run ping to see if ICMP arrives at cloudflared at all
• Check if a Gateway network policy explicitly allowing ICMP to 10.91.0.0/24 makes a difference
• Check Cloudflare community/docs for ICMP proxying limitations with MASQUE protocol
• Windows desktop: 10.90.0.90 (hostname win-desktop), WARP version 2026.7.1376.0
• Ubuntu Server: 10.91.0.91 (hostname origin-primary), cloudflared installed as systemd service
• WARP mode: WarpWithDnsOverHttps, protocol: MASQUE
• Lab-Tunnel token file: /etc/cloudflared/token
• MDM file: C:\ProgramData\Cloudflare\mdm.xml (auth_client_id placeholder — gets filled in at step 9.8)