Verify
Corporate IdP, MFA, group membership, managed enrollment, and device health.
CLOUDFLARE
CLOUDFLARE ONE SOLUTION DESIGN
Executive Technical Whitepaper
Modern Private Access Without the Legacy VPN
A seven-page design for identity-aware access, device posture, SonicWall IPsec, Cloudflare Tunnel, and precise traffic steering.
Recommended outcome
Users connect through the Cloudflare One Client. Access and Gateway apply the configured identity, device, and traffic controls to applicable requests and new connections. Private resources connect through redundant cloudflared replicas or SonicWall IPsec tunnels, without treating network location as authorization.
Prepared for: UFGCreated by: Chelsee Purvis - Senior Specialist SEAugust 2026
01 | Strategy and Architecture
Replace network access with verified requests
A legacy VPN authenticates a user and places the device on a network. For steered traffic, Access and/or Gateway evaluate the attributes applicable to each HTTP request or new network connection. Evaluation and revocation behavior vary by protocol and policy type.
Limit
Named applications, exact hostnames/CIDRs, approved ports, and short sessions.
Observe
Access decisions, Gateway flows, posture results, and connector health in one control plane.
Managed DeviceOne Client
identity + posture
identity + posture
→
Cloudflare EdgeAccess + Gateway
policy decision
policy decision
→
Private On-rampSonicWall IPsec
or cloudflared
or cloudflared
→
ResourcesWeb, SSH, RDP
DB and APIs
DB and APIs
The IdP, MDM, and EDR provide context. Routes provide reachability, not authorization.
Request workflow
| Step | Action | Control |
|---|---|---|
| 1 | MDM enrolls the device; user signs in through the approved IdP. | MFA, group, managed enrollment |
| 2 | The client reports posture and steers the intended destination. | Device profile and split tunnel |
| 3 | The applicable engine evaluates available identity, device, resource, and traffic attributes. | Access and/or Gateway policy |
| 4 | A healthy private connector carries an allowed flow to the resource. | IPsec route or Cloudflare Tunnel |
| 5 | The decision and available flow metadata are logged. | Cloudflare logs and SIEM |
Product roles: Access applications are deny-by-default. Gateway enforces DNS, HTTP, and network policy but allows unmatched traffic by default; UFG must add a lowest-precedence catch-all Block rule where restrictive Gateway behavior is required.
02 | Detailed Architecture
Separate identity, policy, and connectivity
Cloudflare becomes the distributed policy enforcement layer. UFG retains authoritative identity and device systems while each private environment connects through the on-ramp that best matches its routing model.
End-to-end request path
UFG EndpointOne Client + device certificate
→
Cloudflare Global NetworkAccess + Gateway + route selection
→
Private ResourceApplication or private IP/port
Decision inputs
Identity plane
UFG IdP, MFA method, lifecycle, SCIM synchronization, service identity.
Device plane
One Client, MDM compliance, EDR health, encryption, OS and certificate.
Policy plane
Access default deny; explicit Gateway Allow plus catch-all Block where required.
Telemetry plane
Access decisions, network flows, posture, connector health, SIEM export.
Private route domains
SonicWall site
Cloudflare WAN ↔ redundant route-based IKEv2 tunnels ↔ application VLANs.
↓
cloudflared environment
Two outbound-only replicas serve hostname or CIDR routes associated with the logical tunnel.
↓
Common enforcement
Identity, posture, destination, port, protocol, and logging remain consistent.
Policy and routing boundaries
| Layer | Decision | UFG design rule |
|---|---|---|
| Client steering | Does this destination enter Cloudflare? | Use exact Include routes for pilots; consider Exclude mode only where broader inspection is intended. |
| Private routing | Which healthy path reaches the resource? | Keep a route registry; avoid overlap; use longest-prefix and intentional priority. |
| Authorization | May this user/device use this app or port? | Access requires a matching Allow. Gateway needs narrow Allows above an explicit catch-all Block for restrictive mode. |
| Origin firewall | Which source reaches the service? | Allow connector-host IPs for cloudflared; allow designed routed source prefixes for Cloudflare WAN. |
| Return path | Can responses return correctly? | For WAN, route the assigned device VIP prefix (default 100.96.0.0/12) back through Cloudflare; review NAT. |
High availability: place replicas on independent hosts and failure domains; use diverse WAN tunnels. Test reconnection and application-session impact.
Private DNS: coordinate resolver selection with Split Tunnels. Local Domain Fallback runs client-side before Gateway Resolver policies.
03 | Identity and Device Assurance
Policies built around people, devices, and risk
Use role-based rules. In Access, at least one Include is required; multiple Includes are OR. Every Require must pass, and any Exclude match prevents that policy from granting access.
| Resource tier | Identity requirement | Device/context objective | Session target |
|---|---|---|---|
| T0 Critical Production administration | Named privileged group; verified approved MFA method | Privileged posture, approved source country, acceptable user risk | 1 hour or less |
| T1 Restricted Finance, HR, production data | Role-specific group plus MFA | Managed, encrypted, EDR healthy, supported OS | 4-8 hours |
| T2 Internal Intranet, tickets, internal APIs | Employee or approved partner group | Enrollment in UFG Zero Trust and baseline posture | 8-24 hours |
| Service HTTP(S) automation/APIs | Scoped service token or valid client certificate | Protocol support, source controls, credential rotation | Credential-specific |
Human access example
Include: Finance-Production
Require: approved MFA claim, privileged posture, approved country
Exclude: contractor group
HTTP(S) machine example
Action: Service Auth
Include: payroll-api-prod service token
Require: approved source
Alternative policy: valid client certificate
Recommended posture profiles
| Profile | Signals | Use |
|---|---|---|
| Enrollment | Customer organization, Gateway connected, certificate/serial | Minimum entry |
| Managed baseline | Enrollment, disk encryption, host firewall, supported OS/client | Standard applications |
| Security healthy | Baseline, MDM compliance, EDR healthy, no critical finding | Restricted applications |
| Privileged | Security healthy, stronger certificate, tight patch level | Administrative access |
Operational safeguards: posture polling plus Gateway's five-minute cache can delay a changed result. A later failure does not end an active network session; Cloudflare session expiry also does not terminate active SSH/RDP/VNC. Use origin idle/max-session controls. SCIM behavior and latency depend on the IdP; enable supported deprovisioning/session revocation.
Control availability depends on plan, platform, IdP claims, and MDM/EDR integration. User Risk Score requires an eligible Enterprise plan; country uses public source-IP geolocation. Access evaluates Bypass and Service Auth first in displayed order, then Block and Allow. Avoid Bypass because it removes Access enforcement and request logging.
404 | Private Network On-ramps
Two connection models, one policy plane
SonicWall IPsec
- Best for routed sites and subnet integration.
- Route-based IKEv2 to an account-assigned Cloudflare WAN anycast endpoint.
- Unique interface subnet per tunnel; /31 recommended, /30 supported.
- Requires an active Cloudflare WAN subscription; validate endpoint identity and NAT-T.
- Use two tunnels, diverse paths, route priorities, and health checks.
Cloudflare Tunnel
- Best for apps, cloud environments, and remote-user-to-resource access.
cloudflaredcreates outbound-only authenticated connections.- Requires no inbound opening or public origin address; separately remove any existing bypass path.
- Use replicas on independent hardened hosts.
- Associate exact private-hostname or CIDR routes with the tunnel.
SonicWall reference workflow
| Cloudflare | SonicWall | Validation |
|---|---|---|
| Create endpoints; record anycast IP, generated FQDN ID, PSK, and interface subnet. | Set Local IKE ID to the FQDN and Peer IKE ID to the Cloudflare anycast IPv4 address. | IKE and Child SAs establish. |
| Add tunnel and private routes via the SonicWall interface IP. | Create the tunnel interface; enable Ping and asymmetric route support. | Route UFG prefixes toward Cloudflare and the assigned client VIP prefix back through the tunnel. |
| Enable bidirectional request health checks and route priority. | Create VPN objects/rules; review NAT ordering and allow required ICMP management traffic. | Test new connections after tunnel, circuit, and firewall-node failure. |
Vendor-reference example: Cloudflare's tested SonicOS 7.0.1 profile uses IKEv2/PSK, DH20, AES-256 with SHA2-256, 86,400-second IKE lifetime; ESP AESGCM16-256, no separate integrity algorithm, PFS DH20, and 28,800-second Child SA lifetime. Validate on UFG's exact model, release, and crypto standard.
Return/security requirements: route the account's One Client VIP prefix (default 100.96.0.0/12) back through Cloudflare WAN; add the configured Cloudflare Source IP prefix (default 100.64.0.0/12) if applicable. Cloudflare's SonicWall reference disables IPsec anti-replay; require security approval. Cloudflare WAN supports GRE generally, but the SonicWall integration does not.
Cloudflare Tunnel workflow
- Inventory hostname/CIDR, protocol, port, DNS, origin firewall, and existing public bypass paths.
- Create a remotely managed tunnel and protect its connector token.
- Install replicas on independent hosts and associate narrow routes with the logical tunnel.
- Apply Access and/or explicit Gateway policy; test unauthorized flows, reconnection, and session impact.
Important: A private service typically sees the connector host's local source IP. Server-initiated traffic uses the server's normal route and does not traverse this outbound-only tunnel.
05 | Deployment Runbook
Build the service in controlled layers
Implement the policy plane before broad traffic migration. Each step has a clear artifact and validation gate so connectivity never becomes implicit authorization.
Establish Zero Trust administration
Configure UFG tenant settings, scoped admin roles, change control, emergency access, and audit-log retention.
Integrate identity
Add the production IdP, verify MFA claims/groups, then configure supported SCIM synchronization and revocation behavior.
Define reusable policy groups
Create employee, contractor, privileged, geography, service, and exception groups with named owners.
Enroll managed devices
Deploy the One Client by MDM with organization enrollment, tamper controls, update policy, and a pilot device profile.
Observe posture
Create baseline checks for enrollment, encryption, firewall, OS, certificate, MDM, and EDR. Validate before enforcement.
Connect a pilot resource
Build redundant SonicWall tunnels or cloudflared connectors, publish one narrow route, and restrict the origin firewall.
Apply least-privilege policy
Use an Access application and/or narrow Gateway Allow. Add a catch-all Gateway Block for private prefixes when restrictive mode is required.
Steer exact traffic
In Include mode add the pilot route, IdP, team domain, and protected app; coordinate the selected private resolver's route.
Export telemetry
Send Access, Gateway, posture, and connector events to the SIEM. Alert on denied spikes, unhealthy paths, and risk.
Test and expand
Run approved and denied scenarios, fail each connector, capture evidence, then promote by user and application wave.
Minimum policy pattern
1. Access application
Action Allow
ScopeApplication exact host/IP + port
IncludeIdP group APP-ROLE
RequireMFA + Posture
DefaultNo matching Allow: Deny
2. Gateway network
Actions Allow + Block
AllowDestination exact IP/CIDR + port
IdentityGroup + passed posture check
FallbackPrivate ranges catch-all Block
DefaultGateway otherwise allows unmatched traffic
Gateway evaluates network policy before private Access policy; a Gateway Allow never bypasses Access.Gateway may send an origin TCP SYN before policy evaluation.
Production readiness gates
Control planeIdP, groups, SCIM, posture, policy order, and logging validated.
Data planeDNS, routes, origin rules, MTU, return path, and two healthy connectors validated.
OperationsRunbook, monitoring, support ownership, rollback, and change window approved.
Required negative tests: deny correct user with failed posture; deny wrong group despite route availability; block an unapproved port; and verify new/retried connections recover after primary-path loss. Retain posture, Access/Gateway, and connector logs as evidence.
606 | Migration and Onboarding
Move exact traffic, application by application
Include mode: scoped pilot
Only matching IP traffic uses the One Client; other IP traffic bypasses Gateway Network/HTTP policy. DNS still uses Gateway unless Local Domain Fallback applies.
Exclude mode: broader-inspection option
Non-excluded IP traffic uses Cloudflare. Adopt where UFG's Secure Web Gateway scope and endpoint compatibility require it; DNS remains separately controlled.
Precise pilot steering
| Entry | Purpose | Notes |
|---|---|---|
10.24.10.0/24 | Finance application subnet | Prefer exact CIDRs. |
10.24.20.15/32 | Privileged SSH bastion | Authorize port 22 separately. |
<team>.cloudflareaccess.com | Access authentication/posture | Required in Include mode. |
| Corporate IdP and protected app domains | Authentication and policy | Must traverse the client for posture. |
DNS: Split Tunnels steer IP traffic, not DNS disposition. Use Gateway Resolver policies when Cloudflare should select a private resolver; use Local Domain Fallback when the endpoint should query a customer resolver, and route that resolver IP correctly. Domain routes are dynamic, can capture shared IPs, differ on mobile, and require client-observed DNS; prefer IP/CIDR.
Phased onboarding
1Discover
Inventory applications, owners, routes, ports, dependencies, DNS, IdP groups, endpoint posture, SonicWall versions, and success criteria.
2Foundation
Integrate IdP/MFA, configure supported SCIM sync/revocation, establish roles, create posture, and export available logs.
3Pilot
Deploy independent connector replicas or WAN tunnels, map one exact route, enroll an IT cohort by MDM, and start with Include mode.
4Enforce
Add identity and posture policy after observing signals. Test approved, wrong-group, failed-posture, and wrong-port scenarios.
5Expand
Migrate waves by application. Add route, DNS, firewall, policy, and split entry; remove each legacy VPN route after acceptance.
6Retire
Move appropriate profiles to Exclude mode, revoke VPN enrollment/credentials, and decommission routes and concentrators under change control.
Go-live gate: redundant connectors healthy; identity and posture pass; unauthorized tests deny; DNS and split steering validated; logs in SIEM; support runbook and rollback rehearsed.
References: developers.cloudflare.com/cloudflare-one/access-controls/policies/ | /reusable-components/posture-checks/ | /team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/ | /networks/connectors/cloudflare-tunnel/ | developers.cloudflare.com/cloudflare-wan/configuration/third-party/sonicwall/
Technical validation: Product behavior reviewed against official Cloudflare documentation on August 31, 2026. Before deployment, confirm UFG's licensed features, assigned VIP/source ranges, SonicWall model and SonicOS release, cryptographic standard, topology, and non-production results.
7