skills.rest
sota411
sota411COMMUNITY
Explore all skills by this author →
GitHub

cloudflare-one

Guides design, configuration, and troubleshooting of Cloudflare One Zero Trust deployments.

1|Updated Jul 16, 2026
Search Tags:#cloudflare#tunnel#zero trust#gateway#dlp#ztna#access policy
One-click install
npx skills add https://github.com/sota411/codex-config --skill cloudflare-one-sota411
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cloudflare-one
Source: https://github.com/sota411/codex-config/tree/main/user-skills/cloudflare-one
Command: npx skills add https://github.com/sota411/codex-config --skill cloudflare-one-sota411

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Cloudflare One spans Access, Gateway, WARP, Tunnel, WAN, DLP, and CASB, and misconfiguring any boundary between them causes broken connectivity or unintended exposure. This Skill provides structured workflows and guardrails so changes are planned, validated, and rolled back safely. ## Core Features & Use Cases - Design and Configuration Guidance: Walks through assessment prompts, prerequisites, exact resources to change, validation steps, and rollback plans for Access apps, tunnels, Gateway policies, TLS inspection, and DLP. - Troubleshooting Workflow: Traces failures from Gateway activity logs and Access audit logs back to the responsible rule, route, or policy instead of guessing. - Safety Guardrails: Enforces rules like never guessing category IDs or API bodies, starting broad policies in disabled or pilot scope, and keeping secrets out of transcripts. - Use Case: When migrating from a legacy VPN to ZTNA, use it to plan tunnel routes, split tunnel mode, enrollment rules, and device profiles, then verify end-to-end access from a test device before rollout. ## Quick Start Ask the assistant to design a Cloudflare Access policy and private tunnel route for an internal application, including validation and rollback steps.

Frequently Asked Questions about cloudflare-one

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure Cloudflare Access for a private application?▼

Private applications need a network on-ramp such as Cloudflare Tunnel or WARP, matching routes, and DNS resolution in addition to the Access application. Creating the Access app alone is insufficient, and an Allow policy is required because Access is default-deny.

What is the difference between Cloudflare Access and Gateway?▼

Access controls application authorization based on identity, while Gateway controls traffic inspection and filtering for DNS, HTTP, and network flows. Requirements spanning both identity-aware app access and web security use the two together.

Which split tunnel mode should I use for WARP?▼

Use Include mode for VPN replacement only or coexistence with another VPN, and Exclude mode for secure web gateway deployments where all traffic routes through the client. Mode is per-profile and entries must align bidirectionally with tunnel routes.

Why is my Gateway group-based policy not matching users?▼

Gateway group selectors use synced IdP groups via SCIM, not Cloudflare Access Groups, and group names and claims are case-sensitive. Membership can also be stale until SCIM sync and user re-authentication complete.

Can I enable TLS inspection and DLP without breaking applications?▼

Deploy the Cloudflare root CA to managed devices first and create Do Not Inspect exceptions for certificate-pinned applications before enabling inspection. Start DLP with payload logging to tune false positives before switching to block actions.

How do I troubleshoot why Cloudflare Gateway blocked traffic?▼

Start from Gateway activity logs filtered by rule name, user, destination, and action to find the blocking decision, then trace back to the responsible rule and its evaluation order. DNS, HTTP, and Network policies have different evaluation semantics, so check the order of enforcement documentation.

Related Skills

Explore More Software Engineering Skills→
lzx0122lzx0122

network-engineer

Design and analyze multi-region cloud and on-premise network architectures.

Community
Advanced
starwreckntxstarwreckntx

Security Information & Event Management Agent

Aggregate and correlate logs from multiple sources to detect security incidents.

Community
Basic
Git-FgGit-Fg

mobile-testing

Automate mobile-app UI and end-to-end tests via the mobile-mcp server.

Community
Intermediate
xalgordxalgord
954

deploying-palo-alto-prisma-access-zero-trust

Deploy Palo Alto Prisma Access SASE with ZTNA Connectors, GlobalProtect agents, and HIP-based security policies.

Community
Advanced