Skip to content

SolutionsZero Trust

Replace the VPN. Keep the business running.

Staff and third parties get access to each application, not to the whole network. We move you off the VPN one application at a time, so nobody stops working.

Book your 30-minute Cyber Resilience Review
Zero Trust · Cloudflare One

Definition

What is Zero Trust access?

Every request is checked for who is asking, from which device, for which application. Users reach only the apps they are allowed; the rest of the network stays invisible, and no inbound port is open.

From VPN to per-app access. Same users, fewer doors.

How a user reaches an internal app

VPN today

  • One sign-in opens the whole networkNetwork
  • Traffic travels through a central concentratorBackhaul
  • Third parties get a VPN accountShared
  • Device health is not checkedUnchecked
  • Inbound ports open on the firewallExposed

Per-app access

  • Each application is granted on its ownPer app
  • Users connect to the nearest Cloudflare locationDirect
  • Contractors sign in through a browserNo client
  • Device posture checked on every requestPosture
  • Cloudflare Tunnel connects outbound onlyNo open ports

What does Cloudflare One include? One policy engine.

Cloudflare One · components

Cloudflare One connects to Cloudflare Access, Gateway, WARP client, Browser Isolation, CASB and DLP, Identity provider, Device posture, Cloudflare Tunnel, Private applications.

Cloudflare One components on the left; your identity provider, device signals and applications on the right.

How do we move you off the VPN? In three phases.

  1. Phase 01

    Connect.

    WARP on managed devices; web and DNS filtering through Gateway. No new hardware.

  2. Phase 02

    Offload the VPN.

    Internal apps published through Cloudflare Tunnel, lowest-risk first. The VPN shrinks as each app moves.

  3. Phase 03

    Enforce per app.

    Identity and device posture on every request. The VPN is switched off when the last app has moved.

One partner, one contract, one accountable team.

The engineers who design your policies run them after go-live, and you talk to them directly.

Build, then run

Every access change is reviewed.

  • Architecture and policy design
  • VPN migration, application by application
  • Identity provider and device posture integration
  • Policy changes and regular reviews after go-live
cloudflare/access-finance.tfTerraform+3−1
resource "cloudflare_zero_trust_access_policy" "finance" {  account_id = var.account_id  name       = "Finance app: finance team"  decision   = "allow"  include    = [{ group = { id = var.idp_group_finance } }]Removed:   require    = []Added:   require    = [{HEALTHY DEVICES ONLYAdded:     device_posture = { integration_uid = var.disk_encryption }Added:   }]}
Policy checkopa · access-baselineFAIL · 1 app→PASS · 0 appsEvery private app requires a device posture check.

FAQ

Common questions.

For most use cases, yes. Cloudflare Tunnel carries web apps, SSH, RDP and SMB. Where a legacy protocol still needs it, we keep a small, tightly scoped tunnel as a fallback instead of the full VPN.

No. Zero Trust is added alongside what you have. Applications move one at a time, and the VPN stays available for the ones that have not moved yet.

It depends on how many applications you have and how they are reached today. We start with low-risk internal tools, and after the assessment you get a plan with dates for each application.

Both, if you want it. A migration project first, then the same engineers keep managing policies, reviews and changes afterwards. One partner, one contract.

We design for it: redundant Cloudflare Tunnel connectors on separate hosts, and a documented break-glass path for administrators that we test with your team.

Next step

Plan your move off the VPN.

Thirty minutes with an engineer: we look at how people reach your applications today and which ones could move first. You keep the findings either way.

Book your 30-minute Cyber Resilience Review