skills.rest
Aki2022
Aki2022COMMUNITY
Explore all skills by this author →
GitHub

cloudflare-one

Guides design, configuration, and troubleshooting of Cloudflare One Zero Trust deployments.

Updated Dec 9, 2025
Search Tags:#cloudflare#network security#zero trust#gateway#warp#sase#ztna
One-click install
npx skills add https://github.com/Aki2022/skills --skill cloudflare-one-aki2022
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cloudflare-one
Source: https://github.com/Aki2022/skills/tree/main/cloudflare-one
Command: npx skills add https://github.com/Aki2022/skills --skill cloudflare-one-aki2022

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Cloudflare One spans many products (Access, Gateway, WARP, Tunnel, WAN, DLP, CASB), and misconfiguring policies, split tunnels, or TLS inspection causes outages and security gaps. This Skill structures architecture, configuration, and troubleshooting work with retrieval-first guidance against current Cloudflare docs. ## Core Features & Use Cases - Architecture and rollout planning: Assessment prompts for sites, identity providers, connectivity, and phased rollouts with rollback plans. - Configuration guardrails: Product-specific rules for Access policies, Gateway evaluation order, split tunnel modes, TLS inspection, DLP, CASB, and device posture. - Troubleshooting workflows: Log-driven diagnosis using Gateway activity logs, Access audit logs, DEX, and tunnel health checks. - Use Case: When migrating remote users from a legacy VPN to Cloudflare WARP with private app access, the Skill walks through tunnel routing, split tunnel mode selection, enrollment rules, and validation tests before broad rollout. ## Quick Start Ask the assistant to design a Cloudflare One rollout plan for replacing your VPN with WARP and Cloudflare Tunnel for private application access.

Frequently Asked Questions about cloudflare-one

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure Cloudflare Access for a private application?▼

Private applications require the WARP device client or another network on-ramp plus tunnel routes and DNS resolution, not just an Access app. Create the Access application with an Allow policy, publish routes through Cloudflare Tunnel, and configure resolver policies for private hostnames.

How do I choose between split tunnel include and exclude mode in WARP?▼

Use Include mode for VPN replacement only, routing just private CIDRs through the client. Use Exclude mode for secure web gateway deployments where all traffic goes through Cloudflare except specific exclusions. The mode is per-profile and cannot be mixed.

Does Cloudflare Gateway require TLS inspection for DLP?▼

Yes, HTTP inspection and DLP for encrypted web traffic require TLS inspection with the Cloudflare root CA deployed to managed devices. Certificate-pinned applications need Do Not Inspect exceptions configured before enabling broad inspection.

Why is my Cloudflare Access policy blocking users with correct group membership?▼

Group-based policies depend on IdP group claims or SCIM sync, and membership can be stale until sync and re-authentication complete. Verify exact case-sensitive claim names and troubleshoot using the user's last authenticated identity in Access audit logs.

What is the difference between Cloudflare Tunnel and Cloudflare WAN?▼

Cloudflare Tunnel is an off-ramp connecting private networks to Cloudflare via cloudflared connectors. Cloudflare WAN provides site-to-site connectivity and can act as both on-ramp and off-ramp, but is gated behind Enterprise subscriptions.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

implementing-cisa-zero-trust-maturity-model

Assess and implement CISA Zero Trust Maturity Model v2.0 across five pillars.

Community
Intermediate
xalgordxalgord
954

investigating-phishing-email-incident

Investigates phishing email incidents through header analysis, URL detonation, scope assessment, and containment.

Community
Advanced
refractionPOINTrefractionPOINT
29

sensor-coverage

Inventory assets and assess sensor coverage for LimaCharlie endpoints.

Official
Advanced
cloudflarecloudflare
2.6k

cloudflare-one-migrations

Automates network and security stack migration to Cloudflare One with assessment and policy mapping.

Official
Advanced