skills.rest
filippolmt
filippolmtCOMMUNITY
Explore all skills by this author →
GitHub

cloudflare-one

Design, configure, and troubleshoot Cloudflare One Zero Trust and SASE deployments.

1|Updated Jul 2, 2026
Search Tags:#cloudflare#network security#zero trust#gateway#warp#sase#ztna
One-click install
npx skills add https://github.com/filippolmt/skills --skill cloudflare-one-filippolmt
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cloudflare-one
Source: https://github.com/filippolmt/skills/tree/main/skills/cloudflare-one
Command: npx skills add https://github.com/filippolmt/skills --skill cloudflare-one-filippolmt

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Cloudflare One spans Access, Gateway, WARP, Tunnel, DLP, CASB, and Cloudflare WAN, and misconfiguring any of them causes broken connectivity, security gaps, or failed rollouts. This Skill guides architecture, configuration, troubleshooting, and review of Zero Trust deployments with current documentation and guardrails. ## Core Features & Use Cases - Architecture and Configuration Guidance: Classifies the ask, gathers context on identity, sites, and traffic paths, then proposes change sets with prerequisites, validation, and rollback. - Product-Specific Guardrails: Covers Access reusable policies, Gateway rule evaluation order, TLS inspection exceptions, split tunnel modes, DLP rollout, CASB findings, and device client enrollment. - Troubleshooting Workflow: Works from Gateway activity logs, Access audit logs, and DEX diagnostics back to the responsible rule, route, or policy. - Use Case: When migrating from a legacy VPN to ZTNA, use this Skill to plan tunnel connectors, split tunnel configuration, Access policies, and a pilot-group rollout with validation steps. ## Quick Start Ask the assistant to design a Cloudflare One Zero Trust architecture for replacing your corporate VPN with private app access through Cloudflare Tunnel and WARP.

Frequently Asked Questions about cloudflare-one

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure Cloudflare Access policies for private applications?▼

Create policies through the reusable policy API (/access/policies) and attach them to applications rather than sending inline policies. Private destination apps also require WARP or another network on-ramp plus routes and DNS resolution to function.

How do I choose between split tunnel include and exclude mode in WARP?▼

Use Include mode for VPN replacement only, routing just private CIDRs through the client. Use Exclude mode for secure web gateway deployments where all traffic goes through Cloudflare except specific exclusions. The mode is per-profile and cannot be mixed.

Does Cloudflare Gateway TLS inspection work with certificate-pinned apps?▼

Certificate-pinned applications break under TLS inspection and need Do Not Inspect exceptions configured before enabling broad inspection. You must also deploy the Cloudflare root CA to managed devices first.

Why is my Cloudflare Tunnel healthy but private apps unreachable?▼

A healthy tunnel only proves cloudflared reaches Cloudflare. The tunnel still needs published application or network routes, matching split tunnel entries, and DNS resolution for private hostnames before end-to-end connectivity works.

When should I use Cloudflare Tunnel versus Cloudflare WAN?▼

Cloudflare Tunnel is an off-ramp from a private network to Cloudflare and suits most private app connectivity. Cloudflare WAN provides site-to-site connectivity but is gated behind Enterprise subscriptions and is connectivity only, not a security service.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

deploying-palo-alto-prisma-access-zero-trust

Deploy Palo Alto Prisma Access SASE with ZTNA Connectors, GlobalProtect agents, and HIP-based security policies.

Community
Advanced
Arupbiswas09Arupbiswas09

cloudflare-one-migrations

Plan and execute migrations from legacy security stacks to Cloudflare One.

Community
Advanced
BagelHoleBagelHole
46

azure-monitor-audit

Configure Azure Monitor diagnostic settings to export activity logs to Log Analytics.

Community
Intermediate
AgentSecOpsAgentSecOps
183

sast-semgrep

Run Semgrep SAST scans to detect security flaws and map findings to OWASP and CWE standards.

Official
Advanced