skills.rest
leonardoacosta
leonardoacostaCOMMUNITY
Explore all skills by this author →
GitHub

cloudflare-one

Guides design, configuration, and troubleshooting of Cloudflare One Zero Trust and SASE deployments.

Updated Aug 2, 2026
Search Tags:#tunnel#zero trust#gateway#access#warp#sase#cloudflare one
One-click install
npx skills add https://github.com/leonardoacosta/agents --skill cloudflare-one-leonardoacosta
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cloudflare-one
Source: https://github.com/leonardoacosta/agents/tree/main/skills/cloudflare-one
Command: npx skills add https://github.com/leonardoacosta/agents --skill cloudflare-one-leonardoacosta

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Cloudflare One spans many products (Access, Gateway, WARP, Tunnel, WAN, DLP, CASB), and misconfiguring policies, split tunnels, or TLS inspection causes outages and security gaps. This Skill structures architecture, configuration, and troubleshooting work with retrieval-first guidance grounded in current Cloudflare docs. ## Core Features & Use Cases - Structured Workflow: Classifies requests (architecture, configuration, troubleshooting, migration, review), gathers context, inspects existing account resources, and proposes change sets with validation and rollback. - Product Guardrails: Encodes hard-won rules for Access policies, Gateway evaluation order, split tunnel modes, TLS inspection exceptions, DLP rollout, CASB scans, and device client enrollment. - Use Case: When migrating remote users from a legacy VPN to Cloudflare, use this Skill to plan tunnel routes, choose split tunnel mode, stage Gateway policies to a pilot group, and validate end-to-end access before broad rollout. ## Quick Start Help me design a Cloudflare One rollout that replaces our VPN with Access and Tunnel for private apps and adds Gateway DNS filtering for 500 remote users.

Frequently Asked Questions about cloudflare-one

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure Cloudflare Access for a private application?▼

Private destination apps require the WARP device client or another network on-ramp plus tunnel routes and DNS resolution; creating the Access app alone is not enough. Configure resolver policies and connect the private hostname through Cloudflare Tunnel, then add an Allow policy since Access is default-deny.

Cloudflare split tunnel include vs exclude mode: which should I use?▼

Use Include mode for VPN replacement only, routing just private CIDRs through the client with minimal blast radius. Use Exclude mode for secure web gateway deployments where all traffic goes through Cloudflare except specific exclusions. The mode is per-profile and cannot be mixed.

Why is my Cloudflare Gateway group-based policy not matching users?▼

Gateway group selectors use synced IdP groups via SCIM, not Cloudflare Access Groups. Verify SCIM sync completed, the user re-authenticated, and exact case-sensitive group claim names and values match the IdP assertion.

Does Cloudflare CASB provide real-time inline enforcement?▼

API CASB is out-of-band and periodic, so it does not provide real-time inline enforcement. For inline control of actions in specific SaaS applications, use Gateway granular application controls in HTTP policies instead.

When should I enable TLS inspection in Cloudflare Gateway?▼

Enable TLS inspection only after deploying the Cloudflare root CA to managed devices and creating Do Not Inspect exceptions for certificate-pinned applications. HTTP Do Not Inspect rules run before Allow/Block rules, so plan exceptions before broad rollout.

Related Skills

Explore More Software Engineering Skills→
vahagn-madatyanvahagn-madatyan

azure-networking-audit

Audits Azure VNet designs and controls using Azure CLI commands to identify misconfigurations.

Community
Advanced
starwreckntxstarwreckntx

Security Information & Event Management Agent

Aggregate and correlate logs from multiple sources to detect security incidents.

Community
Basic
PostHogPostHog
713

signals-scout-csp-violations

Detects and reports Content Security Policy violation clusters from PostHog event streams.

Official
Advanced
cloudflarecloudflare
2.6k

cloudflare-one-migrations

Automates network and security stack migration to Cloudflare One with assessment and policy mapping.

Official
Advanced