deploying-cloudflare-access-for-zero-trust

为零信任部署 Cloudflare Access

何时使用

• 使用 Cloudflare One 以身份感知的应用访问替代 VPN 基础设施时
• 通过 Cloudflare Tunnel 暴露自托管的内部应用而不开放入站端口时
• 为访问 Web 应用、SSH 和 RDP 服务的分布式员工队伍实施 ZTNA 时
• 需要具有集成 DLP、CASB 和 SWG 能力的成本效益高的零信任解决方案时
• 保护承包商和第三方对特定应用的访问而不授予完整网络访问权限时

不要使用于需要 Cloudflare Tunnel 不支持的持久 UDP 连接的应用、需要气隙隔离或完全本地访问控制的环境，或法规要求禁止通过第三方云基础设施路由流量的情况。

前置条件

• 具有 Zero Trust 订阅的 Cloudflare 账户（最多 50 名用户免费，更大团队使用付费计划）
• 由 Cloudflare DNS 管理的域名（或能够添加 CNAME 记录）
• 用于运行 cloudflared 隧道守护进程的 Linux、Windows 或 macOS 服务器
• 身份提供商：Okta、Microsoft Entra ID、Google Workspace、GitHub 或任何 SAML/OIDC 提供商
• 用于设备级注册的 Cloudflare WARP 客户端（可选但推荐）

工作流

步骤 1：创建到内部应用的 Cloudflare Tunnel

安装 cloudflared 并创建持久隧道以暴露内部服务。

# Install cloudflared on Ubuntu/Debian
curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb \
  -o cloudflared.deb
sudo dpkg -i cloudflared.deb

# Authenticate cloudflared with your Cloudflare account
cloudflared tunnel login

# Create a named tunnel
cloudflared tunnel create internal-apps
# Output: Created tunnel internal-apps with id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

# Configure tunnel routes to internal applications
cat > ~/.cloudflared/config.yml << 'EOF'
tunnel: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
credentials-file: /home/admin/.cloudflared/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.json

ingress:
  - hostname: wiki.company.com
    service: http://localhost:8080
  - hostname: git.company.com
    service: http://10.1.1.50:3000
  - hostname: grafana.company.com
    service: http://10.1.1.60:3000
  - hostname: ssh.company.com
    service: ssh://localhost:22
  - hostname: rdp.company.com
    service: rdp://10.1.1.100:3389
  # Catch-all rule (required)
  - service: http_status:404
EOF

# Route DNS to the tunnel
cloudflared tunnel route dns internal-apps wiki.company.com
cloudflared tunnel route dns internal-apps git.company.com
cloudflared tunnel route dns internal-apps grafana.company.com

# Run tunnel as a systemd service
sudo cloudflared service install
sudo systemctl enable cloudflared
sudo systemctl start cloudflared

# Verify tunnel status
cloudflared tunnel info internal-apps

步骤 2：配置身份提供商集成

使用您组织的身份提供商设置身份验证。

# Using Cloudflare API to configure Okta as IdP
curl -X PUT "https://api.cloudflare.com/client/v4/accounts/{account_id}/access/identity_providers" \
  -H "Authorization: Bearer ${CF_API_TOKEN}" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "Corporate Okta",
    "type": "okta",
    "config": {
      "client_id": "OKTA_CLIENT_ID",
      "client_secret": "OKTA_CLIENT_SECRET",
      "okta_account": "company.okta.com",
      "api_token": "OKTA_API_TOKEN",
      "claims": ["email", "groups", "name"],
      "email_claim_name": "email"
    }
  }'

# Configure Microsoft Entra ID as additional IdP
curl -X POST "https://api.cloudflare.com/client/v4/accounts/{account_id}/access/identity_providers" \
  -H "Authorization: Bearer ${CF_API_TOKEN}" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "Microsoft Entra ID",
    "type": "azureAD",
    "config": {
      "client_id": "AZURE_APP_CLIENT_ID",
      "client_secret": "AZURE_APP_CLIENT_SECRET",
      "directory_id": "AZURE_TENANT_ID",
      "support_groups": true,
      "claims": ["email", "groups", "name"]
    }
  }'

步骤 3：创建 Access 应用和策略

为每个内部服务定义具有身份感知策略的 Access 应用。

# Create Access application for internal wiki
curl -X POST "https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps" \
  -H "Authorization: Bearer ${CF_API_TOKEN}" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "Internal Wiki",
    "domain": "wiki.company.com",
    "type": "self_hosted",
    "session_duration": "8h",
    "auto_redirect_to_identity": true,
    "http_only_cookie_attribute": true,
    "same_site_cookie_attribute": "lax",
    "logo_url": "https://company.com/wiki-logo.png",
    "allowed_idps": ["OKTA_IDP_ID", "AZURE_IDP_ID"]
  }'

# Create Allow policy for the wiki application
curl -X POST "https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies" \
  -H "Authorization: Bearer ${CF_API_TOKEN}" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "Allow Engineering Team",
    "decision": "allow",
    "precedence": 1,
    "include": [
      {"group": {"id": "ENGINEERING_GROUP_ID"}},
      {"okta": {"name": "Engineering", "identity_provider_id": "OKTA_IDP_ID"}}
    ],
    "require": [
      {"device_posture": {"integration_uid": "CROWDSTRIKE_INTEGRATION_ID"}}
    ]
  }'

# Create Access application for SSH access
curl -X POST "https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps" \
  -H "Authorization: Bearer ${CF_API_TOKEN}" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "SSH Access",
    "domain": "ssh.company.com",
    "type": "ssh",
    "session_duration": "4h",
    "auto_redirect_to_identity": true
  }'

步骤 4：部署 WARP 客户端进行设备注册

使用 Cloudflare WARP 注册企业设备以实现专用网络访问和设备态势。

# Create device enrollment rule
curl -X POST "https://api.cloudflare.com/client/v4/accounts/{account_id}/devices/policy" \
  -H "Authorization: Bearer ${CF_API_TOKEN}" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "Corporate Device Enrollment",
    "match": "identity.email matches \".*@company\\.com$\"",
    "precedence": 100,
    "enabled": true,
    "gateway_unique_id": "GATEWAY_ID",
    "support_url": "https://helpdesk.company.com/warp-help"
  }'

# Install WARP on macOS via MDM (Jamf/Intune)
# Download: https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/download-warp/
# Deploy with MDM configuration profile:
cat > warp_mdm_config.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>organization</key>
    <string>company</string>
    <key>auto_connect</key>
    <integer>1</integer>
    <key>switch_locked</key>
    <true/>
    <key>onboarding</key>
    <false/>
</dict>
</plist>
EOF

# Install Cloudflare root certificate for TLS inspection
# Download from: https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/user-side-certificates/
sudo cp cloudflare-root-ca.pem /usr/local/share/ca-certificates/cloudflare-root-ca.crt
sudo update-ca-certificates

# Configure split tunnel to route private network through WARP
curl -X PUT "https://api.cloudflare.com/client/v4/accounts/{account_id}/devices/policy/{policy_id}/fallback_domains" \
  -H "Authorization: Bearer ${CF_API_TOKEN}" \
  -H "Content-Type: application/json" \
  --data '[
    {"suffix": "internal.corp", "description": "Internal corporate domain"},
    {"suffix": "10.0.0.0/8", "description": "Private network range"}
  ]'

步骤 5：配置设备态势检查

将终端安全信号集成到 Access 策略中。

# Add CrowdStrike device posture integration
curl -X POST "https://api.cloudflare.com/client/v4/accounts/{account_id}/devices/posture/integration" \
  -H "Authorization: Bearer ${CF_API_TOKEN}" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "CrowdStrike Falcon",
    "type": "crowdstrike_s2s",
    "config": {
      "api_url": "https://api.crowdstrike.com",
      "client_id": "CS_API_CLIENT_ID",
      "client_secret": "CS_API_CLIENT_SECRET",
      "customer_id": "CS_CUSTOMER_ID"
    },
    "interval": "10m"
  }'

# Create device posture rule for disk encryption
curl -X POST "https://api.cloudflare.com/client/v4/accounts/{account_id}/devices/posture" \
  -H "Authorization: Bearer ${CF_API_TOKEN}" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "Disk Encryption Required",
    "type": "disk_encryption",
    "match": [{"platform": "windows"}, {"platform": "mac"}],
    "input": {"requireAll": true}
  }'

# Create device posture rule for OS version
curl -X POST "https://api.cloudflare.com/client/v4/accounts/{account_id}/devices/posture" \
  -H "Authorization: Bearer ${CF_API_TOKEN}" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "Minimum OS Version",
    "type": "os_version",
    "match": [{"platform": "windows"}],
    "input": {"version": "10.0.19045", "operator": ">="}
  }'

步骤 6：设置审计日志和分析

为访问决策和隧道健康监控配置日志记录。

# Enable Logpush for Access audit logs to S3
curl -X POST "https://api.cloudflare.com/client/v4/accounts/{account_id}/logpush/jobs" \
  -H "Authorization: Bearer ${CF_API_TOKEN}" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "access-audit-logs",
    "output_options": {
      "field_names": ["RayID","Action","Allowed","AppDomain","AppUUID","Connection","Country","CreatedAt","Email","IPAddress","PurposeJustificationPrompt","PurposeJustificationResponse","TemporaryAccessDuration","UserUID"],
      "timestamp_format": "rfc3339"
    },
    "destination_conf": "s3://security-logs-bucket/cloudflare-access/?region=us-east-1&access-key-id=AKID&secret-access-key=SECRET",
    "dataset": "access_requests",
    "enabled": true
  }'

# Query access logs via GraphQL Analytics API
curl -X POST "https://api.cloudflare.com/client/v4/graphql" \
  -H "Authorization: Bearer ${CF_API_TOKEN}" \
  -H "Content-Type: application/json" \
  --data '{
    "query": "{ viewer { accounts(filter: {accountTag: \"ACCOUNT_ID\"}) { accessLoginRequestsAdaptiveGroups(filter: {datetime_gt: \"2026-02-22T00:00:00Z\"}, limit: 100, orderBy: [count_DESC]) { dimensions { action appName userEmail country } count } } } }"
  }'

关键概念

术语	定义
Cloudflare Tunnel	从您的基础设施到 Cloudflare 网络的加密仅出站连接，无需开放入站防火墙端口即可暴露内部服务
Cloudflare Access	身份感知反向代理，在授予对受保护应用的访问权限之前，根据访问策略评估每个请求
WARP 客户端	Cloudflare 的端点 Agent，通过 Cloudflare 网络路由设备流量以实现策略执行和专用网络访问
Access 应用	定义受保护资源（自托管、SaaS 或基础设施）及其关联访问策略的配置对象
设备态势	作为 Access 策略中的条件进行评估的端点健康信号（操作系统版本、磁盘加密、EDR 状态）
Cloudflare One	统一 SASE 平台，结合 ZTNA（Access）、SWG（Gateway）、CASB、DLP 和 RBI

工具与系统

• Cloudflare Access：提供逐请求授权的身份感知应用代理
• Cloudflare Tunnel (cloudflared)：创建从内部网络到 Cloudflare 边缘的加密隧道的守护进程
• WARP 客户端：用于设备注册、DNS 过滤和专用网络路由的跨平台端点 Agent
• Cloudflare Gateway：提供 DNS/HTTP 过滤和 DLP 检查的安全 Web 网关
• Cloudflare Logpush：实时日志流式传输到外部 SIEM 和存储目标
• Access for Infrastructure：使用短期证书和会话录制进行 SSH 和 RDP 访问

常见场景

场景：200 名员工的初创公司从零开始部署零信任

背景：一家拥有 200 名员工、没有现成 VPN 的 SaaS 初创公司，希望为运行在 AWS 上的内部工具（Grafana、内部 API、预发布环境）提供安全访问。预算有限，团队也没有专职安全人员。

方案：

1. 从 Cloudflare Zero Trust 免费版（最多 50 名用户）开始进行概念验证
2. 在生产 VPC 中的 EC2 实例上部署一个 cloudflared 隧道
3. 通过隧道和 DNS 路由暴露 Grafana、内部 wiki 和预发布应用
4. 将 Google Workspace 配置为 IdP，用于 SSO 身份验证
5. 创建 Access 策略，要求所有应用都使用 @company.com 邮箱域名
6. 添加设备态势检查，涵盖磁盘加密和操作系统版本
7. 升级到付费计划，并通过 MDM 向所有员工笔记本电脑部署 WARP 客户端
8. 启用 Gateway DNS 过滤和 HTTP 检查以防范恶意软件
9. 配置 Logpush，将访问日志发送到 Datadog 进行监控

坑点：必须在所有设备上安装 Cloudflare 根证书，TLS 检查才能正常工作；某些应用可能会因 TLS 拦截而无法正常运行。隧道故障转移需要运行多个 cloudflared 实例，或使用 Cloudflare 的副本功能。Access 策略应始终包含一条默认拒绝规则。WebSocket 应用可能需要特定的隧道配置。

输出格式

Cloudflare Zero Trust Deployment Report
==================================================
Organization: StartupCorp
Team Name: startupcorp
Deployment Date: 2026-02-23

TUNNEL INFRASTRUCTURE:
  Active Tunnels: 2 (primary + failover)
  Tunnel Status: Healthy
  Connected Edge: Washington DC, Ashburn
  Ingress Routes: 8

ACCESS APPLICATIONS:
  Self-Hosted Apps: 6
  SaaS Apps: 3
  SSH/Infrastructure: 2
  Total Policies: 15

DEVICE ENROLLMENT:
  Enrolled Devices: 187 / 200
  WARP Connected: 182 / 187 (97.3%)
  Posture Compliant: 175 / 187 (93.6%)

ACCESS METRICS (last 30 days):
  Total Requests: 89,432
  Allowed: 88,756 (99.2%)
  Blocked: 676 (0.8%)
  Unique Users: 195
  Countries: 12
  Avg Session Duration: 6.2 hours