Skip to content

Commit

Permalink
[Teams] Formatting fix and new onboarding docs (cloudflare#840)
Browse files Browse the repository at this point in the history
* fix formatting

* new onboarding docs

* updated link
  • Loading branch information
abracchi-tw authored Feb 24, 2021
1 parent beec7d1 commit ee8a3ad
Show file tree
Hide file tree
Showing 11 changed files with 53 additions and 68 deletions.
Original file line number Diff line number Diff line change
@@ -1,44 +1,45 @@
---
order: 4
hidden: true
---

# Exclude network traffic from WARP
<Aside>

<Aside>

In order for the WARP client to pick up any changes you make to Split Tunnels or Local Domain Fallback, you will need to restart it. To do that, you can either restart the computer or quit the application and relaunch it. This behavior will be improved in a future release.

</Aside>

When the WARP Client is deployed, all DNS requests and/or network traffic on the device are processed by Cloudflare Gateway by default. However, under certain circumstances, you may need to exclude DNS requests and/or network traffic from being processed by Gateway.

To do that, there are two settings you can use depending on your needs:

* **Use [Local Domain Fallback](/connections/connect-devices/warp/exclude-traffic/local-domains)** to instruct the WARP Client to ignore DNS requests to a given list of domains. These DNS requests will be passed back to other DNS servers configured on existing network interfaces on the device.

This is useful when you have defined private hostnames that wouldn’t otherwise resolve on the public internet.



<Aside type="warning">

DNS requests to domain names entered here will not be encrypted, managed or monitored by Cloudflare Gateway.

</Aside>

* **Use the [Split Tunnels](/connections/connect-devices/warp/exclude-traffic/split-tunnels) mode** to instruct the WARP client to ignore traffic to a specified set of IP addresses. Any traffic that is destined to an IP address defined in the split tunnel configuration will be ignored by the WARP client and handled by the local machine.

* **Use the [Split Tunnels](/connections/connect-devices/warp/exclude-traffic/split-tunnels) mode** to instruct the WARP Client to ignore traffic to a specified set of IP addresses. Any traffic that is destined to an IP address defined in the split tunnel configuration will be ignored by the WARP client and handled by the local machine.

This is useful when you want to run another VPN alongside WARP or when you need traffic to flow over the open internet.

This is useful when you want to run another VPN alongside WARP or when you need traffic to flow over the open Internet.

<Aside type="warning">

Any traffic to IP addresses defined in the Split Tunnel configuration will not be encrypted, managed or monitored by Cloudflare Gateway.

</Aside>

## Use WARP alongside a VPN

You may still be required to run WARP alongside a legacy VPN product, and we're working to make this experience as seamless as possible. When running in this configuration, there are two important considerations with your deployment:

* **Start WARP first**. WARP and your legacy VPN are both trying to route traffic and DNS requests over our respective networks. Some legacy VPN clients must be the last client to touch a network configuration or they will fail.

* **Turn on Split Tunnel and DNS Fallback in your legacy VPN configuration**. Your legacy VPN may try to route all network traffic and DNS requests through their product by default. For Gateway to function properly, the legacy VPN configuration needs to be set up to only handle the network traffic required for your LOB applications that still require the legacy VPN. All other traffic should fall back to the local machine, so it can be picked up by WARP and protected by Gateway.
* **Turn on Split Tunnel and DNS Fallback in your legacy VPN configuration**. Your legacy VPN may try to route all network traffic and DNS requests through their product by default. For Gateway to function properly, the legacy VPN configuration needs to be set up to only handle the network traffic required for your LOB applications that still require the legacy VPN. All other traffic should fall back to the local machine, so it can be picked up by WARP and protected by Gateway.

Original file line number Diff line number Diff line change
Expand Up @@ -4,17 +4,16 @@ order: 5

# Local Domain Fallback

<Aside>
<Aside>

In order for the WARP client to pick up any changes you make to Split Tunnels or Local Domain Fallback, you will need to restart it. To do that, you can either restart the computer or quit the application and relaunch it. This behavior will be improved in a future release.

</Aside>

By default, Cloudflare for Teams excludes common top level domains used for local resolution from being sent to the Cloudflare proxy. Excluded domains are listed on the Teams dashboard under **Gateway** > **Policies** > **Settings** > **Local Domains - WARP**. All domains in that list rely on the local DNS resolver configured for the device.

You can add or remove domains from the Local Domains list at any time.



1. On the Teams dashboard, navigate to **Policies** > **Settings**.

![Settings](../../../../static/secure-web-gateway/split-tunnel/settings-page.png)
Expand All @@ -40,4 +39,5 @@ The domain will appear in the list below.
To remove a domain from the list, locate the domain and then click **Delete**.

If you wish to remove multiple domains at the same time, click the checkbox to the left of each domain to select it, and click **Delete** in the top right corner of the box.
![Delete domain](../../../../static/documentation/connections/delete-domains.png)

![Delete domain](../../../../static/documentation/connections/delete-domains.png)
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ order: 5
In order for the WARP client to pick up any changes you make to Split Tunnels or Local Domain Fallback, you will need to restart it. To do that, you can either restart the computer or quit the application and relaunch it. This behavior will be improved in a future release.

</Aside>

Split Tunnels mode can be configured to exclude IP addresses commonly used for private routing, including those defined in [RFC 1918](https://tools.ietf.org/html/rfc1918). You can find a list of excluded IP addresses under **Gateway** > **Policies** > **Settings** > **Split Tunnels - WARP**.

You can add or remove IP addresses from the Split Tunnels list at any time.
Expand Down Expand Up @@ -40,4 +40,4 @@ On the Manage Split Tunnels page, locate the IP address in the list and then cli

If you wish to remove multiple IP addresses at the same time, click the checkbox to the left of each IP address to select it, and click **Delete** in the top right corner of the box.

![Delete IP address](../../../../static/documentation/connections/delete-IP-address.png)
![Delete IP address](../../../../static/documentation/connections/delete-IP-address.png)
82 changes: 33 additions & 49 deletions products/cloudflare-one/src/content/setup/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,78 +2,62 @@
order: 1
---

# Quick start
# Get started

Start using Cloudflare for Teams by creating a Cloudflare account.
<Aside>

1. Navigate to [Cloudflare for Teams](https://dash.cloudflare.com/sign-up?redirect_uri=https%3A%2F%2Fdash.teams.cloudflare.com%2Fauth-callback) and create a new account with your email address and a password.
Before you start using Cloudflare for Teams, create a Cloudflare account. To do that, navigate to the [Cloudflare dashboard](https://dash.teams.cloudflare.com/) and create a new account with your email address and a password.

![Create Account](../static/documentation/quickstart/create-account.png)
</Aside>

2. Click **Create account**. You can now choose to:
Setting up Cloudflare for Teams takes only a couple of minutes, and is as fast as going through these three steps:

* Set up [Cloudflare Access](#set-up-cloudflare-access) to build Zero Trust rules for the applications and data you protect.
* Set up [Cloudflare Gateway](#set-up-cloudflare-gateway) to build DNS filtering, Secure Web Gateway, and cloud firewall policies for your organization.
* Skip directly to the [Teams dashboard](https://dash.teams.cloudflare.com).
* Choosing a [team name](/glossary#team-name).
* Choosing a [payment plan](https://www.cloudflare.com/en-gb/teams-pricing/).
* Adding your payment details (also required for customers on the Free plan).

Let's walk through the setup flow!

![Start Onboarding](../static/documentation/quickstart/first-screen.png)
1. Once you've created your Cloudflare account, navigate to [the sign-up link](https://dash.cloudflare.com/sign-up/teams).
1. Log in with your Cloudflare credentials.
1. Click on the Teams icon.

## Set up Cloudflare Access
![Start Onboarding](../static/documentation/quickstart/step-000.png)

1. Click **Begin setup** in the Cloudflare Access card.
1. On the Welcome page, click **Next**.

1. Enter your *[team domain](/glossary#team-domain)*. The team domain will represent your Cloudflare for Teams account across Access and Gateway. The URL will also serve as the launch page for end users.
![Start Onboarding](../static/documentation/quickstart/step-0.png)

![Team Domain](../static/documentation/quickstart/auth-domain.png)
1. Choose your [team name](/glossary#team-name). This name will be used to generate a [team domain](/glossary#team-domain) that will be shared across the applications you'll protect behind Cloudflare for Teams.

1. Click **Next**. Cloudflare will now check if you have [added an active zone to Cloudflare](https://support.cloudflare.com/hc/articles/201720164-Creating-a-Cloudflare-account-and-adding-a-website).
![Choose team name](../static/documentation/quickstart/step-2.png)

1. If an active zone hasn't been added yet, you will be prompted to create your first **SaaS application** on the Teams dashboard. To do so, click **Continue setup in Teams dash**.
1. Click **Next**.

![SaaS app](../static/documentation/quickstart/setup-saas-application.png)
1. Choose a payment plan.

1. If you have added an active zone to Cloudflare, you can set up your first internal application by providing a name and input the subdomain where your application will be served.
![Choose payment plan](../static/documentation/quickstart/step-3.png)

The subdomain must be part of a zone in your Cloudflare account.
1. Click **Next**. We'll show you a summary of the payment plan you've selected; you now have the opportunity to go back and choose a different plan or click **Proceed to payment**.

![Onboarding App](../static/documentation/quickstart/internal-app.png)
![Enter payment details](../static/documentation/quickstart/step-4.png)

7. Now, create the first **policy** for the app you are securing with Access.
1. As a last step, enter your payment details and click **Purchase**. For Free customers, credit cards will not be charged.

Provide a name and then specify an *Include* rule for the policy.
![Enter payment details](../static/documentation/quickstart/step-5.png)

The *Include* rule will determine which users will be allowed to access the application.
You can either select:
* *Emails* - this option restricts access to users whose email addresses match the ones you define.
* *Emails ending in* - this option restricts access to users whose email addresses end with the email endings you define.
1. Welcome to the Cloudflare for Teams dashboard! Your account has been created. You can now explore a list of one-click actions we've designed to help you kickstart your experience with Teams.

For example, if you've purchased one of the Teams bundle plans, you can:

You can return to edit the policy with more complex rules like identity provider groups or hard key requirements.
* [Add your first location](/connections/connect-networks)
* [Add your first application](/applications/configure-applications)
* [Customize your login page](/identity/login-page)

8. Click **Next**.
And so much more. Happy exploring!

9. You have now successfully configured Cloudflare Access.
![Enter payment details](../static/documentation/quickstart/step-6.png)

To view your application on the *Teams dashboard*, click **View your application**.

To explore the dashboard, click **Proceed to Teams dashboard**.

## Set up Cloudflare Gateway

1. Click **Begin setup** in the Cloudflare Gateway card.

1. Enter your *[team domain](/glossary#team-domain)*. The team domain will be used as your Gateway organization name in the WARP client during user and device enrollment.

1. Set up your first location. Alternatively, you can choose to click **Skip to Teams dash**.

1. If you choose to set up your first location, enter a location name and click **Next**. You will be able to change this name at any time on the Teams dashbaord.

![Onboarding App](../static/documentation/quickstart/first-location.png)

1. Follow the instructions on how to setup your DNS resolvers.

1. Click **Finish setup**. This will take you to the Teams dashboard.

You have now successfully set up Cloudflare Gateway.

## Tutorials

Expand Down
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit ee8a3ad

Please sign in to comment.