Learning objectives
- How do Access, Gateway, and Tunnel fit together for contractors?
- What do you need before recommending a WAN migration?
- Apply Secure web gateway to a customer decision and defend the tradeoff.
The mental model
Cloudflare One is a broader connectivity and security platform, not a single rule you switch on. Access governs who can reach applications. Gateway applies policies to traffic leaving users or networks toward Internet resources. Tunnel provides a connectivity path from infrastructure to Cloudflare using outbound connections. These functions do not substitute for each other: making an application reachable through a tunnel does not, by itself, define who is authorized to use it. For site connectivity, the current documentation calls the service Cloudflare WAN, formerly Magic WAN. Magic Transit addresses protection of network infrastructure. First identify the traffic direction and trust boundary.
How it works
Draw three independent flows: employee to private application, employee to public Internet, and branch to data center. Annotate identity, device context, route selection, DNS resolution, and the component enforcing each decision. Access can apply identity-aware application access policy; Gateway is a secure web gateway; Tunnel establishes a path without requiring the origin to accept ordinary inbound Internet connections. The complete deployment still needs application authorization, connector resilience, identity-provider availability planning, and an auditable exception process.
Cloudflare WAN connects sites and cloud networks through supported on-ramps such as tunnels or direct connectivity. Magic Transit is a network protection service; do not equate network traffic protection with employee identity policy. Evaluate IP ownership, advertised routes, encapsulation, MTU, return paths, and supported topology with the network team. Migrating a branch is a routing and operations project, not only an agent installation. Stage deployment by an application or site with clear test cases. Verify permitted and denied access, connector failure, DNS behavior, and the ability to restore the former path under a documented rollback procedure.
A useful pilot matrix crosses user identity with destination and device state. Test an approved contractor on an expected device, an offboarded contractor, an employee reaching a forbidden destination, and a branch after its primary path fails. Record the expected enforcement point for each case. If a denied request reaches the application anyway, inspect alternate routes and bypass paths before weakening the policy. Connectivity success and correct denial are equally necessary acceptance evidence.
Applied example · hypothetical
Hypothetical scenario: a manufacturer wants contractors to access a drawing portal while branch sites communicate with a private planning system. You separate contractor identity policy from site routing. Access and Tunnel are candidates for the portal; WAN connectivity is evaluated for branch traffic. The network team confirms addressing and MTU before any pilot. Internet browsing policy is a separate Gateway discussion. The proposal names the application owner, identity owner, and network owner, because a single salesperson cannot validate all three operational responsibilities.
In a customer engagement
Ask whether the complaint concerns a person, application, destination, or whole network. Request a path diagram and an inventory of identity providers, overlapping address ranges, connectors, and emergency access needs. Explain the smallest viable migration to both security and networking stakeholders. Avoid implying that purchasing a platform automatically produces a complete Zero Trust operating model.
Interview relevance
In an interview, contrast Access, Gateway, Tunnel, Cloudflare WAN, and Magic Transit using traffic direction and enforcement responsibility. Mention the former Magic WAN name so historical terminology remains understandable. A strong answer includes operational dependencies and deny tests, and admits when a topology requires specialist validation instead of inventing unsupported routing behavior.
Common mistakes
- Treating Tunnel as authorization
- Granting broad network trust unnecessarily
- Ignoring return paths
Key terminology
Secure web gateway — A service that applies security policy to users' or networks' Internet-bound traffic.
ZTNA — Zero Trust Network Access: granting application access using explicit context and policy instead of broad network trust.
On-ramp — A connection method that brings network traffic onto a provider's network or service.
Explain it without the page
- How do Access, Gateway, and Tunnel fit together for contractors?
- What do you need before recommending a WAN migration?
Further reading
Sources explain the underlying concepts; examples and practice answers are original course material. Recheck current limits and plan eligibility before a real proposal.