What is the challenge?
Why is a flat-network VPN a security and productivity problem?
Traditional VPNs put every authenticated user on the corporate network, granting broad access far beyond what any one role actually needs. One compromised credential or stolen laptop becomes a lateral-movement event. On top of that, VPN concentrators become single points of failure and add real latency for remote employees, contractors, and partners — all while creating friction every time someone needs to reach an internal app.
Architecture
How it fits together
Cloudflare's Solution
How Cloudflare solves it
- Per-application access, not network access. Cloudflare Access publishes individual apps (web, SSH, RDP, internal APIs) behind identity and policy. Users reach only what they're explicitly allowed to reach — no implicit trust of the network they're on.
- Any identity provider, any device. Federates with Okta, Microsoft Entra ID, Google, Auth0, GitHub, SAML, OIDC, and more. Layer on device posture signals (managed device, OS version, disk encryption) and require WARP enrollment when needed.
- Connects to anything, anywhere. Cloudflare Tunnel exposes apps from your data center, VPC, or even a developer laptop without opening inbound ports. Public IPs disappear from your origin.
- Faster than a VPN. Traffic terminates at the nearest Cloudflare location (300+ cities) and reaches the app over Cloudflare's backbone. No backhauling through a regional VPN concentrator.
- Audit everything. Every authentication event, policy decision, and session is logged and exportable to your SIEM. Replace 'who was on the VPN' with 'who touched which app and when.'
FAQ
Common questions
Do I have to rip out my existing VPN on day one?
No. The typical migration runs Access alongside the legacy VPN, app by app. Start with one or two high-value internal apps, prove the workflow, then expand. Most customers retire their VPN over 3–6 months.
What about non-HTTP apps like SSH, RDP, or databases?
Cloudflare Tunnel and Access for Infrastructure handle TCP and UDP traffic. Users can connect via the WARP client or, for SSH/RDP, through a browser-rendered terminal that requires no native client.
Does this work for contractors and partners who aren't in our IdP?
Yes. You can add one-time PIN (email OTP) as an identity source for guest users, or federate with their IdP. Access policies can require additional signals (country, device posture, MFA) on top.
How is this different from a typical IdP + SSO setup?
SSO authenticates the user once into individual apps. Zero Trust Access sits in front of every app and enforces continuous policy on every request — identity, device, location, time of day, and more — and protects apps that don't natively support SSO.
Let's Test!
Try it live
Demo coming soon
An interactive demo for Zero Trust Access (VPN Replacement) is being built. In the meantime, check the "Dive Deeper" section below for the official docs and product blogs.
Dive Deeper