Nanosek Ltd. reposted this
Passed the Cloudflare One Service Readiness Assessment this week: a hands-on lab covering private network access, clientless access, secure internet access, and visibility, the four parts of a real Cloudflare One deployment. Swipe for the architecture. Private network access The two servers in my lab could not reach each other. Which meant one connector could not cover for the other, so the usual "run two connectors" advice was useless here. I ran two on each server instead, four in total. Then I stopped one and measured it properly: one server never dropped a request, the other returned a single failure while the edge switched over, then recovered on its own. That is a pass, but only because I checked instead of trusting the dashboard. Clientless access The lab also required access for an external contractor with no agent on their laptop, browser only. I tested it with WARP fully disconnected: the App Launcher and browser-rendered SSH still worked, while a direct SSH attempt to the private IP timed out. Same person, same laptop, two completely different access outcomes depending on identity and posture, not network location. Secure internet access and DLP One requirement said: inspect all prompts that match a DLP rule. Inspect. That can mean block the prompt, or let it through and log it for review. Two different security postures from one word. In a real project this is where people guess, build the wrong thing, and find out in the review meeting. So I did not pick. I ran the same prompt with a real-looking SSN through the same policy twice. Once in block mode, once in allow-and-log. Both detections in the log, same rule, same profile match. The control holds either way, and the customer decides which posture they want. That is most of consulting work. The requirement is rarely as precise as the person writing it thinks. Visibility and log retention Long-term log storage was paid-tier only in the lab. Rather than skip the requirement, I documented what I would deploy for a customer: Logpush into R2, or Log Explorer for SQL over the same data, and which datasets matter for a Zero Trust rollout. None of that is in a course. You get it from building the thing, hitting the wall, and writing down what you would do differently with a real budget. Good week. Thanks to Cloudflare for running the assessment on real infrastructure instead of slides. #Cloudflare #ZeroTrust #ZTNA #SASE #CyberSecurity #Nanosek
