Add identity, devices, and policy

Three separate layers control who reaches what in this architecture. Collapsing them into one mental bucket is how over-broad access happens.

Device enrollment decides who may connect a device to your Zero Trust organization. Passing enrollment means the device is inside the front door. It says nothing about what the device may do next.

A network route says where matching traffic can go. Advertising 10.0.1.0/24 through a Tunnel tells enrolled clients that Cloudflare can carry traffic toward that range. It does not say every enrolled user should reach every destination in it.

Authorization is the third layer, and it is the one people skip. Gateway and Access policies can evaluate identity, destination, port, and device posture — for every connection, at the edge, before traffic reaches your network.

The pattern to copy: start with a catch-all block for the private range. Add narrow allow rules above it for the users and services that need access.

priority  action  who                destination      port
1         allow   ana@example.com    10.0.1.100/32    22
2         allow   dev-team group     10.0.2.0/24      443
3         block   everyone           10.0.0.0/8       any

Policies evaluate in priority order and the first match wins, so the specific allows fire before the blanket block. Anything you never explicitly allowed gets denied by rule 3.

Device posture deserves a sentence. A policy can require an up-to-date OS version or a corporate certificate before allowing a connection. Access follows the person and the machine’s state — something a raw WireGuard key can never express, because a key only proves possession.

The failure mode without that block rule is quiet and common: enrollment plus a route means every enrolled device reaches the entire advertised range. The intern’s laptop can reach the database port. Nothing errors, nothing warns. It surfaces later, in an audit or an incident.

Verification comes in the lab lesson, but the principle is worth stating now: test one allowed identity and one denied identity, and read the policy logs to see which rule matched each connection. A policy nobody has watched matching is a policy nobody understands.