Changelog
Access
SCIM GA for Okta and Microsoft Entra IDCloudflare's SCIM integrations with Okta and Microsoft Entra ID (formerly AzureAD) are now out of beta and generally available (GA) for all customers. These integrations can be used for Access and Gateway policies and Zero Trust user management. Note: This GA release does not include Dashboard SSO SCIM support.
DLP
Profile confidence levelsDLP profiles now support setting a confidence level to choose how tolerant its detections are to false positives based on the context of the detection. The higher a profile's confidence level is, the less false positives will be allowed. Confidence levels include Low, Medium, or High. DLP profile confidence levels supersede context analysis.
Gateway
Category filtering in the network policy builderGateway users can now create network policies with the Content Categories and Security Risks traffic selectors. This update simplifies malicious traffic blocking and streamlines network monitoring for improved security management.
Zero Trust WARP Client
MASQUE GAMASQUE as a device tunnel protocol option is now generally available (GA). Refer to Device tunnel protocol for configuration details and minimum WARP client requirements.
Zero Trust WARP Client
WARP client for macOS (version 2024.11.309.0)A new GA release for the macOS WARP client is now available in the App Center. This release contains minor fixes and improvements.
Changes and improvements:
- Fixed an issue where SSH sessions and other application connections over TCP or UDP could drop when a device that is using MASQUE changes its primary network interface.
- Fixed an issue to ensure the Cloudflare root certificate (or custom certificate) is installed in the trust store if not already there.
- Fixed an issue with the WARP client becoming unresponsive during startup.
- Extended
warp-diag
to collect system profiler firewall state as part of diagnostics. - Fixed an issue with the WARP client becoming unresponsive while handling LAN inclusion.
- Fixed an issue where users were unable to connect with an IPC error message displayed in the UI.
- Fixed an issue that was preventing proper operation of DNS-over-TLS (DoT) for consumer users.
Known issues:
- macOS Sequoia: Due to changes Apple introduced in macOS 15.0.x, the WARP client may not behave as expected. Cloudflare recommends the use of macOS 15.1 or later.
Zero Trust WARP Client
WARP client for Windows (version 2024.11.309.0)A new GA release for the Windows WARP client is now available in the App Center. This release contains minor fixes and improvements.
Changes and improvements:
- Fixed an issue where SSH sessions and other application connections over TCP or UDP could drop when a device that is using MASQUE changes its primary network interface.
- Fixed an issue to ensure the Cloudflare root certificate (or custom certificate) is installed in the trust store if not already there.
- Fixed an issue with the WARP client becoming unresponsive during startup.
- Extended diagnostics collection time in
warp-diag
to ensure logs are captured reliably. - Fixed an issue that was preventing proper operation of DNS-over-TLS (DoT) for consumer users.
Known issues:
DNS resolution may be broken when all of the following conditions are true:
- WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
- A custom DNS server address is configured on the primary network adapter.
- The custom DNS server address on the primary network adapter is changed while WARP is connected.
To work around the DNS issue, reconnect the WARP client by toggling off and back on.
Zero Trust WARP Client
WARP client for Linux (version 2024.11.309.0)A new GA release for the Linux WARP client is now available in the package repository. This release contains reliability improvements and general bug fixes.
Changes and improvements:
- Fixed an issue where SSH sessions and other connections ould drop when a device that is using MASQUE changes its primary network interface.
- Device posture client certificate checks now support PKCS#1.
- Fixed an issue to ensure the Cloudflare root certificate (or custom certificate) is installed in the trust store if not already there.
- Reduced unnecessary log messages when
resolv.conf
has no owner. - Fixed an issue with
warp-diag
printing benign TLS certificate errors. - Fixed an issue with the WARP client becoming unresponsive during startup.
- Extended diagnostics collection time in
warp-diag
to ensure logs are captured reliably. - Fixed an issue that was preventing proper operation of DNS-over-TLS (DoT) for consumer users.
DLP
Send entire HTTP requests to a Logpush destinationIn addition to logging the payload from HTTP requests that matched a DLP policy in Cloudflare Logs, Enterprise users can now configure a Logpush job to send the entire HTTP request that triggered a DLP match to a storage destination. This allows long-term storage of full requests for use in forensic investigation.
Zero Trust WARP Client
WARP client for macOS (version 2024.10.279.1)A new beta release for the macOS WARP client is now available in the App Center. This release contains minor fixes and improvements.
Changes and improvements:
- Fixed an issue where SSH sessions and other application connections over TCP or UDP could drop when a device that is using MASQUE changes its primary network interface.
- Fixed an issue to ensure the Cloudflare root certificate (or custom certificate) is installed in the trust store if not already there.
Known issues:
- Cloudflare is investigating temporary networking issues on macOS 15 (Sequoia) that affect some users and may occur on any version of the WARP client.
Zero Trust WARP Client
WARP client for Windows (version 2024.10.279.1)A new beta release for the Windows WARP client is now available in the App Center. This release contains minor fixes and improvements.
Changes and improvements:
- Fixed an issue where SSH sessions and other application connections over TCP or UDP could drop when a device that is using MASQUE changes its primary network interface.
- Fixed an issue to ensure the Cloudflare root certificate (or custom certificate) is installed in the trust store if not already there.
Known issues:
DNS resolution may be broken when all of the following conditions are true:
- WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
- A custom DNS server address is configured on the primary network adapter.
- The custom DNS server address on the primary network adapter is changed while WARP is connected.
To work around the DNS issue, reconnect the WARP client by toggling off and back on.
Gateway
Per-account Cloudflare root certificateGateway users can now generate unique root CAs for their Zero Trust account. Both generated certificate and custom certificate users must activate a root certificate to use it for inspection. Per-account certificates replace the default Cloudflare certificate, which is set to expire on 2025-02-02.
Cloudflare Tunnel
Simplifed WARP Connector deploymentYou can now deploy WARP Connector using a simplified, guided workflow similar to cloudflared
connectors. For detailed instructions, refer to the WARP Connector documentation.
Gateway
Time-based policy durationGateway now offers time-based DNS policy duration. With policy duration, you can configure a duration of time for a policy to turn on or set an exact date and time to turn a policy off.
Cloudflare Tunnel
Bugfix for --grace-periodThe new cloudflared
build 2024.10.0 has a bugfix related to the --grace-period tunnel run parameter. cloudflared
connectors will now abide by the specified waiting period before forcefully closing connections to Cloudflare's network.
Gateway
Expanded Gateway log fieldsGateway now offers new fields in activity logs for DNS, network, and HTTP policies to provide greater insight into your users' traffic routed through Gateway.
Zero Trust WARP Client
WARP client for Linux (version 2024.9.346.0)A new GA release for the Linux WARP client is now available in the package repository. This release contains minor fixes and minor improvements.
Notable updates:
- Added
target list
to thewarp-cli
to enhance the user experience with the Access for Infrastructure SSH solution. - Added the ability to customize PCAP options in the
warp-cli
. - Added a list of installed applications in
warp-diag
. - Added a
tunnel reset mtu
subcommand to thewarp-cli
. - Added the ability for
warp-cli
to use the team name provided in the MDM file for initial registration. - Added a JSON output option to the
warp-cli
. - Added the ability to execute a PCAP on multiple interfaces with
warp-cli
. - Added MASQUE tunnel protocol support for the consumer version of WARP (1.1.1.1 w/ WARP).
- Improved the performance of firewall operations when enforcing split tunnel configuration.
- Fixed an issue where device posture certificate checks were unexpectedly failing.
- Fixed an issue where the Linux GUI fails to open the browser login window when registering a new Zero Trust organization.
- Fixed an issue where clients using service tokens failed to retry after a network change.
- Fixed an issue where the client, when switching between WireGuard and MASQUE protocols, sometimes required a manual tunnel key reset.
- Fixed a known issue which required users to re-register when an older single configuration MDM file was deployed after deploying the newer, multiple configuration format.
- Deprecated
warp-cli
commands have been removed. If you have any workflows that use the deprecated commands, update to the new commands where necessary.
Known issues:
- Using MASQUE as the tunnel protocol may be incompatible if your organization has Regional Services is enabled.
Zero Trust WARP Client
WARP client for Windows (version 2024.9.346.0)A new GA release for the Windows WARP client is now available in the App Center. This release contains minor fixes and improvements.
Notable updates:
- Added
target list
to thewarp-cli
to enhance the user experience with the Access for Infrastructure SSH solution. - Added pre-login configuration details to the
warp-diag
output. - Added a
tunnel reset mtu
subcommand to thewarp-cli
. - Added a JSON output option to the
warp-cli
. - Added the ability for
warp-cli
to use the team name provided in the MDM file for initial registration. - Added the ability to execute a PCAP on multiple interfaces with
warp-cli
andwarp-dex
. - Improved
warp-dex
default interface selection for PCAPs and changedwarp-dex
CLI output to JSON. - Fixed an issue where the client, when switching between WireGuard and MASQUE protocols, sometimes required a manual tunnel key reset.
- Added MASQUE tunnel protocol support for the consumer version of WARP (1.1.1.1 w/ WARP).
Known issues:
- Using MASQUE as the tunnel protocol may be incompatible if your organization has Regional Services is enabled.
Zero Trust WARP Client
WARP client for macOS (version 2024.9.346.0)A new GA release for the macOS WARP client is now available in the App Center. This release contains minor fixes and improvements.
All customers running macOS Ventura 13.0 and above (including Sequoia) are advised to upgrade to this release. This release fixes an incompatibility with the firewall found on macOS Sonoma 14.4 and above that could result in the firewall being disabled.
Notable updates:
- Added
target list
to thewarp-cli
to enhance the user experience with the Access for Infrastructure SSH solution. - Added a
tunnel reset mtu
subcommand to thewarp-cli
. - Added the ability for
warp-cli
to use the team name provided in the MDM file for initial registration. - Added a JSON output option to the
warp-cli
. - Added the ability to execute a PCAP on multiple interfaces with
warp-cli
andwarp-dex
. - Improved
warp-dex
default interface selection for PCAPs and changedwarp-dex
CLI output to JSON. - Improved application posture check compatibility with symbolically linked files.
- Fixed an issue where the client, when switching between WireGuard and MASQUE protocols, sometimes required a manual tunnel key reset.
- Added MASQUE tunnel protocol support for the consumer version of WARP (1.1.1.1 w/ WARP).
Known issues:
- Using MASQUE as the tunnel protocol may be incompatible if your organization has Regional Services is enabled.
Magic Firewall
New UI improvementsThe dashboard now allows you to search custom rules using the rule name and/or ID. Additionally, the rule ID URL link has been added to Network Analytics. Go to Analytics & Logs > Network Analytics > Magic Firewall > Packet sample log > Search for Rule ID.
Magic WAN
Early access testing for BGP on CNI 2.0 circuitsCustomers can exchange routes dynamically with their Magic virtual network overlay via Direct CNI or Cloud CNI based connectivity.
Magic WAN
Early access testing for BGP on CNI 2.0 circuitsCustomers can exchange routes dynamically with their Magic virtual network overlay via Direct CNI or Cloud CNI based connectivity.
Cloudflare Network Interconnect
Early access testing for BGP on CNI 2.0 circuitsCustomers can exchange routes dynamically with their Magic virtual network overlay via Direct CNI or Cloud CNI based connectivity.
Gateway
File sandboxingGateway users on Enterprise plans can create HTTP policies with file sandboxing to quarantine previously unseen files downloaded by your users and scan them for malware.
Magic WAN
Magic WAN Connector sends WARP client traffic to InternetAll Magic WAN Connectors now route WARP client traffic directly to the Internet, bypassing IPsec tunneling, to prevent double encapsulation of WARP traffic.
Zero Trust WARP Client
WARP client for macOS (version 2024.8.457.0)A new GA release for the macOS WARP client is now available in the App Center. This release contains minor fixes and improvements.
Notable updates:
- Added the ability to customize PCAP options in
warp-cli
. - Added a list of installed applications in
warp-diag
. - Added a summary of
warp-dex
traceroute results in its JSON output. - Improved the performance of firewall operations when enforcing Split Tunnels configuration.
- Fixed an issue where the DNS logs were not being cleared when the user switched configurations.
- Fixed an issue where clients using service tokens failed to retry after a network change.
- Fixed a known issue which required users to re-register when an older single configuration MDM file was deployed after deploying the newer, multiple configuration format.
- Fixed an issue which prevented the use of private IP ranges that overlapped with end users' home networks.
- Deprecated
warp-cli
commands have been removed. If you have any workflows that use the deprecated commands, update to the new commands where necessary.
Known issues:
- Cloudflare is investigating temporary networking issues on macOS 15 (Sequoia) that seem to affect some users.
- Using MASQUE as the tunnel protocol may be incompatible if your organization has Regional Services is enabled.
Zero Trust WARP Client
WARP client for Windows (version 2024.8.458.0)A new GA release for the Windows WARP client is now available in the App Center. This release contains minor fixes and improvements.
Notable updates:
- Added the ability to customize PCAP options in
warp-cli
. - Added a list of installed applications in
warp-diag
. - Added a summary of
warp-dex
traceroute results in its JSON output. - Improved the performance of firewall operations when enforcing Split Tunnels configuration.
- Reduced the time it takes for a WARP client update to complete.
- Fixed an issue where clients using service tokens failed to retry the initial connection when there is no network connectivity on startup.
- Fixed issues where incorrect DNS server addresses were being applied following reboots and network changes. Any incorrect static entries set by previous WARP versions must be manually reverted.
- Fixed a known issue which required users to re-register when an older single configuration MDM file was deployed after deploying the newer, multiple configuration format.
- Deprecated
warp-cli
commands have been removed. If you have any workflows that use the deprecated commands, update to the new commands where necessary.
Known issues:
Using MASQUE as the tunnel protocol may be incompatible if your organization has Regional Services enabled.
DNS resolution may be broken when all of the following conditions are true:
- WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
- A custom DNS server address is configured on the primary network adapter.
- The custom DNS server address on the primary network adapter is changed while WARP is connected.
To work around the DNS issue, reconnect the WARP client by toggling off and back on.
Magic Network Monitoring
Magic Network Monitoring free version available to all customersThe free version of Magic Network Monitoring (MNM) is now available to everyone with a Cloudflare account by default.
Magic Firewall
New UI improvementsThe dashboard now displays the order number of custom rules, and improved drag and drop functionality. You can also preview rules on a side panel without leaving the current page.
Magic Cloud Networking
Cost estimates for network resourcesCustomers can now view estimated costs for discovered network resources.
DLP
Exact Data Match multi-entry upload supportYou can now upload files with multiple columns of data as Exact Data Match datasets. DLP can use each column as a separate existing detection entry.
Cloudflare Network Interconnect
Interconnect portal displays all available locations in a listCustomers can now see all available Direct CNI locations when searching for a Cloudflare site in the Interconnects interface.
Access
Reduce automatic seat deprovisioning minimum to 1 month, down from 2 months.Admins can now configure Zero Trust seats to automatically expire after 1 month of user inactivity. The previous minimum was 2 months.
Zero Trust WARP Client
WARP client for macOS (version 2024.8.309.1)A new beta release for the macOS WARP client is now available in the App Center. This release contains minor fixes and improvements.
Notable updates:
- Added the ability to customize PCAP options in
warp-cli
. - Added a list of installed applications in
warp-diag
. - Added a summary of
warp-dex
traceroute results in its JSON output. - Improved the performance of firewall operations when enforcing Split Tunnels configuration.
- Fixed an issue where the DNS logs were not being cleared when the user switched configurations.
- Fixed a known issue which required users to re-register when an older single configuration MDM file was deployed after deploying the newer, multiple configuration format.
- Fixed an issue which prevented the use of private IP ranges that overlapped with end users' home networks.
- Deprecated
warp-cli
commands have been removed. If you have any workflows that use the deprecated commands, update to the new commands where necessary.
Known issues:
- Using MASQUE as the tunnel protocol may be incompatible if your organization has either of the following conditions:
- Magic WAN is enabled but does not have the latest packet flow path for WARP traffic. To check the migration status, contact your account team.
- Regional Services is enabled.
Zero Trust WARP Client
WARP client for Windows (version 2024.8.308.1)A new beta release for the Windows WARP client is now available in the App Center. This release contains minor fixes and improvements.
Notable updates:
- Added the ability to customize PCAP options in
warp-cli
. - Added a list of installed applications in
warp-diag
. - Added a summary of
warp-dex
traceroute results in its JSON output. - Improved the performance of firewall operations when enforcing Split Tunnels configuration.
- Reduced the time it takes for a WARP client update to complete.
- Fixed issues where incorrect DNS server addresses were being applied following reboots and network changes. Any incorrect static entries set by previous WARP versions must be manually reverted.
- Fixed a known issue which required users to re-register when an older single configuration MDM file was deployed after deploying the newer, multiple configuration format.
- Deprecated
warp-cli
commands have been removed. If you have any workflows that use the deprecated commands, update to the new commands where necessary.
Known issues:
Using MASQUE as the tunnel protocol may be incompatible if your organization has either of the following conditions:
- Magic WAN is enabled but does not have the latest packet flow path for WARP traffic. To check the migration status, contact your account team.
- Regional Services is enabled.
DNS resolution may be broken when all of the following conditions are true:
- WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
- A custom DNS server address is configured on the primary network adapter.
- The custom DNS server address on the primary network adapter is changed while WARP is connected.
To work around the DNS issue, reconnect the WARP client by toggling off and back on.
Magic Firewall
Magic Firewall Analytics Rule Log EnhancementCustomers who create a rule in a disabled mode will see the rule as Log (rule disabled).
Zero Trust WARP Client
WARP client for Linux (version 2024.6.497.0)A new GA release for the Linux WARP client is now available in the package repository. This release includes some exciting new features. It also includes additional fixes and minor improvements.
New features:
- The WARP client now supports operation on Ubuntu 24.04.
- Admins can now elect to have ZT WARP clients connect using the MASQUE protocol; this setting is in Device Profiles. Note: before MASQUE can be used, the global setting for Override local interface IP must be enabled. For more detail, refer to Device tunnel protocol. This feature will be rolled out to customers in stages over approximately the next month.
- The Device Posture client certificate check has been substantially enhanced. The primary enhancement is the ability to check for client certificates that have unique common names, made unique by the inclusion of the device serial number or host name (for example, CN =
123456.mycompany
, where 123456 is the device serial number). - TCP MSS clamping is now used where necessary to meet the MTU requirements of the tunnel interface. This will be especially helpful in Docker use cases.
Warning:
- Ubuntu 16.04 and 18.04 are not supported by this version of the client.
- This is the last GA release that will be supporting older, deprecated
warp-cli
commands. There are two methods to identify these commands. One, when used in this release, the command will work but will also return a deprecation warning. And two, the deprecated commands do not appear in the output ofwarp-cli -h
.
Known issues:
- There are certain known limitations preventing the use of the MASQUE tunnel protocol in certain scenarios. Do not use the MASQUE tunnel protocol if:
- A Magic WAN integration is on the account and does not have the latest packet flow path for WARP traffic. To check the migration status, contact your account team.
- Your account has Regional Services enabled.
- The Linux client GUI does not yet support all GUI features found in the Windows and macOS clients. Future releases of the Linux client will be adding these GUI features.
- The Zero Trust team name is not visible in the GUI if you upgraded from the previous GA release using an MDM tool.
- Sometimes the WARP icon will remain gray (disconnected state) while in dark mode.
Magic Cloud Networking
GCP on-rampsMagic Cloud Networking supports Google Cloud Platform.
Email Security
Email Security is liveEmail Security is now live under Zero Trust.
Email Security
Microsoft Graph API deployment.Customers using Microsoft Office 365 can set up Email Security via Microsoft Graph API.
Cloudflare Tunnel
cloudflared builds available in GitHub for Apple siliconmacOS users can now download cloudflared-arm64.pkg
directly from GitHub, in addition to being available via Homebrew.
Gateway
UK NCSC indicator feed publicly available in GatewayGateway users on any plan can now use the PDNS threat intelligence feed provided by the UK National Cyber Security Centre (NCSC) in DNS policies.
Zero Trust WARP Client
WARP client for macOS (version 2024.6.474.0)A new GA release for the macOS WARP client is now available in the App Center. This release contains fixes to improve the client; no new features are included.
Notable updates:
- Fixed an issue which caused alternate network detection to fail if the beacon host was using TLS 1.2 without TLS Extended Master Secret (EMS) enabled.
- Improved the stability of device profile switching based on alternate network detection.
Known issues:
- If a user has an MDM file configured to support multiple profiles (for the switch configurations feature), and then changes to an MDM file configured for a single profile, the WARP client may not connect. The workaround is to use the
warp-cli registration delete
command to clear the registration, and then re-register the client. - There are certain known limitations preventing the use of the MASQUE tunnel protocol in certain scenarios. Do not use the MASQUE tunnel protocol if:
- A Magic WAN integration is on the account and does not have the latest packet flow path for WARP traffic. Please check migration status with your account team.
- Your account has Regional Services enabled.
Zero Trust WARP Client
WARP client for Windows (version 2024.6.473.0)A new GA release for the Windows WARP client is now available in the App Center. This release contains fixes to improve the client; no new features are included.
Notable updates:
- Fixed an issue which caused alternate network detection to fail if the beacon host was using TLS 1.2 without TLS Extended Master Secret (EMS) enabled.
- Improved the stability of device profile switching based on alternate network detection.
Known issues:
- If a user has an MDM file configured to support multiple profiles (for the switch configurations feature), and then changes to an MDM file configured for a single profile, the WARP client may not connect. The workaround is to use the
warp-cli registration delete
command to clear the registration, and then re-register the client. - There are certain known limitations preventing the use of the MASQUE tunnel protocol in certain scenarios. Do not use the MASQUE tunnel protocol if:
- A Magic WAN integration is on the account and does not have the latest packet flow path for WARP traffic. Please check migration status with your account team.
- Your account has Regional Services enabled.
Magic WAN
Updates to High Availability on the Magic WAN ConnectorThe High Availability feature on Magic WAN Connector now supports additional failover conditions, DHCP lease syncing, and staggered upgrades.
Gateway
Gateway DNS filter non-authenticated queriesGateway users can now select which endpoints to use for a given DNS location. Available endpoints include IPv4, IPv6, DNS over HTTPS (DoH), and DNS over TLS (DoT). Users can protect each configured endpoint by specifying allowed source networks. Additionally, for the DoH endpoint, users can filter traffic based on source networks and/or authenticate user identity tokens.
Magic Cloud Networking
Closed beta launchThe Magic Cloud Networking closed beta release is available, with the managed cloud on-ramps feature.
Zero Trust WARP Client
WARP client for macOS (version 2024.6.416.0)A new GA release for the macOS WARP client is now available in the App Center. This release includes some exciting new features. It also includes additional fixes and minor improvements.
New features:
- Admins can now elect to have ZT WARP clients connect using the MASQUE protocol; this setting is in Device Profiles. Note: before MASQUE can be used, the global setting for Override local interface IP must be enabled. For more detail, refer to Device tunnel protocol. This feature will be rolled out to customers in stages over approximately the next month.
- The Device Posture client certificate check has been substantially enhanced. The primary enhancement is the ability to check for client certificates that have unique common names, made unique by the inclusion of the device serial number or host name (for example, CN =
123456.mycompany
, where 123456 is the device serial number).
Additional changes and improvements:
- Fixed a known issue where the certificate was not always properly left behind in
/Library/Application Support/Cloudflare/installed_cert.pem
. - Fixed an issue where re-auth notifications were not cleared from the UI when the user switched configurations.
- Fixed a macOS firewall rule that allowed all UDP traffic to go outside the tunnel. Relates to TunnelVision (CVE-2024-3661).
- Fixed an issue that could cause the Cloudflare WARP menu bar application to disappear when switching configurations.
Warning:
- This is the last GA release that will be supporting older, deprecated
warp-cli
commands. There are two methods to identify these commands. One, when used in this release, the command will work but will also return a deprecation warning. And two, the deprecated commands do not appear in the output ofwarp-cli -h
.
Known issues:
- If a user has an MDM file configured to support multiple profiles (for the switch configurations feature), and then changes to an MDM file configured for a single profile, the WARP client may not connect. The workaround is to use the
warp-cli registration delete
command to clear the registration, and then re-register the client. - There are certain known limitations preventing the use of the MASQUE tunnel protocol in certain scenarios. Do not use the MASQUE tunnel protocol if:
- A Magic WAN integration is on the account and does not have the latest packet flow path for WARP traffic. Please check migration status with your account team.
- Your account has Regional Services enabled.
Zero Trust WARP Client
WARP client for Windows (version 2024.6.415.0)A new GA release for the Windows WARP client is now available in the App Center. This release includes some exciting new features. It also includes additional fixes and minor improvements.
New features:
- Admins can now elect to have ZT WARP clients connect using the MASQUE protocol; this setting is in Device Profiles. Note: before MASQUE can be used, the global setting for Override local interface IP must be enabled. For more detail, refer to Device tunnel protocol. This feature will be rolled out to customers in stages over approximately the next month.
- The ZT WARP client on Windows devices can now connect before the user completes their Windows login. This Windows pre-login capability allows for connecting to on-premise Active Directory and/or similar resources necessary to complete the Windows login.
- The Device Posture client certificate check has been substantially enhanced. The primary enhancement is the ability to check for client certificates that have unique common names, made unique by the inclusion of the device serial number or host name (for example, CN =
123456.mycompany
, where 123456 is the device serial number).
Additional changes and improvements:
- Added a new Unable to Connect message to the UI to help in troubleshooting.
- The upgrade window now uses international date formats.
- Made a change to ensure DEX tests are not running when the tunnel is not up due to the device going to or waking from sleep. This is specific to devices using the S3 power model.
- Fixed a known issue where the certificate was not always properly left behind in
%ProgramData%\Cloudflare\installed_cert.pem
. - Fixed an issue where ICMPv6 Neighbor Solicitation messages were being incorrectly sent on the WARP tunnel.
- Fixed an issue where a silent upgrade was causing certain files to be deleted if the target upgrade version is the same as the current version.
Warning:
- This is the last GA release that will be supporting older, deprecated
warp-cli
commands. There are two methods to identify these commands. One, when used in this release, the command will work but will also return a deprecation warning. And two, the deprecated commands do not appear in the output ofwarp-cli -h
.
Known issues:
- If a user has an MDM file configured to support multiple profiles (for the switch configurations feature), and then changes to an MDM file configured for a single profile, the WARP client may not connect. The workaround is to use the
warp-cli registration delete
command to clear the registration, and then re-register the client. - There are certain known limitations preventing the use of the MASQUE tunnel protocol in certain scenarios. Do not use the MASQUE tunnel protocol if:
- A Magic WAN integration is on the account and does not have the latest packet flow path for WARP traffic. Please check migration status with your account team.
- Your account has Regional Services enabled.
Zero Trust WARP Client
Cloudflare One Agent for iOS (version 1.4)A new GA release for the iOS Cloudflare One Agent is now available in the iOS App Store.
Notable updates:
- Fixed an issue with endpoint IP settings in MDM files
- Cleaned up some erroneous links
- Updated the Terms of Service
Gateway
Gateway DNS policy setting to ignore CNAME category matchesGateway now offers the ability to selectively ignore CNAME domain categories in DNS policies via the Ignore CNAME domain categories setting in the policy builder and the ignore_cname_category_matches
setting in the API.
Magic WAN
ICMP support for traffic sourced from private IPsMagic WAN will now support ICMP traffic sourced from private IPs going to the Internet via Gateway.
Risk score
Okta risk exchangeYou can now exchange user risk scores with Okta to inform SSO-level policies.
Risk score
SentinelOne signal ingestionYou can now configure a predefined risk behavior to evaluate user risk score using device posture attributes from the SentinelOne integration.
Access
Scalability improvements to the App LauncherApplications now load more quickly for customers with a large number of applications or complex policies.
Magic WAN
Application based prioritizationThe Magic WAN Connector can now prioritize traffic on a per-application basis.
CASB
Atlassian Bitbucket integrationCustomers can now scan their Bitbucket Cloud workspaces for a variety of contextualized security issues such as source code exposure, admin misconfigurations, and more.
Magic WAN
WARP virtual IP addressesCustomers using Gateway to filter traffic to Magic WAN destinations will now see traffic from Cloudflare egressing with WARP virtual IP addresses (CGNAT range), rather than public Cloudflare IP addresses. This simplifies configuration and improves visibility for customers.
Zero Trust WARP Client
WARP client for Windows (version 2024.5.310.1)A new beta release for the Windows WARP client is now available in the App Center.
Notable updates:
- Added a new Unable to Connect message to the UI to help in troubleshooting.
- In the upgrade window, a change was made to use international date formats to resolve an issue with localization.
- Made a change to ensure DEX tests are not running when the tunnel is not up due to the device going to or waking from sleep. This is specific to devices using the S3 power model.
- Fixed a known issue where the certificate was not always properly left behind in
%ProgramData%\Cloudflare\installed_cert.pem
. - Fixed an issue where ICMPv6 Neighbor Solicitation messages were being incorrectly sent on the WARP tunnel.
Known issues:
- If a user has an MDM file configured to support multiple profiles (for the switch configurations feature), and then changes to an MDM file configured for a single profile, the WARP client may not connect. The workaround is to use the
warp-cli registration delete
command to clear the registration, and then re-register the client.
Zero Trust WARP Client
WARP client for macOS (version 2024.5.287.1)A new beta release for the macOS WARP client is now available in the App Center
Notable updates:
- Fixed a known issue where the certificate was not always properly left behind in
/Library/Application Support/Cloudflare/installed_cert.pem
. - Fixed an issue so that the reauth notification is cleared from the UI when the user switches configurations.
- Fixed an issue by correcting the WARP client setting of macOS firewall rules. This relates to TunnelVision (CVE-2024-3661).
- Fixed an issue that could cause the Cloudflare WARP menu bar application to disappear when switching configurations.
Known issues:
- If a user has an MDM file configured to support multiple profiles (for the switch configurations feature), and then changes to an MDM file configured for a single profile, the WARP client may not connect. The workaround is to use the
warp-cli registration delete
command to clear the registration, and then re-register the client.
Digital Experience Monitoring
Last seen ISPAdmins can view the last ISP seen for a device by going to My Team > Devices. Requires setting up a traceroute test.
Digital Experience Monitoring
DEX alertsAdmins can now set DEX alerts using Cloudflare Notifications. Three new DEX alert types:
- Device connectivity anomaly
- Test latency
- Test low availability
Zero Trust WARP Client
Cloudflare One Agent for Android (version 1.7)A new GA release for the Android Cloudflare One Agent is now available in the Google Play Store. This release fixes an issue where the user was not prompted to select the client certificate in the browser during Access registration.
Zero Trust WARP Client
Crowdstrike posture checks for online statusTwo new Crowdstrike attributes, Last Seen and State, are now available to be used as selectors in the Crowdstrike service provider integration.
Zero Trust WARP Client
WARP client for macOS (version 2024.3.444.0)A new GA release for the macOS WARP client is now available in the App Center. This releases fixes an issue with how the WARP client sets macOS firewall rules and addresses the TunnelVision (CVE-2024-3661) vulnerability.
Access
Add option to bypass CORS to origin serverAccess admins can defer all CORS enforcement to their origin server for specific Access applications.
CASB
Export CASB findings to CSVYou can now export all top-level CASB findings or every instance of your findings to CSV.
DLP
Optical character recognitionDLP can now detect sensitive data in jpeg, jpg, and png files. This helps companies prevent the leak of sensitive data in images, such as screenshots.
Access
Zero Trust User identity audit logsAll user identity changes via SCIM or Authentication events are logged against a user's registry identity.
Gateway
Gateway file type control improvementsGateway now offers a more extensive, categorized list of files to control uploads and downloads.
Browser Isolation
Removed third-party cookie dependenciesRemoved dependency on third-party cookies in the isolated browser, fixing an issue that previously caused intermittent disruptions for users maintaining multi-site, cross-tab sessions in the isolated browser.
Access
Access for SaaS OIDC SupportAccess for SaaS applications can be setup with OIDC as an authentication method. OIDC and SAML 2.0 are now both fully supported.
Access
WARP as an identity source for AccessAllow users to log in to Access applications with their WARP session identity. Users need to reauthenticate based on default session durations. WARP authentication identity must be turned on in your device enrollment permissions and can be enabled on a per application basis.
Magic WAN
Network segmentationYou can define policies in your Connector to either allow traffic to flow between your LANs without it leaving your local premises or to forward it via the Cloudflare network where you can add additional security features.
Access
Unique Entity IDs in Access for SaaSAll new Access for SaaS applications have unique Entity IDs. This allows for multiple integrations with the same SaaS provider if required. The unique Entity ID has the application audience tag appended. Existing apps are unchanged.
Access
Default relay state support in Access for SaaSAllows Access admins to set a default relay state on Access for SaaS apps.
Access
App launcher supports tags and filtersAccess admins can now tag applications and allow users to filter by those tags in the App Launcher.
Access
App launcher customizationAllow Access admins to configure the App Launcher page within Zero Trust.
Access
View active Access user identities in the dashboard and APIAccess admins can now view the full contents of a user's identity and device information for all active application sessions.
Access
Custom OIDC claims for named IdPsAccess admins can now add custom claims to the existing named IdP providers. Previously this was locked to the generic OIDC provider.
Access
Azure AD authentication contextsSupport Azure AD authentication contexts directly in Access policies.
Access
Custom block pages for Access applicationsAllow Access admins to customize the block pages presented by Access to end users.