Skip to main content

Integrate with Cloudflare Secure Web Gateway

Describes Cloudflare SASE integration using Secure Web Gateway DNS and HTTP policies. Covers the X-Authenticated-User header built from Cloudflare identity variables, the X-SP-Connector-ID header, catalog download, and verification.

Overview

This integration redirects public GenAI traffic from devices that run the Cloudflare One Client to F5 Workforce AI Security. It uses policies in Cloudflare Secure Web Gateway. A DNS policy resolves the GenAI domains in the Workforce AI Security Public Services catalog to the Workforce AI Security edge. An HTTP policy then adds two headers to that traffic. The X-Authenticated-User header carries the identity of the user who logged in. The X-SP-Connector-ID header identifies the Cloudflare connector.

Both Cloudflare and Workforce AI Security log the traffic. You can use either platform to troubleshoot or analyze it.

Cloudflare supplies the user identity for each request that it proxies. When users use GenAI services that Workforce AI Security governs, they don't see an authentication prompt. The experience is transparent to users.

The Set up proxy chaining with Netskope and Set up proxy chaining with Zscaler integrations attribute traffic the same way.

The policies redirect public GenAI access to Workforce AI Security for every user whose traffic matches them. Make sure you understand this redirect before you set up the integration.

The policies apply only to devices that run the Cloudflare One Client. They don't cover unmanaged devices, personal devices, or servers. For proof-of-concept or pilot deployments, add an identity condition to the policies. The condition limits the redirect to a subset of users or groups. You can then widen the policies to all users for production.

Prerequisites

Before you begin, make sure that the following conditions are true:

  • The Cloudflare One Client (formerly WARP) runs in Traffic and DNS mode on all in-scope devices, and each device is registered with an identity provider.

  • The Cloudflare root certificate is installed on all in-scope devices, and TLS inspection is on for GenAI traffic.

  • Identity variables are available in HTTP policy headers in your Cloudflare account.

  • If you manage your Cloudflare configuration in Terraform, you use version 5.23.0 or later of the Cloudflare module.

Cloudflare fills the X-Authenticated-User header only for devices with a registered identity. A device in DNS-only mode still follows the DNS policy to the Workforce AI Security edge. The HTTP policy never applies to that device.

An HTTP policy can change request headers only on traffic that Cloudflare proxies and decrypts. Headers aren't visible on traffic that stays encrypted. If you turn on TLS inspection before you install the Cloudflare root certificate, every inspected HTTPS session fails with a certificate error.

The Cloudflare root certificate is separate from the SurePath AI Root CA. The SurePath AI Root CA is the root certificate of the Workforce AI Security certificate authority (CA).

Identity variables are a Cloudflare beta feature. To check for them, complete the steps in Confirm identity variables are available.

Earlier versions of the Cloudflare Terraform module can't express the policy configuration in this article.

Workforce AI Security configuration steps

Do these steps in the Admin UI before you configure Cloudflare.

Distribute the root certificate to endpoints

Workforce AI Security recommends that you distribute the SurePath AI Root CA to all endpoints as a trusted certificate authority. In this deployment, two systems decrypt GenAI traffic. Cloudflare decrypts it during TLS inspection, and the Workforce AI Security edge decrypts it again.

The certificate prevents trust errors and warnings in browsers and applications. The Cloudflare root certificate is a separate certificate. You need both.

To download and distribute the certificate:

  1. In CONFIGURE, go to Organization > Integration.

  2. Select the certificate format that fits the endpoint operating systems.

  3. Select DOWNLOAD CERTIFICATE.

  4. Distribute the SurePath AI Root CA with your existing certificate deployment tools. Examples are Group Policy, platforms for mobile device management (MDM), and endpoint management tools.

Download the Cloudflare Public Services catalog

Workforce AI Security maintains a curated list of GenAI sites on the public internet. The list includes vendor names and associated risk levels. You download this list in a format that Cloudflare supports. The list is the traffic condition in each policy.

To download the catalog:

  1. In GOVERN, go to Public Services.

  2. At the top of the page, select DOWNLOAD CATALOG.

  3. In the Download Format list, select Cloudflare Config.

  4. Select DOWNLOAD.

The downloaded file has a name similar to f5-workforce-ai-security-public-services-cloudflare-YYYY-MM-DD.txt. It holds two regular expressions. Cloudflare limits one compiled regular expression to 524,288 bytes, and the full catalog is larger than this limit. For this reason, each policy in this article has two host conditions, one for each expression:

  • The wildcard expression is between the BEGIN WILDCARD DOMAINS REGEX and END WILDCARD DOMAINS REGEX lines. It matches each domain and all of its subdomains.

  • The exact-match expression is between the BEGIN EXACT DOMAINS REGEX and END EXACT DOMAINS REGEX lines. It matches only the exact host names.

Each expression is one long line. Copy it as it is, without the BEGIN and END lines.

For example, a catalog with four domains gives this file:

----- BEGIN WILDCARD DOMAINS REGEX -----
(^|\.)(adcreative\.ai|claude\.ai)$
----- END WILDCARD DOMAINS REGEX ---------- BEGIN EXACT DOMAINS REGEX -----
^(api\.openai\.com|chatgpt\.com)$
----- END EXACT DOMAINS REGEX -----

Don't add domains to the expressions. To add sites to the catalog, contact your Workforce AI Security technical representative. The representative can advise you on the right approach.

When the catalog changes, the policies don't update themselves. To receive traffic for newly added GenAI services, download a fresh copy of the catalog. Then replace both expressions in each policy.

Each Cloudflare connector also has a catalog URL. After you create the connector, the URL shows in the connector details on the Connectors page. The URL returns the same two expressions as a JSON array, with the wildcard expression first.

The response uses JSON escaping, so each backslash appears as two backslashes (\\). Before you paste an expression into a policy, remove the quotation marks around it. Then replace each \\ with \.

A JSON tool can do the conversion. For example, if you save the response as catalog.json, the command jq -r '.[0]' catalog.json prints the wildcard expression. The command jq -r '.[1]' catalog.json prints the exact-match expression.

Create the Cloudflare connector

Workforce AI Security uses the connector to identify inbound traffic from your Cloudflare deployment as trusted. With the connector, Workforce AI Security also accepts the X-Authenticated-User header.

To create the connector:

  1. In CONFIGURE, go to Connectors.

  2. At the top of the page, select ADD CONNECTOR.

  3. In the Name box, enter a name such as Cloudflare Connector.

  4. In the Type list, from the Network Ingress section, select Cloudflare.

  5. Turn on Enable X-Authenticated-User Header.

  6. Select SAVE.

  7. Note the Connector ID value. You need it for the HTTP policy.

X-Authenticated-User header

The X-Authenticated-User header tells Workforce AI Security who the end user is. The user sees no authentication prompt.

How the X-Authenticated-User header works

Cloudflare proxies a request to the Workforce AI Security edge. The HTTP policy then inserts the X-Authenticated-User header. The header holds the email address of the user who logged in. The policy also inserts the X-SP-Connector-ID header with the connector identifier.

Workforce AI Security validates that the traffic comes from the trusted Cloudflare connector. It then associates the identity of the user with their GenAI activity. Workforce AI Security doesn't redirect users to a single sign-on (SSO) page, so users see no interruption.

Both headers are required. Without the connector header, Workforce AI Security can't establish that the traffic came from a trusted source. It also doesn't honor the identity in the X-Authenticated-User header. Without the identity header, Workforce AI Security can't link activity to individual users.

Why the headers are overwritten rather than added

The HTTP policy uses Overwrite headers instead of Add headers. Overwrite headers replaces any value already on the request.

A browser extension, a modified client, or a user who tries to impersonate someone else can set a header locally. Cloudflare replaces that header with the value from the authenticated session. Add headers leaves a client-supplied value next to the Cloudflare value. A malicious user can then influence how Workforce AI Security attributes their activity. Don't use Add headers for either header.

Cloudflare configuration steps

The Cloudflare configuration has two required policies in Secure Web Gateway and one optional policy. The DNS policy sends GenAI traffic to the Workforce AI Security edge. The HTTP policy attaches the identity and connector headers to that traffic. The optional bypass policy limits TLS inspection to GenAI traffic. If you don't apply TLS inspection to all traffic, create the bypass policy.

Every step in this section starts from the Cloudflare One dashboard at one.dash.cloudflare.com. Before each policy, go to Traffic policies > Firewall policies. The steps describe the dashboard workflow. If you work in Terraform, translate them into your own configuration.

Confirm identity variables are available

Cloudflare builds the X-Authenticated-User header from an identity variable, @{identity.email}. When Cloudflare proxies a request, this variable resolves to the email address of the user who logged in. Identity variables in HTTP policy headers are a Cloudflare beta feature. Not every account has this feature turned on.

To confirm availability:

  1. Select Add a policy.

  2. In the If traffic type is list, select HTTP.

  3. In the Then list, select Allow.

  4. Turn on Modify request headers.

  5. Look at the header value box. If the box accepts @{identity.email} and shows a variable picker, the feature is available.

  6. Discard the policy without saving it.

If the feature isn't available, contact your Cloudflare account representative. Ask the representative to turn it on before you continue with this integration.

Create the policy for the Domain Name System

To create the DNS policy:

  1. Select Add a policy.

  2. In the If traffic type is list, select DNS.

  3. Enter a policy name such as Workforce AI Security - GenAI DNS policy.

  4. Optionally, enter a description such as DNS policy that directs GenAI traffic to Workforce AI Security.

  5. Under And traffic matches, add a condition for the wildcard expression:

    1. In the selector list, select Host.

    2. In the operator list, select matches regex.

    3. In the value box, enter the wildcard expression from the catalog.

  6. Select + Or.

  7. Add a condition for the exact-match expression:

    1. In the selector list, select Host.

    2. In the operator list, select matches regex.

    3. In the value box, enter the exact-match expression from the catalog.

  8. Under And identity matches, set the scope:

    • To apply the policy to all users, add no condition.

    • To limit the policy to specific users or groups during a pilot, add a condition.

  9. In the Then list, select Override.

  10. In the Override destination box, enter edge.surepath.ai. Cloudflare adds the value to the box as a tag.

  11. Select Save.

Create the policy for the Hypertext Transfer Protocol

To create the HTTP policy:

  1. Select Add a policy.

  2. In the If traffic type is list, select HTTP.

  3. Enter a policy name such as Workforce AI Security - GenAI HTTP policy.

  4. Optionally, enter a description such as HTTP policy that adds Workforce AI Security identity and connector headers to all GenAI traffic.

  5. Under And traffic matches, add a condition for the wildcard expression:

    1. In the selector list, select Host.

    2. In the operator list, select matches regex.

    3. In the value box, enter the wildcard expression from the catalog.

  6. Select + Or.

  7. Add a condition for the exact-match expression:

    1. In the selector list, select Host.

    2. In the operator list, select matches regex.

    3. In the value box, enter the exact-match expression from the catalog.

  8. Under And identity matches, set the scope:

    • To apply the policy to all users, add no condition.

    • To limit the policy to specific users or groups during a pilot, add a condition.

  9. Under And posture matches, set the scope:

    • To apply the policy to all devices regardless of posture, add no condition.

    • To limit the policy to a specific device posture, add a condition.

  10. In the Then list, select Allow.

  11. In the Untrusted certificate action list, select Pass through. Cloudflare then connects to the Workforce AI Security edge without verifying its certificate. This setting applies only to hosts that this policy matches.

  12. Turn on Modify request headers.

  13. Select Overwrite headers to add the identity header:

    1. In the Header name box, enter X-Authenticated-User.

    2. In the Header value box, enter @{identity.email}.

  14. Select Overwrite headers again to add the connector header:

    1. In the Header name box, enter X-SP-Connector-ID.

    2. In the Header value box, enter the Connector ID value that you noted when you created the connector.

  15. Select Save.

The identity and posture conditions on this policy must be at least as broad as the identity condition on the DNS policy. Suppose the DNS policy sends the traffic of a user to the Workforce AI Security edge, but this policy doesn't apply to that user. Their requests then arrive at Workforce AI Security with neither header. Workforce AI Security can't establish that the traffic came from a trusted source.

Create the bypass policy (optional)

If you already apply TLS inspection broadly across all traffic, you don't need this policy. If you want to limit Cloudflare inspection to GenAI traffic, create it. This policy turns off TLS inspection for non-GenAI traffic. As a result, Cloudflare no longer logs or blocks HTTP requests on that traffic. It also stops data loss prevention (DLP) policies and antivirus scanning on that traffic.

To create the bypass policy:

  1. Select Add a policy.

  2. In the If traffic type is list, select HTTP.

  3. Enter a policy name such as Workforce AI Security - non-GenAI bypass.

  4. Optionally, enter a description such as Bypasses TLS inspection for all non-GenAI traffic.

  5. Under And traffic matches, add a condition for the wildcard expression:

    1. In the selector list, select Host.

    2. In the operator list, select does not match regex.

    3. In the value box, enter the wildcard expression from the catalog.

  6. In the same condition group, select + And.

  7. Add a condition for the exact-match expression:

    1. In the selector list, select Host.

    2. In the operator list, select does not match regex.

    3. In the value box, enter the exact-match expression from the catalog.

  8. In the Then list, select Do Not Inspect.

  9. Select Save.

Join the two bypass conditions with And, not Or. A GenAI host can match one expression and not the other. With Or, the bypass policy then matches that host, and Cloudflare stops inspecting its traffic.

This policy matches only hosts that are absent from the catalog, so it can't match GenAI traffic. Its position in the policy list doesn't affect the Workforce AI Security HTTP policy.

Any other Do Not Inspect policy in the account is different. Cloudflare evaluates all Do Not Inspect policies before Allow policies, regardless of their position in the list. A preexisting Do Not Inspect policy that matches a GenAI domain therefore suppresses the Workforce AI Security HTTP policy and its headers. Review the account for existing Do Not Inspect policies that overlap the catalog.

Verification and troubleshooting

To verify the configuration, follow the steps in Verify the integration.

To confirm that activity shows named users:

  1. Deploy the policies to test users or groups.

  2. In OBSERVE, go to User Activity.

  3. Review recent GenAI requests from the test population. Confirm that each request shows a named user.

If requests don't show named users, look for two failure patterns.

Some requests reach Workforce AI Security without a named user. In that case, the HTTP policy applies and the connector header arrives, but the identity variable doesn't resolve. The usual cause is a device that isn't registered with the identity provider.

If requests reach Workforce AI Security with no headers at all, the HTTP policy doesn't apply to that traffic. One usual cause is a device that runs the Cloudflare One Client in DNS-only mode. Another cause is an identity or posture condition in the HTTP policy that is narrower than the condition in the DNS policy. A preexisting Do Not Inspect policy in the account that matches the GenAI domains is also a common cause.

If you intercept developer tools, also review Intercept support for developer tools. That article documents a requirement specific to Cloudflare for Cursor to operate in HTTP/1.1 compatibility mode.

Related Articles
Did this answer your question?