Gateway Network Policy

[user8216]

I found this post but it is from 2 years ago and I’m hoping there has been some progress in the UI regarding the use of Device Posture Checks in a Gateway Network Policy.

Has anyone been able to get the posture checks working as a condition for a network policy through the UI?

Previous post from two years ago:

Enforce block policy when *any* device posture check fails

Struggling to understand how to use device posture in policies. Let’s simplify the goal as: “I want to block all access to Team-controlled resources for any device that doesn’t meet our posture requirements in any way whatsoever”. What I think I understand so far is (please correct where wrong): You can’t refer to device posture in Settings > Devices > Device Enrollment Permissions > Rules m> Include (or anywhere else in this area that I can find). So you can’t prevent users from enrolling …

[Albertus]

I have it working.

The UI doesn’t have the “if posture failed” policy but you won’t need it.

Steps:

1. Create a list and add the serial numbers for each allowed device.
   
   

2. Using the API (Can’t use GUI for this either) create the serial number posture for linux, mac, windows.

Change the name, description and the id (which is the list including the serial numbers) and the API access values.

curl -v -X POST https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/devices/posture \
-H "X-Auth-Email: $AUTH_EMAIL" -H "X-Auth-Key: $AUTH_KEY" -H "Content-Type: application/json" \
--data '{"type":"serial_number","name":"Mac serial posture","description":"Mac Serial posture","schedule":"1m","match":[{"platform":"mac"}],"input":{"id":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"},"expiration":"1h"}'

Note that if you have devices running linux, mac and windows you need to add a posture for each os.

3. Create a policy allowing access to the secured destinations when the postures pass.
   

   

4. Create a policy denying access to the secured destinations, with no other conditions.

5. Make sure the allow policy is up and the deny is down.

This is how I have it working.

[user8216]

Thank you for your detailed response. This helped me down the right path to get what I needed working. Greatly appreciated.

[Albertus]

Happy to help!