SWG: Cloudflare Gateway policy layers, TLS inspection, and rule order
SWG (Cloudflare Gateway)
The SWG domain tests Gateway: which layer can see which attribute, how user identity reaches a DNS or HTTP decision, when TLS inspection is mandatory, and how first-match ordering changes the result. Most items are decided by one detail: the layer or the order.
Three enforcement layers
- DNS policies are resolved at Cloudflare's resolver through your location's DoH endpoint (
https://<location>.cloudflare-gateway.com/dns-query) or the Gateway resolver addresses. They are fast and agentless, but carry no user identity unless the query comes from WARP. - Network policies act at Layer 4: destination IP, port, protocol, SNI, source IP and egress. They catch non-HTTP traffic and IP-literal attempts to skip domain rules.
- HTTP policies act at Layer 7: host, URL, method, file type, DLP profile, safe search, tenant control, and Browser Isolation. Only this layer can decide on document contents.
HTTPS body inspection requires the Gateway CA certificate installed on the endpoint, which WARP can deploy, plus the matching decryption setting. Without it you get hostname and SNI, not the payload.
Rule order and actions
Gateway evaluates top-down and stops at the first match. Narrow Allow exceptions belong above broad Block rules; a Block above an Allow makes the Allow unreachable. Categories blend security signals (malware, phishing, newly registered domains, anonymizers) with content categories (gambling, social media). Actions include Allow, Block, Isolate, Do Not Inspect, and Do Not Isolate.
Worked example
Requirement: block gambling, keep a miscategorized partner domain reachable, isolate uncategorized sites, and block PII uploads.
- Allow
partner-portal.example. - Isolate category = Uncategorized.
- Block category = Gambling.
- Block HTTP POST with DLP profile = PII.
Reasoning: the exception must precede any category rule that would capture the partner domain; Isolate is preferred to Block so unknown sites stay usable but rendered remotely; the DLP rule sits last so it never overrides the deliberate partner exception.
Traps
- Expecting per-user DNS decisions without WARP enrollment.
- Placing an Allow beneath a Block that already matched the same domain.
- Enabling inspection with no exclusions for pinned or breakage-prone traffic, producing outages users describe as the internet being broken.
- Forgetting that browser-based DoH and IP-literal traffic can skip DNS-layer policy.
- Assuming DNS policies can act on file type or content.
- Overlooking dedicated egress IPs when a third party must allowlist your traffic.