On this page10 sections
Short answer
How do you replace a VPN with Cloudflare Zero Trust?
Do not switch everyone at once. Inventory the applications behind the VPN, connect them to Cloudflare with Tunnel, put Access and Gateway policies in front, and pilot with one small group on the Cloudflare One Client (formerly WARP). Expand ring by ring, each with exit criteria and a rollback, and keep the VPN running until the last group has moved.
Who this is for: network and security leads who run a remote-access VPN today and want application-level access based on identity and device. Product behavior below cites Cloudflare’s documentation as read on October 4, 2026.
What does “replace” mean?
Cloudflare One is Cloudflare’s secure access service edge (SASE) platform; Zero Trust access is part of it. A VPN extends a network to a device. In this design, a user reaches a named application only after Cloudflare checks identity and, where you require it, device posture. That holds only once policies exist: by default, every enrolled device can reach the whole private network routed through a tunnel, and Gateway network policies are not deny-by-default. The plan therefore adds a catch-all block before anyone moves.
“Replace” is staged. The two run side by side, and the VPN stays as the fallback until every ring of the pilot ladder has passed. Cloudflare’s learning path covers client-based access; clientless, browser-based access is a separate path.
Step 1: Inventory what sits behind the VPN
Build one table with a row per application, and have the application owners review it before any configuration. A missing row is the most common way to strand a user group.
| Column | Why it matters |
|---|---|
| Application, hostname, or IP range | What the tunnel must reach |
| Protocols and ports | Web, SSH, RDP, databases, UDP, or ICMP shape the connector choice |
| Users, groups, and identity provider group | These become the policy selectors |
| Device requirement | Managed device, posture checks, or none |
| Source-IP dependence | Tunnel source-NATs traffic, so the origin sees the cloudflared host’s address |
| Session length | Long-lived sessions, such as database replication or persistent RDP, can drop when cloudflared reconnects; Cloudflare suggests Mesh for them |
| Owner | Approves the policy and the exit of each ring |
Also record the identity provider, the endpoint management tool, and the VPN client installed on devices.
Step 2: Connect the applications
Cloudflare’s replace-VPN guide describes three cases: device to network, device to device, and network to network.
| Need | Connector | What the docs say |
|---|---|---|
| Users reach private applications | Cloudflare Tunnel, with cloudflared on the network, and the client on devices |
Outbound-only connections; you can block inbound traffic. Up to 25 replicas per tunnel for redundancy, which do not load-balance |
| Devices reach each other, or traffic must flow both ways | Cloudflare Mesh | In beta, on all Cloudflare One plans including Free; 50 Mesh nodes per account |
| Branch sites and data centers | Mesh nodes, or Cloudflare WAN (formerly Magic WAN) | Cloudflare WAN is Enterprise-only |
Start with Tunnel. Run at least two replicas per tunnel so that one host failing is not an outage; for health-based failover, Cloudflare points to Load Balancing.
Step 3: Write least-privilege policies
Access applications are deny-by-default: a user must match an Allow policy. Cloudflare evaluates Bypass and Service Auth policies first, top to bottom, then Allow and Block policies in their order, and stops at the first match. For private networks, Cloudflare recommends a catch-all Gateway block for the private IP space, with higher-priority Allow rules in Access or Gateway. It calls Access self-hosted private applications the primary method for zero trust network access; they cover any port and protocol and are available on all plans.
The Access policy review checklist runs before an application joins a ring:
| Check | Pass condition | Basis |
|---|---|---|
| No Allow policy includes Everyone, or Login Methods set to One-time PIN | Absent | Cloudflare’s list of common misconfigurations |
| No Bypass policy without a written reason | Bypass enforces no Access controls, and its requests are not logged | Access policies |
| Allow policies name groups, not every valid email | Group or explicit-identity selectors | Method |
| A Block that carves out an exception sits above the Allow it limits, or the Allow uses an Exclude rule | Order checked | First-match evaluation |
| Machines use Service Auth | Service tokens or mutual TLS | Access policies |
| Device posture required where the risk justifies it | Posture selector present | Posture checks |
| Catch-all Gateway block for the private IP space | Present and tested | Private network guide |
| Every policy has an owner and a review date | Named person | Method |
Posture changes take time to bite: client checks poll every five minutes by default, and Gateway policies add up to five minutes more, so allow up to about ten minutes before a non-compliant device loses Gateway access.
Step 4: Roll out the Cloudflare One Client
The client runs on Windows, macOS, Linux, iOS, Android, and ChromeOS; the mobile app is called Cloudflare One Agent. Deploy it through endpoint management such as Intune, JAMF, Kandji, or JumpCloud, with settings in an mdm.xml file or a plist. Parameters in a local policy file overrule device settings configured in the dashboard, which matters when a pilot ring needs different settings.
Coexistence with the old VPN client needs care, because both want to control routing, DNS, and firewall rules. Cloudflare’s guidance:
- Split-tunnel so VPN traffic bypasses the Cloudflare One Client, and the reverse.
- Choose who owns DNS: Traffic and DNS mode (disable DNS in the VPN) or Traffic only mode (the VPN keeps DNS).
- Exclude the VPN’s private IP range and the server it connects to.
- Enable the Cloudflare One Client before the VPN, and retest with each new VPN version.
Cloudflare recommends connecting your private network or applications to Cloudflare instead of keeping a legacy VPN, so coexistence is a migration state, not a destination.
The VPN replacement pilot ladder
This is the VPN replacement pilot ladder. A ring starts only after the previous one passes; group sizes are yours to set.
| Ring | Who | What moves | Exit criterion | Rollback |
|---|---|---|---|---|
| 0 | IT and security | One test application; the client on managed devices | Policies behave as written, including a denied application and a denied private IP; support runbook drafted | Disable the client; VPN untouched |
| 1 | Volunteers | One low-risk application | No unresolved tickets for the agreed period; owners sign off | Remove the application’s policy or route; the VPN still serves it |
| 2 | One department | That department’s applications | Every inventory row for the group works from the client; help-desk load understood | Return the group to the VPN profile |
| 3 | Everyone else, in groups | Remaining applications, high-risk users first | All inventory rows passed and signed | Group-level return to the VPN |
| Decommission | Whole organization | VPN shut down | Break-glass access tested; support runbook live | VPN kept powered off and documented for an agreed period |
Keep a break-glass path that does not depend on Cloudflare or your identity provider: a documented, tested route to the applications that matter most, held by named people.
What this article has not tested
- Cloudflare Mesh and Cloudflare WAN in a live rollout; they are described from the documentation.
- Clientless, browser-based access, which is a separate Cloudflare path.
- Specific VPN products: the coexistence steps are Cloudflare’s guidance, not test results.
- Performance: no figures are given, and no vendor percentages are cited.
FAQ
Can I keep the VPN during the migration?
Yes, and you should. Split-tunnel traffic so VPN traffic bypasses the Cloudflare One Client, decide whether the client or the VPN owns DNS, and enable the client before the VPN. Cloudflare says the combination needs testing with each new version of the VPN software, so build that check into your change process.
What replaces the VPN for server-to-server traffic?
It depends on direction. Tunnel carries user-initiated access to private applications through an outbound-only connection. Cloudflare Mesh, in beta on all plans, covers device-to-device and bidirectional traffic, and Mesh nodes can connect networks. Cloudflare WAN, which is Enterprise-only, covers site connectivity over IPsec, GRE, or Cloudflare’s appliance.
How do I stop broad access?
Use group or explicit-identity selectors, not Everyone or a One-time PIN login method, which Cloudflare lists as common misconfigurations. Add a catch-all Gateway block for your private IP space, because enrolled devices can otherwise reach the whole tunneled network. Review Bypass policies in particular: they enforce no Access controls, and their requests are not logged.
How are devices deployed and configured?
Through endpoint management such as Intune, JAMF, Kandji, or JumpCloud, with settings in an mdm.xml file or a plist. Parameters in a local policy file overrule the device settings configured in the dashboard. Pilot rings can use different parameters, so test the precedence on ring 0 before expanding to the next ring.
Does this need an Enterprise plan?
Not for the core. Cloudflare’s Zero Trust plans page lists zero trust network access, the secure web gateway, the application connector, and the device client on all three plans, with a 50-user limit on Free. Cloudflare WAN is Enterprise-only and an add-on on the Contract plan. Check the plans page on the day you design, because plans change.
Sources
Checked against vendor documentation on How the articles are checked
- Cloudflare One
- Replace your VPN
- Device to network
- Replace your VPN, learning path
- Connection methods (learning path)
- Cloudflare Tunnel
- Tunnel availability and replicas
- Connect a private network (CIDR)
- Choose an application type
- Self-hosted private applications
- Access policies
- Device posture checks
- Cloudflare One Client
- Download the client
- Managed deployment
- Cloudflare One Client with legacy VPNs
- Cloudflare Mesh platform
- Cloudflare One account limits
- Cloudflare WAN
- Zero Trust plans