导航|地址|刷新
Evolving to a SASE architecture with Clo…

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/reference-architecture/llms.txt
Use this file to discover all available pages before exploring further.

Docs Directory API SDKs Changelog

Search

Log in

Reference Architecture

/

Overview

How to use

Find by solution

Reference Architectures

Cloudflare SASE with CrowdStrike

Cloudflare SASE with Microsoft

Cloudflare SASE with SentinelOne

Content Delivery Network (CDN)

Load Balancing

Magic Transit

Multi-Vendor Architecture

Secure Access Service Edge (SASE)

Security Architecture

AI Security for Apps

Email Security Deployments

Reference Architecture Diagrams

Artificial Intelligence (AI)

AI Vibe Coding Platform

Automatic captioning for video uploads

Composable AI architecture

Content-based asset creation

Enterprise AI Vibe Coding Platform

Ingesting BigQuery Data into Workers AI

Multi-vendor AI observability and control

Retrieval Augmented Generation (RAG)

Enterprise AI agent workspace

Bots

Bot management

Content Delivery

Optimizing image delivery

Distributed web performance

Internet of Things (IoT)

Connected transportation systems

Network

BYOIP to Cloudflare

Device roaming with geolocated IPs

Protect data center networks

Protect hybrid cloud networks

Protect ISP and telecommunications networks from DDoS attacks

Protect public networks

Secure Access Service Edge (SASE)

Access to private apps without having to deploy client agents

Cloudflare One Appliance deployment

DNS filtering solution for Internet service providers

Protective DNS for governments

Secure access to SaaS applications

Self-hosted VoIP for hybrid users

Zero Trust and Virtual Desktop Infrastructure

ZTNA with external authorization

Security

FIPS 140 level 3 compliance with Cloudflare Application Services

Securing data at rest

Securing data in transit

Securing data in use

Serverless

A/B-testing using Workers

Fullstack applications

Programmable Platforms

Serverless ETL pipelines

Serverless global APIs

Serverless image content management

Storage

Control and data plane architectural pattern for Durable Objects

Egress-free object storage in multi-cloud setups

Event notifications for storage

On-demand Object Storage Data Migration

Storing user generated content

Design Guides

Cloudflare's benefits for SaaS providers

Leveraging Cloudflare for your SaaS applications

Zero Trust for SaaS applications

Designing ZTNA access policies

Network-focused VPN migration

Secure application delivery

Securing guest wireless networks

Streamlined WAF deployment across zones and applications

Zero trust architecture for startups

Implementation Guides

Zero Trust

Secure your Internet traffic and SaaS apps ↗

Replace your VPN ↗

Secure your email with Email security ↗

Deploy clientless access ↗

Holistic AI Security with Cloudflare One ↗

Application Security

Use mTLS with Cloudflare protected resources ↗

Agent resources

Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

Reference Architecture llms.txt ↗

Reference Architecture llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗

Home

/Reference Architecture

/Reference Architectures

/Secure Access Service Edge (SASE)

Evolving to a SASE architecture with Cloudflare

Last updated Jun 5, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewIntroduction Who is this document for and what will you learn?Disintegration of the traditional network perimeterUnderstanding a SASE architectureCloudflare One: single-vendor, single-network SASE Cloudflare's anycast networkDeploying a SASE architecture with Cloudflare Connecting applications Connecting networks Forwarding device traffic Verifying users and devicesUnified management Lists DLP profiles and datasets Access Groups Example use cases Visibility across the deploymentSummary

Download a PDF version of this reference architecture.

Introduction

Cloudflare One is a secure access service edge (SASE) platform that protects enterprise applications, users, devices, and networks. By progressively adopting Cloudflare One, organizations can move away from their patchwork of hardware appliances and other point solutions and instead consolidate security and networking capabilities on one unified control plane. Such network and security transformation helps address key challenges modern businesses face, including:

Securing access for any user to any resource with Zero Trust practices

Defending against cyber threats, including multi-channel phishing and ransomware attacks

Protecting data in order to comply with regulations and prevent leaks

Simplifying connectivity across offices, data centers, and cloud environments

Cloudflare One is built on Cloudflare's connectivity cloud ↗, a unified, intelligent platform of programmable cloud-native services that enable any-to-any connectivity between all networks (enterprise and Internet), cloud environments, applications, and users. It is one of the largest global networks ↗, with data centers spanning hundreds of cities worldwide ↗ and interconnection with over 13,000 network peers. It also has a greater presence in core Internet exchanges ↗ than many other large technology companies.

As a result, Cloudflare operates within ~50 ms of ~95% of the world's Internet-connected population. And since all Cloudflare services are designed to run across every network location, all traffic is connected, inspected, and filtered close to the source for the best performance and consistent user experience.

This document describes a reference architecture for organizations working towards a SASE architecture, and shows how Cloudflare One enables such security and networking transformation.

Who is this document for and what will you learn?

This reference architecture is designed for IT or security professionals with some responsibility over or familiarity with their organization's existing infrastructure. It is useful to have some experience with technologies important to securing hybrid work, including identity providers (IdPs), user directories, single sign on (SSO), endpoint security or management (EPP, XDR, UEM, MDM), firewalls, routers, and point solutions like packet or content inspection hardware, threat prevention, and data loss prevention technologies.

To build a stronger baseline understanding of Cloudflare, we recommend the following resources:

What is Cloudflare? | Website ↗ (5 minute read) or video ↗ (2 minutes)

Solution Brief: Cloudflare One ↗ (3 minute read)

Whitepaper: Overview of Internet-Native SASE Architecture ↗ (10 minute read)

Blog: Zero Trust, SASE, and SSE: foundational concepts for your next-generation network ↗ (14 minute read)

Those who read this reference architecture will learn:

How Cloudflare One protects an organization's employees, devices, applications, data, and networks

How Cloudflare One fits into your existing infrastructure, and how to approach migration to a SASE architecture

How to plan for deploying Cloudflare One

While this document examines Cloudflare One at a technical level, it does not offer fine detail about every product in the platform. Instead, it looks at how all the services in Cloudflare One enable networking and network security to be consolidated on one architecture. Visit the developer documentation ↗ for further information specific to a product area or use case.

Disintegration of the traditional network perimeter

Traditionally, most employees worked in an office and connected locally to the company network via Ethernet or Wi-Fi. Most business systems (e.g. file servers, printers, applications) were located on and accessible only from this internal network. Once connected, users would typically have broad access to local resources. A security perimeter was created around the network to protect against outsider threats, most of which came from the public Internet. The majority of business workloads were hosted on-premises and only accessible inside the network, with very little or no company data or applications existing on the Internet.

However, three important trends created problems for this "castle and moat" approach to IT security:

Employees became more mobile. Organizations increasingly embrace remote / hybrid work and support the use of personal (i.e. not company-owned) devices.

Cloud migration accelerated. Organizations are moving applications, data, and infrastructure from expensive on-premises data centers to public or private cloud environments in order to improve flexibility, scalability, and cost-effectiveness.

Cyber threats evolved. The above trends expand an organization's attack surface. For example, attack campaigns have become more sophisticated and persistent in exploiting multiple channels to infiltrate organizations, and cybercriminals face lower barriers to entry with the popularity of the "cybercrime-as-a-service" black market.

Traditional perimeter-based security has struggled to adapt to these changes. In particular, extending the "moat" outwards has introduced operational complexity for administrators, poor experiences for users, and inconsistency in how security controls are applied across users and applications.

The diagram above shows an example of this adapted perimeter-based approach, in which a mix of firewalls, WAN routers, and VPN concentrators are connected with dedicated WAN on-ramps consisting of MPLS circuits and/or leased lines. The diagram also demonstrates common problem areas. In an effort to centralize policy, organizations sometimes force all employee Internet traffic through their VPN infrastructure, which results in slow browsing and user complaints. Employees then seek workarounds — such as using non-approved devices — which increases their exposure to Internet-borne attacks when they work from home or on public Wi-Fi. In addition, IT teams are unable to respond quickly to changing business needs due to the complexity of their network infrastructure.

Such challenges are driving many organizations to prioritize goals like:

Accelerating business agility by supporting remote / hybrid work with secure any-to-any access

Improving productivity by simplifying policy management and by streamlining user experiences

Reducing cyber risk by protecting users and data from phishing, ransomware, and other threats across all channels

Consolidating visibility and controls across networking and security

Reducing costs by replacing expensive appliances and infrastructure (e.g. VPNs, hardware firewalls, and MPLS connections)

Understanding a SASE architecture

In recent years, secure access service edge ↗, or SASE, has emerged as an aspirational architecture to help achieve these goals. In a SASE architecture, network connectivity and security are unified on a single cloud platform and control plane for consistent visibility, control, and experiences from any user to any application.

SASE platforms consist of networking and security services, all underpinned by supporting operational services and a policy engine:

Network services forward traffic from a variety of networks into a single global corporate network. These services provide capabilities like firewalling, routing, and load balancing.

Security services apply to traffic flowing over the network, allowing for filtering of certain types of traffic and control over who can access what.

Operational services provide platform-wide capabilities like logging, API access, and comprehensive Infrastructure-as-Code support through providers like Terraform.

A policy engine integrates across all services, allowing admins to define policies which are then applied across all the connected services.

Cloudflare One: single-vendor, single-network SASE

Most organizations move towards a SASE architecture progressively rather than all at once, prioritizing key security and connectivity use cases and adopting services like Zero Trust Network Access ↗ (ZTNA) or Secure Web Gateway ↗ (SWG). Some organizations choose to use SASE services from multiple vendors. For most organizations, however, the aspiration is to consolidate security with a single vendor, in order to achieve simplified management, comprehensive visibility, and consistent experiences.

Cloudflare One ↗ is a single-vendor SASE platform where all services are designed to run across all locations. All traffic is inspected closest to its source, which delivers consistent speed and scale everywhere. And thanks to composable and flexible on-ramps, traffic can be routed from any source to reach any destination.

Cloudflare's connectivity cloud also offers many other services that improve application performance and security, such as API Gateway ↗, Web Application Firewall ↗, Content Delivery ↗, or DDoS mitigation ↗, all of which can complement an organization's SASE architecture. For example, our Content Delivery Network (CDN) features can be used to improve the performance of a self hosted company intranet. Cloudflare's full range of services are illustrated below.

Cloudflare's anycast network

Cloudflare's SASE platform benefits from our use of anycast ↗ technology. Anycast allows Cloudflare to announce the IP addresses of our services from every data center worldwide, so traffic is always routed to the Cloudflare data center closest to the source. This means traffic inspection, authentication, and policy enforcement take place close to the end user, leading to consistently high-quality experiences.

Using anycast ensures the Cloudflare network is well balanced. If there is a sudden increase in traffic on the network, the load can be distributed across multiple data centers – which in turn, helps maintain consistent and reliable connectivity for users. Further, Cloudflare's large network capacity ↗ and AI/ML-optimized smart routing ↗ also help ensure that performance is constantly optimized.

By contrast, many other SASE providers use Unicast routing in which a single IP address is associated with a single server and/or data center. In many such architectures, a single IP address is then associated with a specific application, which means requests to access that application may have very different network routing experiences depending on how far that traffic needs to travel. For example, performance may be excellent for employees working in the office next to the application's servers, but poor for remote employees or those working overseas. Unicast also complicates scaling traffic loads — that single service location must ramp up resources when load increases, whereas anycast networks can share traffic across many data centers and geographies.
…(内容过长已截断)
…