Cloudflare Docs
Cloudflare Zero Trust
Visit Cloudflare Zero Trust on GitHub
Set theme to dark (⇧+D)

Protocol detection

Early access

Gateway supports the detection, logging, and filtering of network protocols using packet attributes.

​​ Enable protocol detection

  1. In Zero Trust, go to Settings > Network > Firewall.
  2. Enable Protocol Detection.

You can now use Detected Protocol as a selector in a Network policy.

​​ Supported protocols

Gateway supports detection and filtering of the following protocols:

Protocol Notes
HTTP The policy builder includes separate values for HTTP/1.1 and HTTP/2.
TLS Gateway detects TLS versions 1.1 through 1.3 with the TLS value.
TPKT TPKT commonly initiates RDP sessions, so you can use it to identify and filter RDP traffic.

​​ Example network policy

You can create network policies that filter traffic based on protocol detections rather than common ports. For example, you can block all SSH traffic on your network without blocking port 22 or any other non-default ports:

Selector Operator Value Action
Detected Protocol in SSH Block