Non-identity on-ramps

With Cloudflare One, you can isolate HTTP traffic from on-ramps such as proxy endpoints or Magic WAN. Since these on-ramps do not require users to log in to Cloudflare WARP, identity-based policies are not supported.

Note

If you want to apply Isolate policies based on user identity, you will need to either install the WARP client or manually redirect users to the Clientless Web Isolation URL.

Set up non-identity browser isolation

1. Install a Cloudflare certificate on your devices.
2. Connect your infrastructure to Gateway using one of the following on-ramps:
   • Configure your browser to forward traffic to a Gateway proxy endpoint with PAC files.
   • Connect your enterprise site router to Gateway with the anycast GRE or IPsec tunnel on-ramp to Magic WAN.
3. Enable non-identity browser isolation:
   1. In Cloudflare One ↗, go to Browser isolation > Browser isolation settings.
   2. Turn on Allow isolated HTTP traffic when user identity is unknown.
4. Build a non-identity HTTP policy to isolate websites in a remote browser.