We rolled out Cloudflare Access to about 200 internal apps and 500 users last year. The goal was to kill our old VPN for everything but true network-level needs. Here's the raw, mid-market take after 12 months.
**The wins were immediate:**
* End-user login flow is dead simple. The magic links and SSO integrations just work.
* Admin setup is fast. Adding a new app behind Access takes us <10 minutes.
* Cost predictability is a huge plus. No more surprise bills based on concurrent connections.
**But we hit some real snags:**
* Audit logs are good, but not great. Tracing a specific user's actions across services can get fuzzy.
* The "mid-market gap" is real. We're between the simple policies and needing full-blown ZTNA. Some niche app protocols still force us back to the VPN.
* Pricing creep is a watch-out. Once you start adding advanced features (like session duration controls), the cost jumps.
Overall, it’s a solid 8/10 for us. It replaced 90% of our VPN use, and the team loves the no-client experience. Just go in with eyes open on the protocol support and log granularity.
Anyone else in a similar size range? Would love to compare notes on how you handle the edge cases.
--ash
data over opinions
Thanks for sharing such a detailed, real-world perspective. It's incredibly valuable for teams at a similar scale.
I hear you on the audit log granularity. We've found that while it captures the access events perfectly, correlating those log entries with specific, granular actions *within* an application often requires pulling logs from the app itself. It's more of a 'first touch' authentication record than a full session audit. Have you tried setting up a logpush to a SIEM? That sometimes helps with the correlation, though it's an extra step.
Your point about the 'mid-market gap' really resonates. That space between basic web apps and complex ZTNA for all protocols is a tough one to fill. We've had some luck with Cloudflare Tunnel for TCP, but it's not a universal fix. I'm curious, which specific niche protocols are still sending you back to the VPN?
Stay curious.
Great point about the SIEM logpush - we actually set that up with Splunk around month 6. It does help with the high-level correlation, but you're right, it's still an extra layer. We ended up writing a small script to enrich the Cloudflare logs with our app's internal user IDs, which got us closer.
> which specific niche protocols are still sending you back to the VPN?
The main culprits for us have been older SSH servers and some legacy database admin tools that rely on raw TCP connections with specific client certs. Cloudflare Tunnel handles generic TCP, but the moment you need client-side certificate authentication *before* the tunnel, we're back to VPN land. 😅 Have you found a workaround for those scenarios, or are you just keeping a small VPN instance alive for the edge cases?
Clean code, happy life
You've hit on the classic trap of trying to use a web proxy for every old-school protocol. That script to enrich logs is clever, but it's also a band-aid for a platform limitation.
On the client cert issue, I've seen teams attempt to run a tiny bastion host *behind* the Access policy, purely for those SSH or database tool connections. It sort of works, but then you're back to managing a server anyway, which defeats half the purpose. You've already got the right answer: keep the small, cheap VPN instance for the 2% of weird stuff.
The real cost isn't the VPN license, it's the organizational drag of trying to make one tool do everything. Sometimes the simpler, cheaper solution is two tools.
keep it simple