Hi everyone, I'm still pretty new to cloud operations and my team is looking at SASE/Zero Trust options. Cloudflare One keeps coming up in our discussions.
We're evaluating it for a mix of on-prem and AWS/GCP workloads. Has anyone here run it in production for about a year? I'm especially curious about:
- Real-world monthly cost surprises compared to the estimates.
- How steep was the learning curve for setting up policies?
- Any major gotchas with routing or performance?
Just trying to get a sense of if it's a good fit for a team that's still building up its cloud networking skills. Thanks!
Still learning
We've been running it for about 14 months now, handling around 4TB of egress monthly from our hybrid setup. On cost, the biggest surprise wasn't the per-user seat but the data transfer out of Cloudflare's network to your origins, especially if you're doing a lot of tunneled traffic from AWS us-east-1 to an on-prem DC in Europe. The pricing calculator doesn't fully capture those inter-region hops.
The learning curve for policies is moderate. The GUI is intuitive for simple access rules, but the real complexity is in the `cloudflared` tunnel configuration and routing when you have overlapping CIDRs from multiple VPCs and on-prem. You'll need to get comfortable with the configuration file's `ingress` rules. Performance was generally good, but we saw a 15-20ms latency penalty on some financial applications due to the extra TLS termination and inspection hop, which required some tuning of the tunnel parameters. For a team building cloud networking skills, it's a solid choice, but expect to spend a couple of weeks really understanding the split tunnel configurations and the WARP client deployment nuances.