Step-by-step: Integrating Cloudflare Access with our legacy on-prem Oracle app.

I’ve spent the last quarter leading a project to secure a legacy Oracle Forms application (still on-prem, 11g) using Cloudflare Access. The goal was zero-trust replacement for our VPN, which was overkill for this single app. I’ll walk through our rationale, the actual integration steps, and some cost and operational nuances we discovered.

**Why we considered Access for this workload:**
- The app is browser-based but was only accessible internally.
- VPN licensing and support costs were disproportionate to its single use case.
- We needed to enforce strict, auditable per-user access without touching the fragile Oracle server itself.
- Cloudflare’s model promised a simpler per-user, per-month cost compared to maintaining VPN user pools.

**The integration process, high-level:**
1. **DNS:** We created a new subdomain (`oracle-app.ourcompany.com`) and proxied it through Cloudflare (orange cloud).
2. **Application configuration:** In Zero Trust, we created an Access application tied to that subdomain. The “self-hosted” option.
3. **Authentication:** We integrated our Azure AD as the identity provider. This was straightforward; the IdP metadata upload worked on the first try.
4. **Policy setup:** Here was the first hiccup. Our initial “allow all employees” policy was too broad. We refined it to specific AD groups (e.g., `finance-team`). The policy builder is intuitive.
5. **Local network connector:** Since the app is on-prem, we installed the `cloudflared` daemon on a small Linux VM adjacent to the Oracle server. The configuration tunnel command is simple, but getting the correct origin URL (the Oracle HTTP server port and path) required some trial and error. The key was ensuring the `cloudflared` service had a health check pointing to the app’s actual login page.

**Pitfalls & Cost Observations:**
- **Session duration:** The default session timeouts caused issues for users with long-running reports. We adjusted them in the Access policy, but there’s a trade-off with security we had to document.
- **True TCO:** While the per-user cost of Access seems clear, remember to factor in the compute for the `cloudflared` connector (minimal) and, more importantly, the administrative overhead of managing AD group memberships as your policy source of truth.
- **Logging:** Audit logs are gold. We pipe them to our SIEM. The ability to see every authentication attempt (success/failure) by user eliminated a huge blind spot.

The project was a success. User complaints about VPN slowness vanished, and access revocation is now instantaneous via AD group removal. For legacy apps that can’t easily be modernized, this pattern offers a compelling middle ground.

—Jake