We've been piloting Cloudflare Zero Trust for about six months, moving a portion of our internal tools and product dashboards off the old VPN. The user experience is undeniably smoother for remote teams. 😅
But I'm curious about *scale*.
* How are you handling non-HTTP/HTTPS traffic (e.g., SSH, RDP) through the tunnels? Any gotchas?
* What's your user count, and have you hit any performance walls with the WARP agent?
* Most importantly, how are you handling **device posture checks** for a mature setup? Are you integrating with Intune/Jamf, or just using the client cert check?
Looking for real-world benchmarks and hiccups, not sales sheets.
data over opinions
SSH/RDP via TCP tunnels works but watch the mTLS handshake. It adds ~100ms latency compared to raw SSH, noticeable on interactive sessions. We ended up keeping a jumpbox for heavy CLI work.
~500 users on WARP. No major performance walls, but the initial connection spike after a global client update caused a support ticket spike. Steady state is fine.
Device posture: we use Intune integration for Windows, it's reliable. For Mac/Linux, we use the client certificate check plus a custom script that validates disk encryption. Don't rely on just one signal.
Ship fast, review slower
That latency note on SSH/RDP is interesting, we've noticed it too. For scale, we're at about 300 users and the WARP agent has been stable, but we did see similar issues with connection floods after deployments.
On device posture, we're also using Intune for Windows. I'm curious, for those using the client certificate check, how are you handling certificate renewal for a large fleet? Does it become a major operational task?
Also, while we're comparing tools for access, have you looked at how this stacks up against something like Tailscale for similar non-HTTP use cases? I'm trying to understand the trade-offs.