Replacing Cisco AnyConnect with Cloudflare Zero Trust

At a Glance

Detail	Value
Industry	Enterprise
Environment	5,000 employees, us-east-1, remote and office-based workforce
Timeline	12 weeks pilot to full rollout
Key Results	Zero-trust access to all devices, outbound filtering and DLP, VPN gateways decommissioned

The Challenge

A 5,000-employee enterprise had been running Cisco AnyConnect as its remote access VPN, deployed in AWS us-east-1. On any given day, 2,000+ concurrent users connected from home offices, hotels, and client sites. Every one of them tunnelled through the us-east-1 gateway, regardless of where they or the target resource were located.

The AnyConnect deployment was creaking under the load:

Licensing and Failover: Each VPN concentrator ran as an independent gateway on EC2 with Cisco licensing tied to instance size, making upgrades expensive. Failover was DNS-based. When a gateway went down, active connections were dropped and clients had to reconnect. Frustrating for anyone mid-session on a web tool or device management interface.

Latency Penalties: All traffic hairpinned through us-east-1, even when the resource was in the same city as the user. An employee in San Francisco accessing an internal tool hosted in us-west-2 had their traffic routed San Francisco to us-east-1 to us-west-2 and back. Round-trip times routinely exceeded 150ms for what should have been a sub-20ms connection.

Attack Surface: The VPN concentrators were exposed to the public internet, making them a persistent target. The team spent significant effort patching CVEs, monitoring for brute-force login attempts, and managing certificate rotations.

No Outbound Visibility: The VPN only secured inbound access. There was no consistent way to filter outbound traffic, enforce acceptable use policies, or prevent data exfiltration from employee devices.

Helpdesk Burn: VPN connectivity issues were the single largest category of helpdesk tickets, making up 40% of all incidents. Employees struggled with client configuration, network conflicts, and dropped connections.

The Solution: Cloudflare Zero Trust with WARP and cloudflared

We replaced the AnyConnect VPN with Cloudflare Zero Trust. WARP runs as the client on employee devices, and cloudflared exposes internal services. The shift was from network-level VPN access to identity-based access with outbound security controls.

Architecture

The deployment followed a phased approach over 12 weeks:

Phase 1: Identity Integration (Weeks 1-2). Cloudflare Zero Trust was connected to the existing identity provider. Existing MFA policies were mapped into Cloudflare Access policies, ensuring no gap in authentication coverage.

Phase 2: Service Exposure with cloudflared (Weeks 3-6). Internal services and devices that previously required VPN access were exposed through Cloudflare Tunnel using cloudflared. Each service was configured as a Cloudflare Access application with granular policies: who could access it, from which devices, and under what conditions. No public IPs were needed. cloudflared created outbound-only tunnels from the services to Cloudflare’s edge.

Phase 3: AnyConnect Migration (Weeks 7-10). Employee devices were migrated from AnyConnect to the Cloudflare WARP client. The deployment was staged by department, with IT and power users going first to validate the experience. WARP ran silently in the background. Employees no longer had to think about connecting to the VPN.

Phase 4: Outbound Filtering and DLP (Weeks 10-12). Cloudflare Gateway was configured to inspect outbound traffic from WARP clients. DNS filtering blocked malicious domains and unwanted categories. HTTP/S inspection policies were applied to prevent data exfiltration, block file uploads to unauthorised destinations, and enforce acceptable use policies.

How Employees Connect

Instead of launching AnyConnect and getting a full network tunnel, employees now run the Cloudflare WARP client in the background. When they need to access an internal service:

1. WARP connects to the nearest Cloudflare data centre (335 cities globally, 13,000+ interconnections)
2. Cloudflare Access verifies the user identity, checks device posture, and enforces MFA if required
3. Cloudflare Tunnel (cloudflared) proxies the connection to the internal service. No inbound firewall rules or public IPs required.
4. All outbound traffic passes through Cloudflare Gateway for DNS filtering, HTTP/S inspection, and DLP policy enforcement

A user in San Francisco accessing a device hosted in us-west-2 connects to Cloudflare’s San Francisco edge. Identity is verified, and traffic is forwarded through the cloudflared tunnel directly to the service. Round-trip drops from 150ms to under 20ms.

Security Outcomes

The zero trust architecture eliminated entire categories of risk:

No Public-Facing VPN: The VPN concentrators in us-east-1 were removed from the internet. Services exposed through cloudflared required no inbound firewall rules. The tunnels were outbound-only from the services to Cloudflare.

Application-Level Segmentation: Even with valid credentials, an employee can only reach the specific services their policy allows. There is no lateral movement possible through a network tunnel.

Outbound Filtering: Cloudflare Gateway provided DNS filtering, blocking malicious domains, C2 callbacks, and unwanted content categories across all WARP-connected devices. Regardless of whether the employee was on the office network or a coffee shop WiFi.

Data Loss Prevention: DLP policies were applied to HTTP/S traffic, preventing sensitive data (PII, financial information, internal credentials) from being uploaded to unauthorised external destinations. File uploads to personal cloud storage and unapproved webmail were blocked or logged.

Continuous Verification: Cloudflare Zero Trust re-verifies identity and device posture on each request. Sessions time out and require re-authentication based on policy, not on a fixed VPN session timer.

The Results

• 100% of internal services moved to Cloudflare Tunnel access. No remaining VPN dependencies.
• 60% reduction in helpdesk tickets related to remote access
• 90% latency reduction for cloud-hosted service access
• Zero VPN gateways on the public internet. Attack surface dramatically reduced.
• Outbound DNS filtering applied across all WARP-connected devices
• DLP policies blocking sensitive data uploads to unauthorised destinations
• 2,000+ concurrent users supported without any gateway capacity concerns
• 3 full-time equivalent staff freed from VPN maintenance and patching

Key Takeaways

1. VPN replacement is the easiest entry point to zero trust. The pain is widely felt, the benefits are immediately visible, and the migration path is well understood.
2. cloudflared eliminates inbound firewall rules. Services are exposed via outbound-only tunnels. No public IPs, no open ports, no patching VPN concentrators.
3. WARP gives you outbound security for free. Once devices run WARP, applying DNS filtering and DLP policies is configuration-only. No additional agents or infrastructure required.
4. Employee experience improves, not degrades. Zero trust done right means faster connections, fewer dropped sessions, and no more wrestling with VPN client configuration.
5. Start small, prove the model. Onboard one service and one department first. Let them validate the experience before rolling out across the organisation.