Name: Defeat cyber threats, delight your guests: Secure WiFi networks with Cloudflare
Uploaded: 2025-07-29T18:32:01.629Z
Duration: 44 min 16 s
Description: Defeat cyber threats, delight your guests: Secure WiFi networks with Cloudflare

Transcript for "Defeat cyber threats, delight your guests: Secure WiFi networks with Cloudflare": Hey, everyone. Thanks for attending. We really appreciate you taking time out of your day to join our webinar. Today, we're gonna be focusing on one of the fastest and easiest ways, in our opinion, that you can start realizing business value with the security use case. And, specifically, we'll we'll be talking about how to secure your guest Wi Fi network. So we're gonna share some step by step guidance. We're gonna talk about practices, including how to overcome challenges in your implementation. And we have a live demo, which is always fun. So let's get started. Now we wanna get a better sense for what's bringing you to today's webinar, so I'm gonna launch a poll. And please, you know, include your response. And while this is running in the background, I wanna give some give us an opportunity to introduce ourselves. I'm James. I've been with Cloudflare for five ish years now. I, have been with our SaaS portfolio since its earliest days and and and have traditionally covered our secure web gateway functionality, which includes some of our DNS filtering capabilities that we'll be talking about. And I'm joined by Nathan. Hi. Yeah. My name is Nathan Sackett. I'm a solutions engineer. I focus on zero trust and SaaS here at Cloudflare. I've been in IT for a very long time, and I jokingly consider myself like a the IT guy for a lot of organizations or was previously the IT guy. I was the network guy, the server guy, the security guy, and I I suspect there's some folks out there that maybe had that role as well. They had to do a lot of little. And, I joined Kotler, about two years ago. Very passionate about solutions that are easy for folks like myself at a at previous role. And I think you'll see a lot of value with what we share today. Awesome. Thanks. So, you know, if you haven't had a chance to respond yet, let's get those responses in. Otherwise, throughout this webinar, place your questions in the chat, and we'll do our best to either respond via message or we're gonna address it live during some q and a breaks. I see some final votes trickling in, but I'm going to close it now and share out, responses. So, you know, handful of people responded. It seems like there's pretty wide distribution of folks who are already have their DNS filtering solution in place looking to optimize versus folks who are maybe earlier in that journey and are exploring different ways to, get started. So I think it's probably helpful to so we're all on the same page about, what is the use case we're talking about here. So safe, fast, reliable Wi Fi. I would say that's no longer just a nice bonus for your visitors. It's really a fundamental expectation. Your customers demand it, and your organization often depends on it. Securing guest Wi Fi is first and foremost about filtering out inappropriate and harmful and internet content. So you certainly don't want your guest browsing adult or gambling sites in public spaces where people can can look over the shoulder and see things that they don't wanna see. And certainly, they don't want their devices infected by malware or ransomware or other cyber threats as they're browsing. And as an organization, you often need to enforce your own acceptable use policy by blocking offensive, illegal, dangerous content. And in the process, you wind up protecting your brand and your network reputation. You know, we've seen in some cases, businesses like hotels, cafes, libraries, they face lawsuits for allegedly enabling illegal downloads through their guest Wi Fi. And if you do have the wrong solution in place, many organizations find that they can get pretty bogged down. And customers often complain because their connections are too slow, maybe because some other guest is has been hogging up the bandwidth via torrenting. Behind the scenes, some vendors can make configuring rules and scaling new to new locations unnecessarily difficult. And finally, providing high quality Wi Fi is really an opportunity to elevate the customer experience. It's an opportunity to build a positive impression. Some of the folks mentioned in the poll that you're looking to enhance your Wi Fi experience. We'd love to hear more about that. This is your opportunity to encourage guests to stay longer, to come back more often, to just have a good time in your public spaces. And typically, these goals are accomplished by deploying a DNS filtering service, which blocks traffic based on domains and IPs. So today, Cloudflare is helping organizations across industries and around the world accomplish these types of goals with our own DNS filtering solution. We operate one of the fastest, largest, and most reliable recursive DNS resolver in the world. And And so this puts in puts us in a pretty unique position to address DCS WiFi needs at any scale. So I'll just call out a few of some of the customer stories that we've seen starting on the top left. First, this is a global coffee brand that was struggling with the cost and complexity of maintaining their Cisco umbrella subscription. And instead, they turned to Cloudflare, and we were able to extend protections across all their North American retail locations within just a few days, helping them be more efficient with their time and longer term with their dollars. And on the bottom left, a global airline, they were switching their Wi Fi provider and specifically were bringing on Starlink for higher speed service. And in turn, they brought on Cloudflare to layer on different filtering controls for their passengers and crew. And in the middle, regional government in France rolled out Cloudflare to filter content across their hundreds of schools, making sure their students were not exposed to any inappropriate content. And the remaining examples you see here, co working space, the city port, the federal agency, they all represent different motivations and pretty common ones for organizations to switch to us, whether that concern is mitigating risk, improving efficiency, or just delivering a better user experience. So hopefully, that sets the table for folks. I wanna turn it over to Nathan, who's gonna start getting us thinking about how to make progress with this use case. So over to you, Nathan. Yeah. Sounds good. I mean, I'll start with a pretty typical scenario that I think likely you're familiar with. Maybe you're familiar with this because you have a home wireless router, but, in the use case, maybe you have a a coffee shop, a clinic, office, any kind of location where you have maybe just, business Internet. You're provided maybe with a router or you have a consumer router. Maybe the IP address is assigned by your Internet service provider along with the DNS server provided by your service provider as well. But, typically, that's somewhat limited. And, you know, certainly no options for DNS security or often there's no options for DNS security, maybe no uptime SLA, limited privacy, limited visibility. So this is this is what we're talking about maybe protecting. And, while I'm showing kind of a consumer, maybe business Internet, setup, I'll walk through some enterprise scenarios as as well. So, the first step, at least to onboard DNS queries to our, recursive DNS service or our protected DNS service is identifying the source IP address from which those DNS queries are sent right from your your desk locations. And it's typically the public IP address of that router. In a scenario, maybe you have a business Internet, maybe you have a static, range of IP addresses that you can use that are assigned to those routers. That can be used as a DNS endpoint. That source IP address can be a DNS location in our dashboard. When we see queries from that IP address, then we can assign policy. Right? So, allowing certain destinations and then blocking potentially malicious destinations or, like James mentioned, blocking maybe questionable content. Right? So inappropriate sites, maybe malicious or illegal sites that, you know, you don't wanna, you know, expose your organization to any risk by folks connecting to those destinations. So this is kind of a first step in onboarding that traffic for, you know, maybe a very simple setup where there's a guest wireless router, like a simple wireless router at that location. Another example. Right? Like, if you're a larger enterprise, maybe you have an enterprise a wireless enterprise solution, you know, an enterprise, firewall. And this is something that I've set up for a number of organizations where I've worked or had consulting work on, or maybe I have maybe you have a a guest wireless network that's broadcast on an SSID that's linked to a VLAN tag and maybe behind the zone behind a firewall. And then similarly, the corporate network is maybe another SSID that has a different beeline tag behind a different, zone behind a firewall. And so what I'd do in that scenario is maybe I would build a port address translation policy so that the guest wireless network would have a different public IP address for those DNS queries set being sent to Cloudflare versus my corporate network. I would have a separate policy for the corporate network going to a different public IP address. And, again, it's a it's a data point that we can use for that DNS endpoint where I can build unique policies. In this diagram I built here, maybe your policy for your guest wireless is is a little bit more lenient. Right? You're allowing them to go really wherever they want. This is a service that you're providing to them, but you just wanna ensure they're not going to malicious destinations where they can infect their computer or, you know, do illegal activity or, you know, go to some questionable sites. I'm gonna show you in the dashboard just a second, like, even for your enterprise solution. Right? This is a very easy lift, very easy to implement. But then you can build policy not just for, you know, security, but build the acceptable use policy for, only acceptable destinations for your users that maybe have an HR policy, for example. If you wanna present protect or prevent against resolution to geolocations and specific applications, all capabilities that exist in the dashboard that I'll show you in just a minute. Alright. And I'll I'll hand it back over to you, James, and, we'll go back in the demo in just a second. Yeah. Thanks, Nathan. So we focused on some pretty common architecture. It's a very basic setup, a pretty common enterprise setup. We're just gonna zoom out a bit further and kind of synthesize what we've been talking about. So we focus primarily on the left side of this diagram, which is around getting traffic to CloudFront and the different, setups you can you can take. And, specifically, we've been really focusing on the most common method here, which is via I p v four or I p v six addresses. And within this one approach, we have a couple of different options including, you know, one, we can assign addresses to you by default, or you can request your own dedicated resolver IP, or you can ring your own. And the other common method, which Nathan will show in the dashboard, is to use DOH or DOT endpoints resolve queries. So this adds some encryption, reduces reliance on static IPs, adds for a little bit more flexibility for applications, for example. Now the right side reflects how we enforce policies for where the traffic is coming to us. We've talked already about allowing or blocking domains and IP addresses with comprehensive coverage across different content and security categories. But you can also set DNS override policies where you can redirect queries, for example, to so that the user can read read your acceptable use policy. Maybe you send them to a captive portal, maybe some preapproved sites, and so on. Now configuring all these and scaling these policies is something that can be bought automated via API or our Terraform Terraform provider. And with Cloudflare, all these controls run on one of the largest, authoritative and recursive DNS resolvers. So we handle some four plus trillion DNS queries per day, and that's the type of real time visibility that helps us inform different AI and ML based models for us to identify where threats are emerging. So, Nathan, as in your engagements with customers, I'm curious, what are some of the most common implementation hurdles you've seen them face, and what's some advice you typically share with them to overcome it? Yeah. Sure. So, lot of capabilities exist within the Cloudflare dashboard to protect your organized organizations and net traffic, but, DNS is is really the easiest place to start. Right? So in terms of configuration, some of those things I have, you know, outlined by, you know, send your traffic to Cloudflare by changing your DNS service on that router. For but even for your entire enterprise organization, you may have internal DNS resolvers modifying your your DNS forward lookup for external, recursive lookup is a couple minutes to set up and start sending DNS queries to Cloudflare and building policies, something that happens in a few minutes. So very easy to very easy to get set up, and I'll show you an example of that in dashboard in a second. And typically, where I maybe see some challenges is maybe lack of familiarity, like maybe there's different router brands or maybe those consumer, router brands or from your business Internet. It sometimes it's just, you know, finding where do I modify the DNS settings, where do I modify the public IP address potentially. So that's typically where I maybe see some hurdles and slowdowns. Yeah. Thanks, Nathan. And, you know, with that, you know, what maybe it's time to switch over to that live demo, see how it all see how it all works. And as Nathan is getting that dashboard ready, I'll say, you know, we often see enterprises start with this use case as a springboard for other security projects. So as Nathan's gonna show you, the different DNS filtering controls recognize that you can use that same resolver, that same policy manager to set up more granular types of inspections and HTTP control. So with that, I'm gonna stop sharing this, and I'll give Nathan the opportunity to pull up his environment. Alright. Sounds good. Alright. I'm gonna share my whole desktop so you'll get to see if I have everything in just a second. Yeah. A little bit of a weird inception thing going on there. So this is my dashboard. I'm gonna come back to this in a second, but I'm gonna go over to, a topology view of my environment. I hope that James, can you just confirm that we see that now? Yep. All good. Okay. Yeah. So, something that we often talk about is our connectivity cloud, and I'm kinda representing that in this this architectural topology diagram where Cloudflare we have, data centers in 330 plus cities around the world. And I'm, you know, I'm showing that as kind of a a hub for all of my connectivity and on ramp for my home, my devices, where I'm sending all my DNS queries, I'm onboarding traffic through IPSec tunnel IPSec tunnels, our our endpoint clients. So a little out of scope for this conversation, but I will point out we'll focus on DNS. This is something that you can even do at your home for free with up to 50 users. So if you're interested in doing something like I'm doing in protecting all my DNS queries, leaving my home, ensuring that my kids, for example, that are 10 and 14, aren't going to inappropriate destinations. I've installed a client on their laptops, their iPads, their iPhones, so you can protect your home and your family very similarly, so easy to do, and these capabilities scale up to even the largest enterprises. So just a little plug for that set up initially, and I'll I'll walk through that for where DNS queries are leaving my home from a Ubiquiti router. But a couple other options I'll show in just a second. Another thing I'll point out, like, just some of those settings that I set up in my router, and hopefully, you can see this. I'll I'll zoom in a little bit. But, maybe I have a public IP address, and as James pointed out, maybe that IP address changes. Maybe it's dynamically assigned. Cloudflare can provide to you a dedicated I p v four or I p v six endpoint for your organization. So instead of focusing on the source from which that DNS query is generated, it could be the destination to which I could build policy. So you could have a unique I p v four, I p v six address, and I'll show you how I'm doing both, options in my dashboard. Additionally, I'm I'm pointing to the Cloudflare DNS servers on my dashboard, and you'll notice my router and likely your router too or your your endpoint device may just provide the end user, the end user device with just the DNS server as the the gateway, the default gateway device, just the router IP address that they might see in their dashboard as opposed to this in their configuration settings. But one other thing I like to do as well is I might build a policy in that router, and I'll try to zoom in on this as well, that maybe only allows DNS queries to the Cloudflare IP addresses, so allow Cloudflare DNS. And then I'd have another policy below that blocking UDP 53 potentially to all other destinations. Right? So if someone tries to change to, you know, quad eight or quad 9 or 8 Dot 8 Dot eight or quad nine, something like that, we could block those queries, or even a malicious actor setting up a a DNS. They would not be able to do that with their with this router configuration. So very simple, very easy to set up. As I go into the dashboard, when you log in and initially to -.cloudflare.com, and, again, you can set up your own account very easily, to do a lot of what I'm doing today. You're gonna see all of the Cloudflare capabilities. Right? So we're known for web application firewall, DDoS mitigation, hosting your, or onboarding your domains or even purchasing a domain from Cloudflare. We can you can start here, right, for your your journey with Cloudflare. My focus as a specialist is all of them is zero trust dashboard. So, you know, I help a lot of customers with zero trust network access solutions, secure web gateway functionality, but I'll focus primarily on the scope of DNS security. You'll notice, in my dashboard, you'll see a little bit of analytics about my environment on the last twenty four hours. It's remarkable how many DNS queries are leaving my house. Right? So in in my family's devices. So a 135,000 in just this little environment. Right? I mean, even in my home, I think there's 50 wireless connected devices. There's, you know, Purist and filters. There's Amazon's. There's Alexa's, Google devices. It's just crazy. And my washer and dryer is wireless connected. Right? So all of these could maybe be potential pivot points for malicious actors if any of those things are compromised. So ensuring that all DNS traffic is protected is is really powerful. So I get some visibility into that into the dashboard. Some of the block destinations, my top users in my environments if you're using, you know, for example, an endpoint client like our work client. In this case, we're just sending DNS queries to Cloudflare, from this environment. There's some more dashboards too that you can look at, you know, DNS queries analytics. This could pivot you to the logs, provide you more insights about that activity from your guest wireless environments. I'll show you a little bit as well into the setup. When I go to gateway, that's typically where all of our services protect outbound Internet traffic exists, including DNS. We have really good documentation at Cloudflare. At least I think we do. Right? So even our public documentation is is very succinct, very prescriptive on how to get things configured and set up. But even when you go into the dashboard, a lot of these things are wizard driven to how you get started in protecting your environment. So protect your network with DNS filtering. I would get started here. And you'll notice. Right? I can protect your network from DNS. Estimated time completion, six minutes. So this is where I was talking about just that very, very quick time to value, very quick setup and configurations is is this is where you start. Right? So you'll notice here just these four easy steps, to identify maybe the source once those DNS queries queries are being generated. We'll walk you through maybe some guidance to forward your DNS queries from your routers, point your DNS, and then kind of your review setup and and and and deploy. Right? So this is what this wizard will will walk you through. I have a lot of this already preconfigured in my environment, but I just wanted to show you this very quickly that this is very simple solution to set up. When I go to my, my dashboard, I'm gonna go to my DNS locations, and I have a a couple different locations here. First of all, my home. I'll I'll point out my public IP address. This is where I I noted that my my Ubiquiti router has a static IP address. I'm pointing to Cloudflare recursive DNS. IP address is the one seventy two sixty four thirty six dot one and dot two. And I've named that for my home. Breezy Willow Photography is kind of the name that I use for a lot of my my, simulated business type environment. I can use this as an attribute that I can apply policy. You'll notice as well is the Cloudflare generates a unique DOT and DOH string that can be used for your browsers and your applications, and a unique IPv6 endpoint that I can point to Cloudflare that specific destination. That's what I've done for I have a rental property in this area. I generated a unique IPv6 destination. That just consumer spectrum router, I pointed my I b v six DNS queries to that, destination, and then I can build policy just ensuring that my guests at that at that rental property, again, aren't going to malicious destinations. Their devices aren't getting infected with any kind of malicious content, and maybe they're not going to to destinations that are, maybe illegal, for example, right, exposing me to risk. So that's a little bit about the setup, the onboarding, getting traffic to Cloudflare. What's I think it's really powerful about the solution is the granularity in which we can build policy, right, to ensure that users are going to those malicious destinations, for those enterprise customers. Right? I start off with maybe a a a domain list, and maybe I have a list of, of domains like the ones that I own. I I showed you breezybreezywillow.com for my, you know, my little business, Breezy Willow Photography. Maybe I'll include all the domains that I own, maybe my partner domains, ensuring that, you know, if something happens, the disposition of that destination changes, Cloudflare is not gonna get in the way of doing any kind of look up to those destinations. Going a step further, right, for security risks, again, I build this policy ensuring that, if any device in my home or any device in your wireless location that does a DNS query for, you know, malicious.net, for example, instead of responding to that query with an IP address, we're not gonna respond to that query. That that that is we're not gonna allow this establishing connection to that destination. Right? So, very easy to get set up configured. I can choose all the security categories, including DNS tunneling, anonymizers, command and control, malware, phishing, spam, spyware, a tremendous amount of, improvement in your security posture by ensuring that we're not gonna allow, resolution to these potentially malicious destinations. I built different policies for a lot of the different functions that I wanna to provide to my DNS security. For example, I built another policy ensuring that, any DNS traffic isn't resolving to countries that are sanctioned by the I live in United States Of America. So this is a list of sanctioned countries like Afghanistan, Iran, Iraq, Russian Federation, very easy to build policies. So these are some of the ones that I've built. I've named them accordingly so that it's easy to identify in my dashboard and in my logs. But I just wanna show you really quickly that there's also a number of different options to build really, really granular policy. We talked about security destinations, different kinds of DNS records, IP addresses, DOH domains, the source IP address from which you're generating that query. All of these things can be attributes that I could build policy with. Additionally, maybe I wanna have a different policy for different locations. Right? So I can even choose the location as one of the selectors. I can choose n as my operator, and you'll see those same DNS locations that I showed you just a moment ago are available too. So maybe I have a policy that's different for my home versus that Atlantic Beach house. And similarly, maybe you have a different policy for, you know, one clinic versus another clinic or or or one, shop or coffee shop, storefront, whatever it may be. You could have unique policy based on that DNS endpoint or the source IP from which that DNS query was generated. So lots of options for configuration setup. And then I have options to choose to block, allow, override. James mentioned some of those things to override to a different destination. And in my environment, I'm also doing safe search. So ensuring that my kids' devices, when they're connecting, they can't do a search for something that would land them on a a potentially inappropriate site. So couple of the options that, are are provided there. In our enterprise, when you start to use this for your enterprise and you want more granularity and you have, maybe the Warp Client installed, this is our Cloudflare endpoint, you can you can present a custom block page plus the custom prompts from that agent itself. And that's just a little bit insight about what you see additionally in my dashboard that, might be out of scope for the conversation, but a tremendous amount of capability, in this dashboard to build really granular policy and provide some insights into the users why they're being blocked to these specific destinations. Alright. I hope that was helpful at least in terms of the demo, and I'm gonna hand it back over to James, to take over. I'll stop sharing here in just a second. Yeah. Thank you so much, Nathan. You know, one of the things I've really liked about prepping with Nathan for this webinar is how much of this he was able to build just within his own environment that helps his everyday life. And, you know, you you talked about if you've even having all these smart home devices including the washer dryer. I've been myself on the fence about some of these things, so maybe we can chat about it offline. I think that's about what your experiences have been. Yeah. Just to kind of put it all together. So Nathan kind of showed you how it all works behind the scenes, and I want to reconnect it with how this delivers business impact. So going a little bit deeper on that, story I alluded to earlier around this, top mobile airline. So this is an airline that was, choosing to equip its entire fleet with a newer high speed Internet service from Starlink. And Starlink itself doesn't have any of the Kennedy's needed, or built in DNS filtering controls and certainly not at the level of granularity they needed. I mean, in fact, Starlink relies on Cloudflare's free public DNS resolver for some very basic controls. They want to do a little bit more advanced things. So in an evaluation with competitors like Cisco Umbrella, DNS filter, and Infoblox, we were selected because we could deliver the specific controls the airline needed in the simplest way with the best user experience. And so specifically, they valued our global network scale and reliability. So they were looking for a partner that could really handle the large volumes of queries across all the flights they were operating wherever those planes were at any given point around the world. And they found it pretty easy to configure those policies based on content categories, application selectors, and other factors like, you know, should we specifically block torrenting for, guest, you know, our passengers. And plus those in testing, those protections were enforced very consistently with the speed that they were looking for. Now a key requirement for this airline, in this project was to differentiate policies by crew versus passengers. So for example, you know, preventing their passengers obviously from going from torrenting or streaming. And for crew on managed devices, they want to prevent them from downloading managed software or performing operating system updates, for example. So we were able to address this specifically with our dedicated resolver IPs. As I mentioned, these are IPs that we make unique to a customer's account that are not used by other customers who are routing their traffic through Cloudflare. And so by assigning these dedicated IPP for addresses, again, for those passengers versus their crew networks, as Nathan, showed you in the dashboard, they were able to kind of identify the source of traffic and apply different policy controls accordingly. Okay. So so far today, we've really just been focused on these on this starter use case, which is securing guest Wi Fi with DNS filtering. But as we've alluded to and as Nathan showed in Dash, this can often be a launchpad for more strategic efforts to modernize security throughout this organization, and in the process, help you to replace different complex point solutions. And one of the most common set of next steps revolves around extending security and deepening your controls across different web environments. So first, this often means expanding those DNS filtering protections from just your guest users to now your corporate users. So covering your remote workers, your corporate offices. And then later, that same secure web gateway that's doing that DNS filtering, that can be used to enforce some more granular controls with HTTP and browser isolation rules. And with that type of inline visibility in place via our proxy and with your device client deployed, in many instances, this is an opportunity for organizations to now turn on our data loss prevention detection so that they can see when sensitive data is in transit and then block things accordingly. K. So so far, we've been talking mostly about the the web channel, but organizations often think about extending controls across other workspace environments. So for example, many customers prioritize deploying email security to stop attacks like phishing, business email compromise. And the most common initial first step is just to layer our, cloud native capabilities on top of whatever is built in with your Microsoft, your Google, your existing email provider. Maybe further down in the journey or sometimes in parallel, organizations think about mitigating the risks of data exposure and leaks in their SaaS environment. And so this is often when organizations deploy our cloud access security broker to check via API for different misconfigurations that might risk a data leak. So for example, you know, a public, Google Drive is set to publicly accessible over the Internet as opposed just within your corporate environment. And this can be used in combination with our DLP to figure out where sensitive data might be at risk of of leaving organization. And throughout all these steps on the spectrum, this is where organizations have an opportunity to unify security controls with Cloudflare across a wider variety of channels. So web, email, SaaS, cloud, and private app environments. So let's take a little bit of a look at how these these steps have played out for some customers. On the top left is THG. They're an ecommerce retailer in The UK. They've begun a VPN replacement project with Zscaler, but were struggling. And in particular, they were pretty frustrated with switching having to switch between Zscaler's two separate management interfaces to protect private apps with ZPA and their web filtering with CIA. And so this for them, this was an opportunity in moving to us to consolidate and unify security across those different environments for their 7,000 hybrid workers. And to get their migration started, we have some automated tooling that actually just exports, kinda lifts and shifts what those policies look like in VIA to Cloudflare and helps them get started about, helps them get started thinking about what life could look like with us. On the bottom left is Applied Systems. They they're a US insurance technology company. They pretty followed a pretty similar path. So, again, the focus was on consolidating web filtering and private app access controls with software so that they could replace their traditional Cisco VPN and Zscaler. But one use case that was really important to them was isolating access to public generative AI tools like ChatGPT. And so, by kept running all that web code on Cloudflare's edge network, this was their opportune instead of on their local device, this was their way to control how users were interacting with those tools. So they were able to enforce data and use controls, for example, light blocking copy and paste, and blocking uploads uploads to these tools. Estonian Railways on the top right. For them, the CASB service was really critical. It helped them get a better understanding of their overall SaaS security posture by identifying again those potential data leak opportunities in this two configurations. And Werner Enterprises, for them, email security was the focus. So this is a North American transportation company that saw the was able to reduce their malicious out, emails by over 50% within a few weeks and was able to cut their manual effort needed previously to triage all these different email incidents by several hours a day. So we've shared a common path. We've shared how how some customers have done it. Ultimately, this journey is gonna be up to you in terms of where you start and how you make progress. But with the breadth of our portfolio across, you know, not just DNS filtering, but kind of a broader SaaS market. And, of course, beyond that to our application services, protects for web apps and customer facing infrastructure, as well as our developer port portfolio. There are a variety of ways to get started with different types of modernization projects. And so before we move to q and a more broadly, I have to recommend this resource, which is our reference architecture with Nathan actually authored. So this is a great opportunity to get his insights into different technical steps and best practices as you make progress with your secure guest Wi Fi use case. Alternatively, you know, you know how to reach us, and this is a great opportunity to start thinking about what, workshopping your architecture, maybe other POCs that we can develop, in partnership to help you address some of the these use cases. So, that's all the prepared remarks we had for today. And so I'm working in the chat for additional questions, and this is, your opportunity to get in those, questions. While those are coming in, I, you know, wanna get your thoughts, Nathan, on, you know, assuming this guest Wi Fi project goes well, what recommendations can you share to help make a business case for these other types of security projects that we've mentioned? And I actually share my Yeah. I mean yeah. Sounds good. Yeah. I mean, I think there's there's a tremendous amount of visibility you get from, you know, sending not not just for your guest wireless, but your entire organization to send your DNS queries to us for a protected DNS. Right? So like I mentioned before, maybe have internal resolvers within your organization, simple configuration to look at that forward lookup tab. I'm we'll think of, like, as more kind of Microsoft DNS, that forward lookup tab within those configuration settings, enter those IP, IP addresses for Cloudflare DNS, and it will start sending out DNS queries from there and building policy on that. Is such an easy way to get started. But, within our Zero Trust dashboard, again, that's my focus at Cloudflare. There is a tremendous amount of opportunity to to not just look at DNS queries, but all, you know, flows from your endpoints, web traffic, network traffic, all ports and protocols, building very robust policy from there, evaluating all traffic, and leveraging our global infrastructure, right, at scale to do things like TLS inspection, data loss prevention. Right? A tremendous amount of granularity in terms of control. Right? Similar to what you saw on the DNS dashboard, I had all sorts of options for a very customized policy, but now go a step further for all of your outbound Internet traffic. Right? I can build policies for all ports and protocols. I can build policies to do TLS inspection, look at different data point attributes, applications, tremendous amount of control. And that's just, our kind of our gateway solution. In addition to that, you you notice that we're, you know, we're kind of going head to head with Zscaler. So providing access to your internal Reese's through your self hosted applications or building a VPN replacement solution using Cloudflare. And and it was, you know, one of the reasons I came to Cloudflare as well, like, seeing this journey where more and more and more folks have begun working from home and distributed across the country. Right? So or I worked for other organizations where maybe we sold an appliance or a box, and everyone was trying to connect to that appliance to do provide VPN functionality. It was difficult to scale. So leverage Cloudflare for that solution for VPN where we can in, you know, real time scale for to support your environment, your entire workforce through Cloudflare and control it through the centralized dashboard, that can be managed as code infrastructure as code, use your Terraform to to manage that. So I went on about a lot of our things that we can support in that zero trust dashboard, but, man, there's again, it's really just the tip of the iceberg. Yeah. And, you know, just to add to that, I think your your point about how this is maybe the easiest of on ways to get started and start proving value with us because of, you know, how, you know, easy it is to set those location based filtering controls. These secure guest Wi Fi projects are pretty directly tied to quantifiable business impacts for your end customers. So if you're managing a public space, like, you can track the the right metrics around, customer complaints or, the IT tickets that people need to resolve. You can measure the the speed of connections and, you know, see and and track the traffic within your source. There are a bunch of different ways where by you know, once you roll out this filtering service, you're able to connect that to business value. And so that's something you can take internally within your organization and start building cross functional support with other stakeholders across IT, going beyond people who manage just that guest network, who are often maybe just the first tip of the iceberg people to be responsible for a project like this. This is your opportunity to go higher into the org more horizontally across the organization, to get more people on board to take on some of the steps that, Nathan mentioned. So I don't see any questions in the chat. I'll I'll I guess I'll ask one more to to you, Nathan. You know, one of the more common incumbents that we encounter is Cisco umbrella. It makes a lot of sense. They were kind of these early movers and the leaders in this reverse DNS filtering market. But increasingly, and and and in your deals and certainly what I'm seeing, we're seeing a lot of organizations come to us, and kind of look to a switch off of those. I'm kinda curious based on your experience, what are some of the reasons you've seen and where have we been able to, shine? Yeah. I I I think I mean, I I mean, if anyone looks at my LinkedIn profile, you'll know that I I have a lot of experience with, Cisco umbrella. So I I do kinda know a lot about the differentiation between CloudFlare and Cisco. What I I think is one of the most powerful things is our global infrastructure having, data centers in in, 330 cities. Right? So regardless of where your employees are or where folks are working, they're gonna have a great experience in terms of not just DNS response time, but all of our services are provided in all those data centers. It's truly about performance and about, you know, being able to connect very easily. So I think that is one thing that's considerably, I I think, you you may see as an improvement. But also, the folks that have maybe managed that environment and looked at what I just shared the dashboard, I think you likely saw a tremendous amount more granularity in terms of control. Geolocation for one, I think is something that, I think is very powerful in our solution, but tremendous amount of options, to get to configure very customized, policies for your environment that might might go above and beyond. Yeah. Thank you. Thanks for that. I I mean and, yeah, I I don't wanna belabor it. We did share some of those anecdotes earlier on. We have a question around, you know, for folks who are using managed services, how do we support them? I know, for example, we actually can work with a ton of managed service providers to deliver these DNS filtering controls. And for them, at least, one of the ways in which they've historically been able to do this is via, and and prefer to do this is via, you know, API. So just using that to orchestrate different paired child types of relationships, and tiers of policies across the organizations they wanna handle. Nathan, anything you want to add to that? With the with the managed service program? Yeah. Yeah. I I guess I don't have have much to add there, but I have worked I have worked with customers that are offering services to other customers and and, you know, again, being cloud first infrastructure as a code. Right? We can scale and provide, you know, for those solutions as well very, very easily and and the law of management of those solutions very, very easily and effectively as well. Yeah. And then I guess we have one other live question, which is around, you know, looking at us versus a vendor like DNS filter. And and at least in my opinion, you know, DNS filter, they're a service where this is their primary, focus. And certainly, you know, they they can accomplish a lot of these secure guess why by types of use cases, pretty well. And I would say that, you know, we as Nathan and I have been highlighting, this is an opportunity we can certainly address, and we view ourselves as best in class to do these types of secure guest Wi Fi types of use cases. But this is also an opportunity, to work with a vendor who is ready to take on these broader types of enterprise modernization projects. Yeah. But yeah. And and you wanna add to that? No. No. I think I think that's a great great call out. Right? Like, when you're when you're there's tremendous amount of benefits for vendor consolidation and and not just in terms of cost savings. Right? So, you know, if it's just DNS and then be able to add on those other capabilities for all of our zero trust solutions. But then going a step further for our application service, our web application filtering, our our DDoS mitigation, you know, all under the same dashboard, and correlating that data with log push and seeing all of that in one location, I think helps even the practitioners. So it's not just cost cost savings, but putting all the analytics together in one place, in one dashboard, a lot of control from one place is a centralized, control plane is, I think, really powerful too for the folks that have maybe limited IT staff, like in the organizations maybe at work. I think it's incredibly helpful. Yeah. I think I think the question is well Yeah. Real quick, but I was gonna gonna direct it. Yeah. So, the best way to kinda white list white list DNS names, and that that maybe I didn't highlight that terribly well, but the the first lit the first rule that I have in my policies in my dashboard is domains and list allows. So I have a list of domains, that I can address, and I like I mentioned, my domains partner companies need to work with, all the destinations that I won't don't want Cloudflare to get in the way of of changing disposition or blocking as it relates to DNS filtering. You can very easily create a list, enter specific domains and policy, but it should be the very first one in your rule in terms of order of operations and processing is build that rule first, and then everything else below that. So, you can ensure that those queries are always, handled appropriately. Excellent. Well, thanks so much for joining me today, Nathan. I really appreciate, you know, just getting a tour of your environment, and we'll have to chat more about how that's set up offline. But and thanks to our audience, of course, for spending time with us. Again, the opportunity to download some documents, within this interface, have the QR code on the reference architecture on the screen. And please get in touch with us if you want, to get start a conversation about this use case or other modernization projects. Thanks so much for joining. Sure. Bye, everyone.