Securing IoT fleets without a separate network
Internet of Things (IoT) devices are everywhere: cameras, printers, door readers, thermostats, and even hospital monitors. They are cheap, useful, and often deeply insecure. Constrained hardware means limited access controls, hard-coded passwords, and no practical way to push firmware patches. A vulnerable IoT device sitting on a production network is a literal backdoor into the rest of the environment.
The threat is not theoretical. The 2016 Mirai botnet compromised millions of IoT devices and used them to take down major Internet services. Cloudflare itself saw this play out in March 2021, when a vendor for physical security cameras was compromised. The attacker gained access to the vendor's internal support tools and tried to move laterally across Cloudflare's network. A Zero Trust architecture — where every connection must be authenticated — stopped the intrusion at the cameras.
Still, incidents like that raise a question: can the IoT devices themselves be protected even when they sit alongside production systems? Cloudflare's answer is yes, using its own Cloudflare One product line.
Traditional IoT protection gets complicated fast
Zero Trust works well in controlled environments like corporate offices, where every application and resource sits behind an access gateway. But IoT devices often operate in environments that are much harder to ring-fence. Data centers, for example, have multiple vendors on site, legacy machine-to-machine connections, and an existing mesh of production networks. Deploying a Zero Trust model there—where every camera and reader must authenticate before reaching anything else—is not practical.
VLANs offer another approach: put IoT devices on their own segmented network. This works at Layer 2, but Layer 3 egress must be tightened with access lists on the upstream router. As networks grow, so does the complexity. Each site requires consistent configuration across switches, access lists for ingress and egress, and logging for both allowed and denied traffic. A single misconfigured switch can allow a device from one VLAN to pivot into another. Private VLANs help on a per-switch basis, but add their own management overhead.
The result is a scalability problem: security teams cannot easily maintain the same guarantees across hundreds of sites with shifting infrastructure.
Routing IoT traffic through Cloudflare's edge
Cloudflare's alternative eliminates the per-site network engineering. The IoT device—in their proof of concept, a Verkada camera—connects to a Power over Ethernet switch configured to tunnel all traffic via Anycast GRE to Cloudflare's global network. There, security policies are enforced from a single dashboard.
This setup gives network administrators policy control at Layer 3 and above without touching physical infrastructure. Egress rules determine exactly where a device may send traffic; anything outside that scope is dropped. Because enforcement happens in the Cloudflare edge, rules are pushed globally and instantly. There is no per-switch configuration, no GRE tunnel on a per-site basis, and no access list to maintain at every site.
Logs are gathered automatically. The protection is vendor-agnostic, runs over common standards, and does not rely on buying new hardware. Compared to VLAN-based isolation, the upkeep is simpler, and the security guarantees are more consistent.
| Zero Trust | VLAN | Cloudflare One | |
|---|---|---|---|
| Prevents lateral movement with proper configuration | ✅ | ✅ | ✅ |
| Hardware not required | ✅ | ❌ | ✅ |
| Automatic logging | ✅ | ❌ | ✅ |
| Isolation of IoT Device itself | ❌ | ✅ | ✅ |
| Single point of configuration | ❌ | ❌ | ✅ |
| Complexity does not increase with number of devices | ❌ | ❌ | ✅ |
| Device agnostic | ❌ | ❌ | ✅ |
| Speed and performance benefits from CF's network | ❌ | ❌ | ✅ |
That level of isolation comes without needing a separate physical network or a dedicated stack of devices. Cloudflare treats the entire model as a serverless, infrastructure-less approach to network segmentation.
Proven under attack, rolling out internally
In Q4 2021, Cloudflare hired an independent penetration testing firm to challenge the architecture. The test reproduced an attacker with access to a rogue device inside the protected environment, who then attempted to reach production systems. Lateral movement was not possible—the setup held.
With that validation complete, Cloudflare has begun formalizing the rollout of this architecture across its own data center sites under a Physical Security initiative, aiming to protect the systems the company considers most sensitive. The same setup is available to external enterprises through Cloudflare One.
