Skip to content
Cloudflare Docs

Applications and app types

Gateway allows you to create DNS, Network, and HTTP policies based on applications and app types. You can select individual applications or groups of app types to filter specific traffic on your network.

Applications

When you choose the Application selector in a Gateway policy builder, the Value field will include all supported applications and their respective app types. Alternatively, you can use the Gateway API to fetch a list of applications, app types, and ID numbers.

App types

Gateway sorts applications into the following app type groups:

ValueDefinition
Artificial IntelligenceAI assistance applications
Audio StreamingMusic streaming, podcasts, and other audio applications
Collaboration & Online MeetingsBusiness communication and collaboration applications
DatingOnline dating applications
DevelopmentSoftware development and development operations applications
EmailEmail applications
Encrypted DNSDNS encryption applications
File SharingFile sharing applications
Finance & AccountingFinancial and accounting applications
GamingGames and gaming applications
Human ResourcesEmployee management applications and workforce tools
Instant MessagingInstant messaging applications
IT ManagementIT deployment management applications
LegalLegal tools and applications
NewsNews applications
ProductivityBusiness and productivity applications
Public CloudPublic cloud infrastructure management applications
Sales & MarketingSales and marketing applications
Search EnginesWeb search engines and applications
SecurityInformation security applications, including shadow IT
ShoppingOnline shopping applications
Social NetworkingSocial networking applications
SportsSports streaming and news applications
Video StreamingVideo streaming applications
Do Not InspectApplications incompatible with the TLS certificate required by the Gateway proxy

Application controls

With Cloud App Control, you can choose specific actions and operations to match application traffic. Supported applications and operations include:

ChatGPT (app ID 1199)
Operations groupOperations group IDOperation nameOperation IDApplication Controls groupApplication control IDDLP content
Chat1650SendPrompt8004Prompt1652✅
Chat1650UploadFile8008Upload1653❌
Chat1650UploadFilePayload8013Upload1653✅
Chat1650ShareResponse8006Share1654❌
Chat1650ShareCanvas8007Share1654❌
Chat1650TranscribeVoice8011Voice1655❌
Chat1650EnableVoiceMode8003Voice1655❌
Settings1651AllowTraining8009❌
Settings1651AllowVoiceTraining8010❌
Settings1651AllowVideoTraining8016❌
Settings1651ExportData8020❌

Google Gemini (app ID 1340)
Operations groupOperations group IDOperation nameOperation IDApplication Controls groupApplication control IDDLP content
Chat1656SendPrompt8021Prompt1657✅
Chat1656UploadFile8022Upload1658❌
Chat1656UploadFilePayload8023Upload1658✅
Chat1656TranscribeVoice8025Voice1659❌

Perplexity (app ID 1937)
Operations groupOperations group IDOperation nameOperation IDApplication Controls groupApplication control IDDLP content
Chat2596SendPrompt11947Prompt2598✅
Chat2596ClarifyingPrompt11951Prompt2598✅
Chat2596CreateUploadUrl11948Upload2599❌
Chat2596UploadFile11955Upload2599✅
Settings2597UploadOrganizationFile11950Upload2599❌
Chat2596ShareChat11952Share2600❌
Chat2596VoiceTranscription11953Voice2601❌
Chat2596ExportChat11949❌
Chat2596DeleteThread11954❌
Settings2597DeleteOrganizationFile11956❌

Claude (app ID 2430)
Operations groupOperations group IDOperation nameOperation IDApplication Controls groupApplication control IDDLP content
Chat2126SendPrompt10048Prompt2127✅
Chat2126PromptCompletion10050Prompt2127✅
Chat2126RetryPromptCompletion10040Prompt2127✅
Chat2126UploadFile10039Upload2128✅
Chat2126ConvertDocument10041Upload2128✅
Chat2126ShareConversation10043Share2129❌
Chat2126GetShares10052Share2129❌
Chat2126CreateConversation10038❌
Chat2126GetConversation10046❌
Chat2126UpdateConversation10047❌
Chat2126DeleteConversation10045❌
Settings2125UpdateAccount10036❌
Settings2125InitiateDataExport10037❌
Chat2126GiveFeedback10042❌
Chat2126SetConversationTitle10044❌
Settings2125GetOrganisation10049❌
Chat2126GetFilePreview10051❌

Usage

Overlapping hostnames

Overlapping hostnames are most common for vendors with many applications, such as Google or Meta. When you use the Application selector in Gateway policies, actions taken by Gateway will be limited to the specific application defined. Gateway will also log other applications that use the same hostnames, but it will not take action unless the application was matched by the policy. For example, both the Facebook and Facebook Messenger apps use the chat-e2ee.facebook.com hostname. When evaluating traffic to the Facebook Messenger app, Gateway will only take action on Facebook Messenger traffic but may log both the Facebook and Facebook Messenger apps.

To ensure Gateway evaluates traffic with your desired precedence, order your most specific policies with the highest priority according to order of precedence.

Do Not Inspect applications

Gateway automatically groups applications incompatible with TLS decryption into the Do Not Inspect app type. As Cloudflare identifies incompatible applications, Gateway will periodically update this app type to add new applications. To ensure Gateway does not intercept any current or future incompatible traffic, you can create a Do Not Inspect HTTP policy with the entire Do Not Inspect app type selected.

TLS decryption limitations

Applications can be incompatible with TLS decryption for various reasons:

  • Certificate pinning: Certificate pinning is a security mechanism used to prevent on-path attacks on the Internet by hardcoding information about the certificate that the application expects to receive. If the wrong certificate is received, even if it is trusted by the system, the application will refuse to connect.

  • Non-web traffic: Some applications send non-web traffic, such as Session Initiation Protocol (SIP) and Extensible Messaging and Presence Protocol (XMPP), over TLS. Gateway cannot inspect these protocols.

Microsoft 365 integration

To optimize performance for Microsoft 365 applications and services, you can bypass TLS decryption by turning on the Microsoft 365 traffic integration. This will create a Do Not Inspect policy for all Microsoft 365 domains and IP addresses ↗ specified by Microsoft. This policy also uses Cloudflare intelligence to identify other Microsoft 365 traffic not explicitly defined.

To turn on the Microsoft 365 integration:

  1. In Zero Trust ↗, go to Settings > Network > Integrated experiences.
  2. In Bypass decryption of Microsoft 365 traffic, select Create policy.
  3. To verify the policy was created, select View policy. Alternatively, go to Gateway > Firewall policies > HTTP. A policy named Microsoft 365 Auto Generated will be enabled in your list.

All future Microsoft 365 traffic will bypass Gateway logging and filtering. To disable this behavior, turn off or delete the policy.

Terraform

Terraform users can retrieve the app types list with the cloudflare_zero_trust_gateway_app_types_list data source. This allows you to create Gateway policies with the application's name rather than its numeric ID. For example:

data "cloudflare_zero_trust_gateway_app_types_list" "gateway_apptypes" {
  account_id = var.cloudflare_account_id
}


locals {
  apptypes_map = merge([
    for c in data.cloudflare_zero_trust_gateway_app_types_list.gateway_apptypes.result :
    { (c.name) = c.id }
  ]...)
}


resource "cloudflare_zero_trust_gateway_policy" "zt_block_dns_apps" {
  account_id = var.cloudflare_account_id
  name       = "DNS Blocked apps"
  action     = "block"
  traffic    = "any(app.ids[*] in {${join(" ", [
    local.apptypes_map["Discord"],
    local.apptypes_map["GoToMeeting"],
    local.apptypes_map["Greenhouse"],
    local.apptypes_map["Zelle"],
    local.apptypes_map["Microsoft Visual Studio"]
  ])}})"
}