Allow for lost sessions while pfSense HA nodes run incompatible state-sync versions
An HA upgrade can preserve failover capability while still interrupting established connections.
Read the guideDSE security knowledge hubSecurity knowledge,
Security knowledge,
without the noise.
Page 4 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
DSE-authoredOfficial sourcesReviewed guidance
Search the library DSE post stream
2,626 articlesGuidance and analysis from DSE
Protect the pfSense pfsync network as a state-table trust boundary
pfsync state exchange has no built-in authentication, so the network carrying it matters.
Read the guide
Document what pfSense XMLRPC synchronization deliberately leaves local
Synchronized firewall rules do not prove that both HA nodes have matching local configuration.
Read the guide
Check resolved addresses before using a pfSense hostname alias for a public service
A DNS-backed firewall alias is a periodically refreshed address set, not a hostname-aware web filter.
Read the guide
Read both NAT addresses and both directions in the pfSense state table
The state table can distinguish a translated connection from one that has not received a reply.
Read the guide
Review required OIDC claims before connecting a SaaS application through Cloudflare Access
A missing required claim can block authentication even after the user signs in successfully.
Read the guide
Do not equate Cloudflare’s WARP posture check with enrollment in your organization
The documented WARP check also accepts the consumer client.
Read the guide
Keep Access client-certificate trust separate from the website server certificate
The CA uploaded for Access mTLS validates clients, not the certificate shown by the website.
Read the guide
Separate Access authentication evidence from HTTP activity evidence
A successful login record does not list every action taken inside an application.
Read the guide
Recheck the full Cloudflare Access policy when adding a more specific application path
A child-path application can replace the parent policy instead of adding another restriction.
Read the guide