From Legacy Architecture to Cloudflare One

A 'big bang' cutover that moves 30,000 users and 1,000+ legacy applications all at once is the biggest obstacle to turning VPN-based infrastructure into Zero Trust. Cloudflare and CDW explain that instead of tearing everything down at once, they reduce migration risk by classifying applications by risk level and moving them sequentially.

The key is to treat the network not as simple plumbing but as a system of entangled application dependencies. CDW first migrates simple, modern apps to build momentum, then handles complex legacy systems later in a controlled way. They cite a public-sector case where an outage occurred after attempting to move 500 apps at once as a cautionary example, warning against pushing large-scale transitions without a tiered methodology.

The security model is built around Cloudflare Access. Rather than opening up an entire network segment the way a traditional VPN does, it verifies identity, device posture, and other contextual signals for every request before granting access. Legacy apps can be wrapped with Cloudflare Tunnel and Access policies without rewriting code, converting them into an outbound-only connection that includes SSO and MFA.

Before migration, the environment should be assessed as follows:

• Identity provider check: Distinguish apps using a federated IdP like Okta from those using a local directory.
• Dependency mapping: Document each app's backend DB, API, and service token dependencies.
• Separate Strategy Group / Implementation Group: Keep security standards and implementation efficiency separate, to prevent least-privilege principles from being compromised for the sake of speed.
• Session stress testing: Identify legacy apps that require session persistence in situations where the IP changes, such as mobile environments.

Apps are divided into tiers as follows to set the migration schedule.

• Tier 0: Modern SaaS apps, 1–3 hours/app
• Tier 1: Internal Web Apps, 3–6 hours/app
• Tier 2: Non-Web Client-Server Apps, 4–8 hours/app
• Tier 3: Legacy Enterprise Apps, 1–3 days/app, may require code modifications

The roadmap proceeds through Phase 1 Strategy & Infrastructure, Phase 2 Pilot Rollout, and Phase 3 Production Scaling. In the pilot, the Cloudflare One Client is deployed to a subset of employees first, and during the transition period, legacy VPN and Cloudflare Access run in parallel to preserve a rollback path. Cloudflare emphasizes that a single control plane and single-pass architecture reduce bottlenecks for security teams, and that over the long term, a post-quantum encryption foundation prepares for future threats as well.

In conclusion, the goal isn't simply moving apps to the cloud, but increasing visibility and resilience while significantly raising the difficulty of intrusion. Rather than pushing through a massive transition all at once, safely reducing legacy debt through application modernization and phased rollout is the approach that Cloudflare One and CDW present.