Admin

Troubleshooting FAQ

Here we answer commonly asked questions that should help troubleshoot issues with Cloudflare Managed Labs.

Lab resources

What resources do I get with each lab?

This depends on the Solution and Blueprint:

Zero Trust - Enablement

  • 2 VMs
    • Ubuntu origin with 3 mock services running in Docker (website, intranet, SMB fileserver)
    • Windows 11 client with WARP pre-installed
  • Cloudflare account with Zero Trust entitlements and subscriptions

Application Services - Enablement

  • Cloudflare account with Application Services entitlements and subscriptions
  • Access to (shared) origin servers
  • Optionally integration with API Shield traffic generator

Magic WAN - Enablement (WiP)

  • Cloudflare account with Magic WAN entitlements and subscriptions
  • Anycast IP for Magic WAN
  • 5 VMs
    • Headquarters - 1 router, 1 Ubuntu origin server with 3 mock services running in Docker (website, intranet, SMB fileserver)
    • Branch - 1 router, 1 Windows 11 client
    • Roaming employee - 1 Windows 11 client with WARP pre-installed

User invitations and onboarding

Q: How do I invite external users to the lab?

A: Click on the Add lab button, then fill out the form:

Note: When creating a lab, you have the option to add comma-separated list of user emails. This is the list of users that will be sharing this one lab.
If you're running a workshop and want each participant to have their own lab, you will need to create a new lab for every individual user.

All emails in the User(s) field:

  1. Get access to the lab's resources via the frontend UI at labs.cfdata.org
  2. Are added as an Administrator member to the Cloudflare account associated with this lab

Q: How do the users get onboarded? What comms do they receive by the platform?

A: Right now, we don't send out any comms (yet).

  • Anyone with @cloudflare.com email, or anyone who has an existing Cloudflare account is automatically added to the Cloudflare dashboard account and receives no comms at all.
  • Anyone who does not have an existing Cloudflare account under the email they've provided will receive an invitation to join the Cloudflare dashboard account. They need to accept this invitation within 24 hours, if they do not, you will need to re-send the invite (see below).

In both cases you'll need to explain to the end users how to access the lab. We recommend sending them directly to https://labs.cfdata.org/a/lab/list. Once they log in through Access, this page will list all labs they have access to.

Q: My user is not receiving the invite to join the Cloudflare account or the invitation expired.

A: Ask them to double-check the email they gave you. If you created the lab or are one of its admins, you have Super-Administator access to the Cloudflare account. Log in to Cloudflare dashboard, open the account in question and try resending the invite from Manage Account ‣ Members.

Some corporate email solutions can block the invite emails. In this case, ask the user to share some alternate email, e.g. their personal one.

Q: When logging in to labs.cfdata.org, my user does not receive the email with the OTP code.

A: Ask the user to double-check the email address they are putting in and ask them to check their Junk folder. Sometimes it may also take a few minutes for the code to arrive.

Q: When logging in to labs.cfdata.org, my user receives the OTP email, but when they plug in the OTP or click on the link in the email, they get "Invalid login session" error.

A: This is likely because the link was already accessed, either by the user or by their Email Security Gateway (ESG). In this case, just ask the user to navigate directly to labs.cfdata.org again and they should be logged in.

Q: Are the Cloudflare accounts that are created for the labs special in some way?

A: No, these are standard Cloudflare accounts and you can manage them as any other account. There are some specifics to keep in mind though:

  • They are ephemeral and they will be deleted when the lab expires
  • They have generous entitlements/subscriptions aligned with the specific lab solution, you can further adjust these via Ninja Panel if you need to

Q: How long do the labs last? Can I extend them in any way?

A: Lab expiry is decided during creation. Labs created via catalog have an expiration of 14 days, labs created via a form have default expiration of 7 days, this can be changed to up to 31 days by the person creating the lab.

We are working on making this extendable post-creation.

ℹ️
If you urgently need to extend a lab, you can contact us at [email protected].

CML user interface

Q: I can't copy & paste to my Linux / Windows VM.

A: Make sure clipboard read access is allowed - in Chrome this is done via an icon in the address bar:

This could also be an issue of some browsers so if that's an option, consider switching to Chrome.

ℹ️
See also How do I set clipboard permissions for different browsers?

WARP troubleshooting

Q: I have connected my WARP client to the Zero Trust account (blue WARP) and now when I turn the WARP client on, the Windows machine becomes unresponsive.

A: This is happening because when you turn on the WARP client, WARP sends all outbound traffic to Cloudflare. This includes the RDP traffic from the Windows VM to the Managed Labs bastion that provides the remote connectivity.

To solve this and allow the traffic from Windows VM to the bastion to be routed locally, add the bastion IP to the Split Tunnel Exclude list.

Settings ‣ WARP Client ‣ Default profile ‣ Configure and here under Split Tunnels select Manage

Q: The above still didn't work, my Windows machine remains unresponsive and I want to troubleshoot, but I can't access the Windows machine.

A: To temporarily disable WARP from sending all traffic to Cloudflare (and let you use RDP to access the Windows machine), you can switch WARP to DoH mode.

Settings ‣ WARP Client ‣ Default profile ‣ Configure and here switch Service mode to Gateway with DoH.

After saving wait a few minutes for the change to propagate to the client and reload the CML page with the Windows session. Your session should become active again.

Q: I don't see the WARP icon in task bar.

A: If you just opened the Windows machine, give a minute or two, it may take a while for the WARP process to start.

If that doesn't help, double-check both WARP processes are running via Task Manger:

If either process is missing, try starting WARP manually from the start menu.

If they are both running, double-check WARP is allowed to display its icon. Right-click on the taskbar and select Taskbar settings.

Then under Other system tray icons, make sure Cloudflare WARP is set to On.

Known issues

  • None

Roadmap

High priority

  • Provisioning multiple labs in one go (e.g. for a all attendees in a workshop)
  • Ability to configure lifespan of a lab when creating it
  • Ability to extend lifespan of a lab post-creation

Medium priority

  • Delete multiple labs in one go