---
title: Non-identity on-ramps · Cloudflare Zero Trust docs
description: With Cloudflare Zero Trust, you can isolate HTTP traffic from on-ramps such as proxy endpoints or Magic WAN. Since these on-ramps do not require users to log in to Cloudflare WARP, identity-based policies are not supported.
lastUpdated: 2024-11-18T22:04:23.000Z
source_url:
  html: https://zt-dark-mode-changelog.preview.developers.cloudflare.com/cloudflare-one/policies/browser-isolation/setup/non-identity/index.md
  md: https://zt-dark-mode-changelog.preview.developers.cloudflare.com/cloudflare-one/policies/browser-isolation/setup/non-identity/
---

With Cloudflare Zero Trust, you can isolate HTTP traffic from on-ramps such as [proxy endpoints](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/agentless/pac-files/) or [Magic WAN](https://developers.cloudflare.com/magic-wan/zero-trust/cloudflare-gateway/). Since these on-ramps do not require users to log in to Cloudflare WARP, [identity-based policies](https://developers.cloudflare.com/cloudflare-one/policies/gateway/identity-selectors/) are not supported.

Note

If you want to apply Isolate policies based on user identity, you will need to either install the [WARP client](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/) or manually redirect users to the [Clientless Web Isolation](https://developers.cloudflare.com/cloudflare-one/policies/browser-isolation/setup/clientless-browser-isolation/) URL.

## Set up non-identity browser isolation

1. [Install a Cloudflare certificate](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/user-side-certificates/) on your devices.

2. Connect your infrastructure to Gateway using one of the following on-ramps:

   * Configure your browser to forward traffic to a Gateway proxy endpoint with [PAC files](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/agentless/pac-files/).
   * Connect your enterprise site router to Gateway with the [anycast GRE or IPsec tunnel on-ramp to Magic WAN](https://developers.cloudflare.com/magic-wan/zero-trust/cloudflare-gateway/).

3. Enable non-identity browser isolation:

   1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Settings** > **Browser Isolation**.
   2. Turn on **Non-identity on-ramp support**.

4. Build a non-identity [HTTP policy](https://developers.cloudflare.com/cloudflare-one/policies/browser-isolation/isolation-policies/) to isolate websites in a remote browser.
