From bf8621e6101a578095475ef3f0287df021abbbfb Mon Sep 17 00:00:00 2001 From: Tomislav Novak Date: Thu, 27 Aug 2026 15:30:39 +0100 Subject: [PATCH] [LOGPUSH] Update ZeroTrust Network Session SourceInternalIP wording MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Updating the SourceInternalIP field description because the current wording says it is only available for GRE/IPsec tunnel on-ramps and represents the local LAN IP. A customer confirmed this is also populated for WARP client (device_client) traffic, where the value represents the WARP CGNAT/internal address rather than the device’s local LAN IP. This change clarifies the field behavior across on-ramp types and avoids customers assuming the field should be empty for WARP traffic. Fix per merge for Fix Gateway analytics IPv4 byte order --- .../logpush-job/datasets/account/zero_trust_network_sessions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions.md b/src/content/docs/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions.md index 6a5f1a6ca1c..e91f21d34e8 100644 --- a/src/content/docs/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions.md +++ b/src/content/docs/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions.md @@ -243,7 +243,7 @@ Source IP of the network session. Type: `string` -Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp. +Internal IP of the device. For WARP client traffic, this is the WARP CGNAT address, typically in the `100.96.0.0/12` range. For GRE/IPsec tunnel [on-ramps](/cloudflare-one/networks/connectivity-options/), this may represent the local/private source IP behind the tunnel. ## SourcePort