[Spectrum] Document IP Access Rules blocking health checks

src/content/docs/load-balancing/additional-options/spectrum.mdx

@@ -54,6 +54,10 @@ The exact settings will vary depending on your use case. Refer to the following
 8. On the **Monitors** page, define the settings presented and select **Next**.
    - Review the monitors attached to your pools.
    - If needed, you can attach an existing monitor or [create a new monitor](/load-balancing/monitors/create-monitor/#create-a-monitor).
+   :::caution[IP Access Rules and health checks]
+   If your Spectrum application is used as a Load Balancer endpoint and has [IP Access Rules](/spectrum/reference/configuration-options/#ip-access-rules) enabled, Cloudflare's health check probes must be allowed by your rules. Otherwise, health checks will be blocked and all endpoints will be marked as unhealthy. To resolve this, add [Cloudflare IP addresses](https://www.cloudflare.com/ips/) to your IP Access Rules allowlist. Refer to [Spectrum Troubleshooting](/spectrum/reference/troubleshooting/#health-checks-fail-when-ip-access-rules-are-enabled) for details.
+   This does not apply when the Spectrum application's origin is a Load Balancer hostname. In that architecture, the monitor probes the origin directly and is not affected by IP Access Rules on the Spectrum app.
+   :::
 
 9. On the **Traffic Steering** page, choose an option for [Traffic steering](/load-balancing/understand-basics/traffic-steering/steering-policies/) and select **Next**.
 

src/content/docs/spectrum/reference/configuration-options.mdx

@@ -94,6 +94,14 @@ If [IP Access rules](/waf/tools/ip-access-rules/create/) are enabled for a Spect
 Network analytics data for Spectrum does not reflect the outcomes of IP Access rules. Instead, to verify whether traffic was allowed or blocked based on these rules, consult the Spectrum event logs.
 :::
 
+:::caution[Health checks and IP Access Rules]
+When IP Access Rules are enabled with an allowlist model (allow specific IPs, block all others), health checks targeting the Spectrum application may be blocked, causing endpoints to appear unhealthy. This applies when the Spectrum application is the target of a Cloudflare Health Check or a Load Balancer monitor. To prevent this, add [Cloudflare IP addresses](https://www.cloudflare.com/ips/) to your allowlist. Refer to [Spectrum Troubleshooting](/spectrum/reference/troubleshooting/#health-checks-fail-when-ip-access-rules-are-enabled) for details.
+:::
+
+:::note
+[Custom rules](/waf/custom-rules/) (WAF rules) do not apply to Spectrum applications configured with the TCP/UDP application type. IP Access Rules are the only supported IP-based filtering mechanism for these applications. Refer to [Spectrum Limitations](/spectrum/reference/limitations/#ip-access-control) for details.
+:::
+
 ## Argo Smart Routing
 
 Once Argo Smart Routing is enabled for your application, traffic will automatically be routed through the fastest and most reliable network path available. Argo Smart Routing is available for TCP and UDP (beta) applications.

src/content/docs/spectrum/reference/troubleshooting.mdx

@@ -28,6 +28,37 @@ When a Spectrum application uses a [virtual network origin](/spectrum/reference/
 
 For tunnel health, BGP, and routing diagnostics on WAN-connected origins, refer to [Troubleshoot Cloudflare WAN](/cloudflare-wan/troubleshooting/).
 
+## Health checks fail when IP Access Rules are enabled
+
+### Applies to
+
+This issue applies when a Spectrum application is the target of a health check:
+
+- A standalone Cloudflare [Health Check](/health-checks/) is configured against the Spectrum application, or
+- A [Load Balancer monitor](/load-balancing/monitors/) uses the Spectrum application as an endpoint (the Spectrum app is the target of the Load Balancer).
+
+This issue does **not** apply when the Spectrum application's **origin** is a Load Balancer hostname. In that architecture, the Load Balancer monitor probes the origin servers directly, not through the Spectrum application, so IP Access Rules on the Spectrum app do not affect the monitor.
+
+### Symptoms
+
+- Cloudflare Health Checks or Load Balancer monitors report the Spectrum endpoint as unhealthy.
+- Removing IP Access Rules from the Spectrum application causes health checks to succeed.
+- The Spectrum application works correctly for client traffic that is allowed by the IP Access Rules.
+
+### Cause
+
+When you turn on [IP Access Rules](/spectrum/reference/configuration-options/#ip-access-rules) on a Spectrum application, all incoming connections are evaluated against your rules based on source IP — including connections from Cloudflare's own health check probes. If your rules use an allowlist model (allow specific IPs, block all others), Cloudflare's health check source IPs will be blocked.
+
+Switching the health check from HTTP to TCP does **not** bypass IP Access Rules, because the rules evaluate the incoming connection before the health-check protocol is negotiated.
+
+### Solution
+
+Add Cloudflare's IP ranges to your IP Access Rules allowlist. You can find the current list of Cloudflare IP addresses at [cloudflare.com/ips](https://www.cloudflare.com/ips/).
+
+If you need to restrict client access but cannot allowlist Cloudflare IPs on the Spectrum application, move access control to your origin instead of using IP Access Rules on the Spectrum app.
+
+If IP Access Rules remain enabled without allowing Cloudflare probe IPs, health checks will continue to fail.
+
 ## Cannot create Spectrum application — DNS record already exists
 
 ### Symptoms