You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* refined description
* refined text
* refined text
* refined text
* refined text
* title
* refined text
* refined text
* refined text
* refined text
* refined text
* refined text
* refined text
* refined text
* refined text
* refined text
* refined text
* refined text
* refined text
* refined text
* refined text
* refined text
* refined text
* refined text
* Apply suggestions from code review
Co-authored-by: Pedro Sousa <[email protected]>
---------
Co-authored-by: Pedro Sousa <[email protected]>
You can bring your own public IPs to Cloudflare to use with Magic Transit. This process requires two steps:
13
13
14
-
1. Add IP <GlossaryTooltipterm="prefix">prefixes</GlossaryTooltip> for each IP address block that you bring to Cloudflare. The IP prefix includes the permission (<GlossaryTooltipterm="letter of agency">Letter of Agency or LOA</GlossaryTooltip>) that allows Cloudflare to announce the network or its subnets. The IP prefix is also where you define your optional [Autonomous System Number (ASN)](https://www.cloudflare.com/learning/network-layer/what-is-an-autonomous-system/) to be included in Cloudflare's advertised AS path.
15
-
2. Define additional BGP prefixes, which control the announcement of the prefix from Cloudflare. By default there is always one BGP prefix that is identical to the IP prefix. You can optionally configure additional, more-specific BGP prefixes (subnets of the IP prefix), up to a maximum prefix length of `/24`.
14
+
1. Add IP <GlossaryTooltipterm="prefix">prefixes</GlossaryTooltip> for each IP address block that you bring to Cloudflare. The IP prefix includes the permission (<GlossaryTooltipterm="letter of agency">Letter of Agency or LOA</GlossaryTooltip>) that allows Cloudflare to announce the network or its subnets. You can also define your optional [Autonomous System Number (ASN)](https://www.cloudflare.com/learning/network-layer/what-is-an-autonomous-system/) to be included in Cloudflare's advertised AS path.
15
+
2. Define additional BGP prefixes, which control the announcement of the prefix from Cloudflare. By default, there is always one BGP prefix that is identical to the IP prefix. You can optionally configure additional, more-specific BGP prefixes (subnets of the IP prefix), up to a maximum prefix length of `/24`.
16
16
17
17
### IP prefixes
18
18
19
19
Cloudflare measures the Magic Transit prefix count based on the number of BGP prefixes a customer defines. Each prefix is billed separately, even if they overlap. For example, both a `/16` and any `/24` within it are counted individually. Onboarding a larger aggregate prefix does not automatically include its smaller subnets for announcement or billing purposes.
20
20
21
-
While there is no billing limit on the accepted prefix sizes, technically only prefixes up to `/24` are accepted for onboarding, as longer ones (like `/25`, `/26`) are not globally routable.
21
+
There is no billing limit on the accepted prefix sizes. However, only prefixes up to `/24` are accepted for onboarding because longer prefixes (like `/25`, `/26`) are not globally routable.
22
22
23
23
Provide all IP prefixes you plan to onboard, along with the ASNs from which they will be advertised. When specifying prefixes, observe these guidelines:
24
24
25
-
- Prefixes must support at least 256 hosts (`/24` in classless inter-domain [routing](https://www.cloudflare.com/learning/network-layer/what-is-routing/) CIDR notation). Refer to [Use a Cloudflare IP](/magic-transit/cloudflare-ips/) if you do not meet the `/24` prefix length requirement.
25
+
- Prefixes must support at least 256 hosts (`/24` in CIDR ([Classless Inter-Domain Routing](https://www.cloudflare.com/learning/network-layer/what-is-routing/)) notation). If you do not meet the `/24` prefix length requirement, refer to [Use a Cloudflare IP](/magic-transit/cloudflare-ips/).
26
26
- Internet Routing Registry entries and Letters of Agency (LOA) must match the prefixes and originating prefixes you submit to Cloudflare.
27
27
- When using contiguous prefixes, specify aggregate prefixes where possible.
28
28
- When using Route Origin Authorizations (ROAs) to sign routes for [resource public key infrastructure (RPKI)](https://tools.ietf.org/html/rfc8210), the prefix and originating ASN must match the onboarding submission.
@@ -88,8 +88,8 @@ Create a [POST request](/api/resources/addressing/subresources/prefixes/subresou
2. From the **IP Prefixes** tab, select the prefix you want to modify > **Edit**.
92
-
3. From the dropdown menu **Status**, choose whether the status of your IP is**Advertised** or **Withdrawn**.
91
+
2. From the **IP Prefixes** tab, select the prefix to modify > **Edit**.
92
+
3. From the **Status** drop-down menu, choose**Advertised** or **Withdrawn**.
93
93
4. (Optional) Edit the description for your prefix.
94
94
5. Select **Edit IP Prefix** to save your changes.
95
95
</TabItem>
@@ -133,7 +133,7 @@ json={{
133
133
}}
134
134
/>
135
135
136
-
AS prepending helps you gracefully transition traffic between network providers. By adding prepends to Cloudflare's advertisement, you make the route through Cloudflare less preferred for some Internet network providers. This allows you to simultaneously advertise the same prefix from an alternate provider with a shorter, more desirable `AS_PATH`. Advertising from both providers at once can provide a smoother traffic migration and minimize packet loss during a change of provider.
136
+
AS prepending helps you gracefully transition traffic between network providers. By adding prepends to Cloudflare's advertisement, you make the route through Cloudflare less preferred for some Internet network providers. This allows you to simultaneously advertise the same prefix from an alternate provider with a shorter, more desirable `AS_PATH`. Advertising from both providers at once provides a smoother traffic migration and minimizes packet loss during a change of provider.
137
137
138
138
The `"asn_prepend_count"` parameter accepts values from `0` to `3`. A higher value makes the route less preferred. This parameter can also be changed using BGP — refer to [Use communities to set AS prepends on an anycast prefix](#use-communities-to-set-as-prepends-on-an-anycast-prefix).
139
139
@@ -145,7 +145,7 @@ When you use AS prepending to migrate traffic away from Magic Transit, the typic
145
145
-**Final state**: External networks now receive two advertisements: the prepended route through Cloudflare and the non-prepended route through your new provider. The external network will select a path based on its BGP policy rules.
146
146
147
147
:::caution
148
-
BGP has different mechanisms to control route priorities which are set by the peered network, not by Cloudflare. As such, this is a besteffort feature. Cloudflare cannot guarantee that peers will honor AS prepends on Cloudflare's transit and peering connections.
148
+
BGP has different mechanisms to control route priorities which are set by the peered network, not by Cloudflare. As such, this is a best-effort feature. Cloudflare cannot guarantee that peers will honor AS prepends on Cloudflare's transit and peering connections.
Copy file name to clipboardExpand all lines: src/content/docs/magic-transit/how-to/configure-routes.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ title: Configure routes
4
4
sidebar:
5
5
order: 2
6
6
head: []
7
-
description: Magic Transit uses a static configuration to route your traffic through anycast tunnels from Cloudflare's global network to your locations. If you are connected through Direct CNI you also have access to BGP peering. Learn how to configure routing.
7
+
description: Magic Transit uses a static configuration to route your traffic through anycast tunnels from Cloudflare's global network to your locations. If you are connected through Direct CNI, you also have access to BGP peering.
Copy file name to clipboardExpand all lines: src/content/docs/magic-transit/how-to/configure-tunnel-endpoints.mdx
+2-4Lines changed: 2 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,9 +4,7 @@ title: Configure tunnel endpoints
4
4
sidebar:
5
5
order: 1
6
6
head: []
7
-
description: Cloudflare recommends two tunnels for each ISP and network location
8
-
router combination, one per Cloudflare endpoint. Learn how to configure IPsec
9
-
or GRE tunnels.
7
+
description: Cloudflare recommends two tunnels for each ISP and network location router combination, one per Cloudflare endpoint. Learn how to configure IPsec or GRE tunnels.
10
8
---
11
9
12
10
import { Render } from"~/components";
@@ -30,4 +28,4 @@ import { Render } from "~/components";
30
28
31
29
## Next steps
32
30
33
-
Now that you have set up your tunnel endpoints, you need to configure routes to route your traffic through Cloudflare. Refer to [Configure routes](/magic-transit/how-to/configure-routes/) to learn more about static routing and BGP peering (only available through Direct CNI connection).
31
+
Now that you have set up your tunnel endpoints, configure routes to direct your traffic through Cloudflare. Refer to [Configure routes](/magic-transit/how-to/configure-routes/) to learn more about static routing and BGP peering (only available through Direct CNI connection).
Copy file name to clipboardExpand all lines: src/content/docs/magic-transit/how-to/ipv6.mdx
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,18 +25,18 @@ Cloudflare transports IPv6 traffic over an IPv6-over-IPv4 GRE tunnel. Here is ho
25
25
26
26
## Current known limitations
27
27
28
-
- The IPv6 beta is not available for accounts with CNI links configured.
29
-
- MTU is 1420 bytes for egress traffic (does not impact Direct Server Return).
28
+
- The IPv6 beta is not available for accounts with CNI (Cloudflare Network Interconnect) links configured.
29
+
- MTU (Maximum Transmission Unit) is 1,420 bytes for egress traffic (does not impact Direct Server Return).
30
30
- Magic Firewall supports two matching fields for IPv6 traffic: source IP address and destination IP address.
31
31
- Cloudflare supports the advertisement of IPv6 prefixes ranging from `/48` to `/32`.
32
32
- Limited to IPv4-based [tunnel health checks](/magic-transit/reference/tunnel-health-checks/) only.
33
33
- Supports only IPv4-based endpoint health checks.
34
34
35
35
## How to configure IPv6
36
36
37
-
Since IPv6 works over an existing IPv4 tunnel you will need to choose either an existing IPv4 GRE tunnel or create a new one to test IPv6. All settings that apply to the IPv4 GRE tunnel apply to the IPv6 tunnel as well, except for any MSS clamping you might need to configure — refer to [MSS clamping recommendations](#mss-clamping-recommendations) below for more information.
37
+
Since IPv6 works over an existing IPv4 tunnel, you need to choose either an existing IPv4 GRE tunnel or create a new one to test IPv6. All settings that apply to the IPv4 GRE tunnel apply to the IPv6 tunnel as well, except for any MSS clamping you might need to configure — refer to [MSS clamping recommendations](#mss-clamping-recommendations) below for more information.
38
38
39
-
To test and set up IPv6 in the Cloudflare dashboard there is only one new field you need to fill out when creating a new IPv4 GRE tunnel or editing an existing one: **IPv6 Interface address**. This is where you enter the Cloudflare-assigned IPv6 address for the Cloudflare side of the tunnel. Each tunnel is assigned a `/127` subnet from your allocated `/96` range. You will configure one address on the Cloudflare side and the other address on your router.
39
+
To test and set up IPv6 in the Cloudflare dashboard, complete one new field when creating a new IPv4 GRE tunnel or editing an existing one: **IPv6 Interface address**. Enter the Cloudflare-assigned IPv6 address for the Cloudflare side of the tunnel. Each tunnel is assigned a `/127` subnet from your allocated `/96` range. You configure one address on the Cloudflare side and the other address on your router.
40
40
41
41
:::caution
42
42
Cloudflare allocates a `/96` IPv6 prefix for each account. The first two addresses in this range are reserved for Cloudflare. The remaining addresses are available for customer GRE tunnels, starting from `:2`, with two IPv6 addresses assigned per tunnel.
@@ -66,4 +66,4 @@ After the first two reserved addresses, you can continue allocating `/127` subne
66
66
67
67
### MSS clamping recommendations
68
68
69
-
Customers using Magic Transit ingress-only traffic (DSR) should apply a TCP MSS clamp with a maximum of 1,416 bytes to their edge router's transit ports to account for the larger IPv6 header.
69
+
If you use Magic Transit ingress-only traffic (DSR), apply a TCP MSS (Maximum Segment Size) clamp with a maximum of 1,416 bytes to your edge router's transit ports to account for the larger IPv6 header.
0 commit comments