Magic Transit

BGP route filtering for IPsec and GRE tunnels

Cloudflare WAN and Magic Transit IPsec and GRE tunnels now support BGP import and export filtering. Create reusable filter profiles that specify an allow or deny action and a list of Classless Inter-Domain Routing (CIDR) targets with exact, more-specific, or prefix-length matching. Each tunnel supports one import filter and one export filter. You can create and assign profiles through the dashboa…

BGP over IPsec and GRE tunnels generally available

BGP peering over IPsec and GRE tunnels is generally available for Cloudflare WAN and Magic Transit. You can use it for production workloads. BGP peering exchanges routes dynamically between your devices and your Cloudflare virtual network routing table. You no longer need to update static routes manually as your network changes. BGP over IPsec and GRE tunnels is available to all accounts that use…

Managed Rulesets supported in Unified Routing

Cloudflare Advanced Network Firewall Managed Rulesets are now supported for accounts using Unified Routing mode. For the full list of feature availability, refer to Check feature availability before upgrading.

Unified Routing generally available

Unified Routing is generally available for Cloudflare WAN and Magic Transit. Unified Routing improves the integration between Cloudflare One and the standard connectivity onramps supported by Cloudflare WAN. It is capable of many new features including Automatic Return Routing, BGP and custom client subnets. We recommend Unified Routing for all new accounts. For details, refer to Cloudflare WAN t…

Threat Intel Lists supported in Unified Routing

Cloudflare Advanced Network Firewall Threat Intel Lists are now supported for accounts using Unified Routing mode. This feature requires a Cloudflare Advanced Network Firewall subscription. Support for additional features - Rate Limiting and Managed Rulesets - is planned. For the full list of current beta limitations, refer to Traffic steering beta limitations.

IP lists, IDS, and SIP rules supported in Unified Routing

Cloudflare Advanced Network Firewall IP lists, IDS, and SIP rules are now supported for accounts using Unified Routing mode. These features require a Cloudflare Advanced Network Firewall subscription. Support for additional features - Threat Intel Lists, Rate Limiting, and Managed Rulesets - is planned. For the full list of current beta limitations, refer to Traffic steering beta limitations.

Network Analytics support for Unified Routing

Network Analytics is now fully supported for accounts using Unified Routing mode. Traffic that traverses Unified Routing onramps and offramps is now visible in Network Analytics with the same dimensions and filters as traffic on the standard data plane. This closes a parity gap for customers who had moved tunnels onto Unified Routing and lost visibility into their dataplane traffic in the Network…

New accounts assigned a single IPv4 anycast address

New Magic Transit and Cloudflare WAN accounts are now assigned a single IPv4 anycast address by default. Cloudflare handles failures on its network automatically by advertising your endpoint IP from multiple nodes across many globally distributed data centers. To handle failures on your network, configure two tunnels from separate routers. To request additional anycast IP addresses for your accou…

NAT-T support for IKE on UDP port 500

Cloudflare IPsec now supports the standard NAT traversal (NAT-T) flow, where IKE begins on UDP port 500 and switches to UDP port 4500 after NAT is detected. Previously, devices behind NAT had to be configured to initiate IKE on UDP port 4500 directly. Devices that started on UDP port 500 could not complete the IKE handshake when NAT was in the path. This required custom configuration on devices s…

Country rules supported in Unified Routing

Cloudflare Advanced Network Firewall Country rules are now supported for accounts using Unified Routing mode. This feature requires a Cloudflare Advanced Network Firewall subscription. You can create firewall rules that match traffic based on source or destination country to enforce geographic access policies across your network. This is the first of the Cloudflare Advanced Network Firewall featu…

BGP over GRE and IPsec tunnels

Magic WAN and Magic Transit customers can use the Cloudflare dashboard to configure and manage BGP peering between their networks and their Magic routing table when using IPsec and GRE tunnel on-ramps (beta). Using BGP peering allows customers to: Automate the process of adding or removing networks and subnets. Take advantage of failure detection and session recovery features. With this functiona…

Network Services navigation update

The Network Services menu structure in Cloudflare's dashboard has been updated to reflect solutions and capabilities instead of product names. This will make it easier for you to find what you need and better reflects how our services work together. Your existing configurations will remain the same, and you will have access to all of the same features and functionality. The changes visible in you…

Magic Transit and Magic WAN health check data is fully compatible with the CMB EU setting.

Today, we are excited to announce that all Magic Transit and Magic WAN customers with CMB EU (Customer Metadata Boundary - Europe) enabled in their account will be able to access GRE, IPsec, and CNI health check and traffic volume data in the Cloudflare dashboard and via API. This ensures that all Magic Transit and Magic WAN customers with CMB EU enabled will be able to access all Magic Transit a…

Graceful withdrawal of BYOIP prefixes

Magic Transit customers can now configure AS prepending on their BYOIP prefixes advertised at the Cloudflare edge. This allows for smoother traffic migration and minimizes packet loss when changing providers. AS prepending makes the Cloudflare route less preferred by increasing the AS path length. You can use this to gradually shift traffic away from Cloudflare before withdrawing a prefix, avoidi…

Establish BGP peering over Direct CNI circuits

Magic WAN and Magic Transit customers can use the Cloudflare dashboard to configure and manage BGP peering between their networks and their Magic routing table when using a Direct CNI on-ramp. Using BGP peering allows customers to: Automate the process of adding or removing networks and subnets. Take advantage of failure detection and session recovery features. With this functionality, customers…

Explore product updates for Cloudflare One

Welcome to your new home for product updates on Cloudflare One. Our new changelog lets you read about changes in much more depth, offering in-depth examples, images, code samples, and even gifs. If you are looking for older product updates, refer to the following locations. Older product updates Access Browser Isolation CASB Cloudflare Tunnel Data Loss Prevention Digital Experience Monitoring Ema…