Best practices for dynamic advertisement
Best practices when managing dynamic advertisement.
Verify user roles & obtain prefix IDs
To ensure smooth operation in general and simplify the advertisement process during an attack scenario, complete the following tasks:
Assign appropriate user roles. Ensure that users assigned to manage the status of IP prefix advertisement have the Administrator or Super Administrator role in your Cloudflare account. For instructions, see . Setting up Multi-user accounts on Cloudflare Get a list of the Prefix IDs you want to manage. Maintaining a list of Cloudflare IDs for each prefix simplifies management via the Cloudflare API, since most dynamic advertisement operations require them.
To obtain Prefix IDs, go your Cloudflare account home page and review
, or use the get prefix IDs operation in the Cloudflare API. Refer to these Prefix IDs when managing prefix advertisement. list prefixes Enable prefix advertisement
Be sure to enable prefix advertisement with Cloudflare before you withdraw the advertisement from your data center.
Withdrawing the advertisement from your data center without first enabling it with Cloudflare can result in dropped traffic, since that traffic will not have access to a valid route.
To avoid latency and the possibility of dropped routes, enable prefix advertisement from Cloudflare
before you withdraw the advertisement from your data center, as outlined in these steps:
To enable prefix advertisement,
in your Cloudflare account home or use the use the IP Prefixes page operation in the Cloudflare API. This operation requires your Account ID, Prefix IDs, and API key. (For instructions, see Update Prefix Dynamic Advertisement Status .) get prefix IDs
Enablement takes 2–7 minutes.
Verify the advertisement using looking glass of your choice—
, for example. Use the Cloudflare ASN (13335) to track the advertisement route. Hurricane Electric Internet Services
Remove the prefix advertisement that originates from your data center.
If you do not remove the advertisement from your data center, some of your traffic may not route through Cloudflare for protection, depending on which routes your ISP prefers. If you want to continue advertising from your data center while using Magic Transit, one option is to advertise a less specific route (eg. a /23) and have Cloudflare advertise more specifics (eg. /24s).
Disable prefix advertisement
To disable (withdraw) prefix advertisement, reverse the steps you used to enable it:
Add the prefix advertisement to your data center.
[Optional] Verify the advertisement using a looking glass of your choice—
, for example. Hurricane Electric Internet Services
To disable prefix advertisement at Cloudflare’s edge, see the
in your Cloudflare account home or use the IP prefixes page operation in the Cloudflare API. This operation requires your Account ID, Prefix IDs, and API key. (For instructions, see Update Prefix Dynamic Advertisement Status . get prefix IDs
Disablement takes approximately 15 minutes.