Skip to content
Cloudflare Docs

Network health

Magic Transit uses health check probes to determine the status of tunnels. Cloudflare uses this information to steer traffic through the best available route and warn you about potential issues with a tunnel. Service-level indicators (SLIs) and service-level objectives (SLOs) combine to determine when Cloudflare sends you tunnel health alerts. Refer to How Cloudflare calculates Magic Tunnel health alerts for more information about SLIs and SLOs.

There are two types of health checks available: endpoint and tunnel health checks.

  • Endpoint health checks evaluate connectivity from Cloudflare distributed data centers to your origin network. Endpoint probes flow over available tunnels to provide a broad picture of Internet health and do not inform tunnel selection or steering logic.

    Cloudflare global network servers issue endpoint health checks outside of customer network namespaces and typically target endpoints beyond the tunnel-terminating border router.

    During onboarding, you specify IP addresses to configure endpoint health checks.

  • Tunnel health checks monitor the status of the tunnels that route traffic from Cloudflare to your origin network. Magic Transit relies on health checks to steer traffic to the best available routes.

    During onboarding, you specify the tunnel endpoints or tunnel health check targets that the tunnel probes from Cloudflare's global network will monitor.

    You can access tunnel health check results through the API. Cloudflare aggregates these results from individual health check results on Cloudflare servers.

Refer to Tunnel health checks for a deep dive into the different types of health checks, what they do, and how they work.

Refer to the following pages for details on how to use the various network health checks available.