Skip to content
Magic Transit
Visit Magic Transit on GitHub
Set theme to dark (⇧+D)


Cloudflare requires that you meet the following Magic Transit onboarding requirements:

Use compatible tunnel endpoint routers

Magic Transit relies on Generic Routing Encapsulation (GRE) tunnels to transmit packets from Cloudflare’s edge to your origin network. To ensure compatibility with Magic Transit, the routers at your GRE tunnel endpoints must meet these requirements:

  • Support GRE tunneling.
  • Allow configuration of at least 1 tunnel per Internet service provider (ISP).
  • Support maximum segment size (MSS) clamping.

Draft Letter of Authorization

Draft a Letter of Authorization (LOA) that identifies the prefixes you want to advertise and gives Cloudflare permission to announce them. See this LOA template for an example.

Verify Internet Routing Registry entries

To ensure that Magic Transit routes traffic to the correct autonomous systems (AS), verify that your Internet Routing Registry (IRR) entries match corresponding origin autonomous system numbers (ASNs). For guidance, see Verify IRR entries.

Set maximum segment size

Packet flow diagram

The SYN-ACK packet sent to the client during TCP handshake encodes the value for maximum segment size (MSS). Egress packets are routed via your ISP interface, and each packet must comply with the standard Internet routable maximum transmission unit (MTU), which is 1500 bytes.

Cloudflare uses GRE tunnels to deliver packets from our edge to your data center(s), while Cloudflare Magic Transit encapsulates these packets, adding a new IP header and GRE protocol header.

To accommodate the additional header data, you must set the MSS value to 1436 bytes at your physical egress interfaces (not the GRE tunnel interfaces):

Standard Internet routable MTU1500 bytes
-Original IP header20 bytes
-Original protocol header (TCP)20 bytes
-New IP header20 bytes
-New protocol header (GRE)4 bytes
=Maximum segment size (MSS)1436 bytes

Unless you apply these MSS settings at the origin, client machines do not know that they must use an MSS of 1436 bytes when sending packets to your origin.

Follow router vendor guidelines

Instructions to adjust MSS by applying MSS clamps vary depending on the vendor of your router.

The following table lists several commonly used router vendors with links to MSS clamping instructions:

Router deviceURL
CiscoTC IP Adjust MSS
JuniperTCP MSS – Edit System

Verify MSS settings at your origin

To verify that your routers have the correct MSS setting (1436 bytes) at your origin, run the following command on the servers egressing the prefixes you want to add to Magic Transit:

$ curl

You should see the following result:

Local: MSS: 1436Remote MSS: 1436