Configure Virtual Connector

Virtual Magic WAN Connector (Virtual Connector) is a virtual appliance alternative to the hardware based Magic WAN Connector appliance. These two versions of Connector are identical otherwise.

​​ Prerequisites

Before you can install Virtual Connector, you need an Enterprise account with Magic WAN enabled. Additionally, you need to have a VMware host with sufficient compute, memory, and storage to run the virtual machine with Virtual Connector. This includes:

• Intel x86 CPU architecture
• ESXi hypervisor 7.0U1 or higher
• 4 virtual CPUs per virtual connector (We recommend deployment with a 1:1 virtual CPU to physical core allocation to avoid CPU over contention which will cause packet loss.)
• 8 GB of RAM per virtual connector
• 8 GB of disk per virtual connector
• One vSwitch port group or VLAN with access to the Internet (for example, through a WAN)
• One or more vSwitch port group or VLAN that will be the internal LAN

Refer to VMware’s documentation Open external link for more information on how to install ESXi and configure a virtual machine.

​​ 1. Obtain the Virtual Connector image

Contact your account team at Cloudflare to obtain the Virtual Connector OVA package Open external link and license keys. The OVA image includes the files required to install and configure the virtual machine (VM) for Virtual Connector with the appropriate settings.

This image can be deployed multiple times to create several instances of a Virtual Connector, in different locations or on the same ESXi host.

You will consume one license key for each instance created. For example, if you want to deploy 10 Virtual Connectors you should request 10 license keys, and your account team will create 10 Connector instances in your Cloudflare dashboard.

​​ 2. Deploy the Virtual Connector on VMware

The following instructions assume you already have VMware ESXi hypervisor installed with sufficient resources. Refer to Prerequisites for more information.

1. When setting up your VMware ESXi, you need to create port groups for Virtual Connector. Go to Networking > Port groups, and prepare your vSwitch port groups and/or VLANs for your desired network topology. For example, a simple deployment typically has:

   • A WAN port group where the Virtual Connector will get an IP address (static or DHCP) that has access to the Internet.
   • A LAN port group, where the Virtual Connector will act as default router, and possibly DHCP server.
   • A null, or unused, port group for allocating unused virtual interfaces in the Virtual Connector. You can, for example, create a null port group with the name of Null port group, and a VLAN ID of 999.

2. Extract the files in the OVA image provided by your Cloudflare account team. For example:

   tar -xvf mconn-2024-1-3.ova

   Take note of the folder where you are extracting the files to, as you will need to refer to that folder when creating the VM.

3. Go to Virtual Machines > Create/Register VM wizard to start deploying the Virtual Connector.

4. Select Deploy a virtual machine from an OVF or OVA file > Next.

5. Choose a descriptive name for your virtual machine.

6. Upload the files you have extracted from the OVA image. These include mconn.ovf, mconn.nvram, and mconn.vmdk.

7. Select where you want to save the files extracted from the OVA image > Next.

8. In Networking mappings, select assignments for your desired topology according to the port groups you set up previously:

   1. For example, map eno1 port to VM Network to create your WAN, and eno2 to LAN0 to act as your LAN port.
   2. Allocate any unused ports to the null port group.
   3. Take note of your configuration. You will need this information to configure your network in the Cloudflare dashboard.

9. In Disk provisioning, select Thin.

10. Before completing the deployment wizard, disable Power on automatically. This is important so that you can configure the license key prior to boot.

11. Configure the virtual machine with the license key your account team provided you:

    1. Select the Virtual Connector’s VM > Settings.
    2. Go to VM Options > Advanced > Edit Configuration.
    3. Select Add parameter to add your license key. Scroll down to the last entry (this is where VMware adds the new parameter), and add the following two new entries:
       • Key: guestinfo.cloudflare.identity
       • Value: <YOUR_LICENCE_KEY>

12. Select Save to finish configuring your Virtual Connector.
13. Continue set up in your Cloudflare dashboard.

​​ 3. Set up Cloudflare dashboard

​​ 1. Create a site

Sites represent the local network where you have installed your Magic WAN Connector — for example, a branch office location.

You need to create a site and set up all the settings associated with it before you can connect your Magic WAN Connector to the Internet.

To add a site:

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/sites \
--header 'Content-Type: application/json' \
--header 'X-Auth-Email: <EMAIL>' \
--header 'X-Auth-Key: <API_KEY>' \
--data '{
  "site": {
    "description": "<SITE_DESCRIPTION>",
    "name": "<SITE_NAME>"
  }
}'

{
  "result": {
    "site": {
      "id": "<SITE_ID>",
      "name": "<SITE_NAME>",
      "description": "<SITE_DESCRIPTION>",
      "connector_id": null,
      "secondary_connector_id": null,
      "ha_mode": false
    }
  },
  "success": true,
  "errors": [],
  "messages": []
}

​​ 2. Create a WAN

1. In WAN configuration, select Create. You can create one or more wide area networks (WANs) Open external link . Configuring multiple WANs will create multiple IPsec tunnels. This allows the Connector to failover between circuits according to their health.
2. In Interface name, enter a descriptive name for your WAN.
3. Physical interface needs to correspond to the virtual network interface on the Virtual Connector instance you have set up in VMware. Following our example from the previous steps, you need to choose port 1 since that is what corresponds to the eno1 port we set up in VMware.
4. In VLAN ID, enter a number between 0 and 4094 to specify a VLAN ID.
5. In Priority, choose the priority for your WAN. Lower numbers have higher priority. Refer to Traffic steering to learn more about how Cloudflare calculates priorities.
6. Addressing: Specify whether the WAN IP is fetched from a DHCP server or if it is a static IP. If you choose a static IP, you also need to specify the static IP and gateway addresses.

7. Select Save when you are finished.

Create a POST request using the API Open API docs link to create a WAN.

The static_addressing object is optional. Omit it if you are using DHCP. If you are using static addressing, add the secondary_address parameter when your site is in high availability (HA) mode.

Example:

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/sites/{site_id}/wans \
--header 'Content-Type: application/json' \
--header 'X-Auth-Email: <EMAIL>' \
--header 'X-Auth-Key: <API_KEY>' \
--data '{
  "wan": {
    "description": "<YOUR_WAN_NAME>",
    "physport": 1,
    "priority": 0,
    "vlan_tag": 0
  }
}'

​​ 3. Create a LAN

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/sites/{site_id}/lans \
--header 'Content-Type: application/json' \
--header 'X-Auth-Email: <EMAIL>' \
--header 'X-Auth-Key: <API_KEY>' \
--data '{
  "lan": {
  "description": "<YOUR_LAN_NAME>",
  "physport": 2,
  "static_addressing": {
    "address": "172.16.14.0/24"
  },
  "vlan_tag": 0
}
}'

​​ Network segmentation

After setting up your LANs, you can configure your Connector to enable communication between them without traffic leaving your premises. Refer to Network segmentation for more information.

​​ DHCP options

Magic WAN Connector supports different types of DHCP configurations. Connector can:

• Connect to a DHCP server or use a static IP address instead of connecting to a DHCP server.
• Act as a DHCP server.
• Use DHCP relay to connect to a DHCP server outside the location your Magic WAN Connector is in.
• Reserve IP addresses for specific devices on your network.

Refer to DHCP options to learn more.

​​ 4. Activate Connector

Virtual Magic WAN Connector is deactivated after you install it, and will only establish a connection to the Cloudflare network when it is activated. Cloudflare recommends leaving it deactivated until you finish setting it up in the dashboard.

When the Connector is first activated, one of the ports must be connected to the Internet through a device that supports DHCP. This is required so that the Connector can reach the Cloudflare global network and download the required configurations that you set up in the site configuration step.

When you are ready to connect your Magic WAN Connector to the Cloudflare network:

1. Log in to the Cloudflare dashboard Open external link and select your account.
2. Go to Magic WAN > Configuration > Connectors.
3. Find the Connector you want to activate, select the three dots next to it > Edit. Make sure you verify the serial number to choose the right connector you want to activate.
4. In the new window, the Status dropdown will show as Deactivated. Select it to change the status to Activated.
5. The Interrupt window is the time period when the Magic WAN Connector software can update, which may result in interruption to existing connections. Choose a time period to minimize disruption to your sites. Refer to Interrupt window for more details on how to define when the Connector can update its systems.
6. Select Update.

​​ 5. Boot your Virtual Connector

1. Go to Virtual Machines in VMware, and boot up Virtual Connector’s VM.
2. The Virtual Connector will make a request to Cloudflare. This is the step where Virtual Connector registers your provided license key and downloads the site configuration for its connected site.
3. The Virtual Connector will set up the LAN and WAN connections according to the configuration downloaded from the site you created on the Cloudflare dashboard. The Virtual Connector will also establish IPsec tunnels.
4. If successful, the tunnel health checks will show as healthy.
5. If you do not see a healthy heartbeat the Cloudflare dashboard, reboot the Virtual Connector’s VM in VMware.

​​ IP sec tunnels and static routes

Magic WAN Connector automatically creates IPsec tunnels and static routes for you. You cannot configure these manually.

To check the IPsec tunnels and static routes created by your Magic WAN Connector:

1. Log in to the Cloudflare dashboard Open external link and select your account.
2. Go to Magic WAN > Sites.
3. Select the name of the site for which you want to check the Connector’s IPsec tunnels and static routes, and select Edit.
4. Select Tunnels to check IPsec tunnels, and Routes for the static routes.

​​ Next steps

• Network options
• Maintenance
• Reference information
• Troubleshooting