Skip to content
Cloudflare Docs

Configure hardware Connector

Prerequisites

You need to purchase Magic WAN before you can purchase and use the Magic WAN Connector. The Magic WAN Connector can function as your primary edge device for your network, or be deployed in-line with existing network gear.

You also need to purchase a Magic WAN Connector before you can start configuring your settings in the Cloudflare dashboard. After buying a Magic WAN Connector, the device will be registered with your Cloudflare account and show up in your Cloudflare dashboard.

Contact your account representative to learn more about purchasing options for the Magic WAN Connector device.

Before you begin

You can install up to two Magic WAN Connectors for redundancy at each of your sites. If one of your Connectors fail, traffic will fail over to the other Connector ensuring that you never lose connectivity to that site.

In this type of high availability (HA) configuration, you will choose a reliable LAN interface as the HA link which will be used to monitor the health of the peer connector. HA links can be dedicated links or can be shared with other LAN traffic.

You must decide the type of configuration you want for your site from the beginning: no redundancy or with redundancy. You cannot add redundancy after finishing configuring your dashboard settings. If, at a later stage, you decide to enable redundancy, you will need to delete your Connector on-ramp in the Cloudflare dashboard, and start again.

Do you need a high availability configuration?

DHCP vs static IP connections

At first boot, Magic WAN Connector needs to reach out to Cloudflare to download your settings and go through the activation process. If any of the networks plugged into your Connector are DHCP enabled, does not use a VLAN, and have an Internet connection, that process is handled automatically. However, if all of the networks require more information to utilize, (such as a network with static IPs, or tagged VLAN networks) your Magic WAN Connector might need some more information to proceed. There are couple of ways to provide that information. Choose the one that fits your workflow:

Option one - Activate on a DHCP Network

  1. Connect Magic WAN Connector to a DHCP port with access to the Internet.
  2. Go through the setup flow below and activate your Connector.
  3. Refer to WAN with a static IP address.

Option two - Bootstrap via Serial Console

Refer to the Bootstrap workflow.

Port speeds

The hardware version of the Magic WAN connector includes two SFP+ ports that support 10G throughput, as well as six RJ45 ports that support 1G throughput.

Refer to SFP+ port information for details on this topic.

Set up Cloudflare dashboard

1. Add a Connector on-ramp

You need to add your Connector to your Cloudflare dashboard and configure its settings before connecting it to the Internet.

To add a Connector on-ramp:

  1. Log in to the Cloudflare dashboard ↗ and select your account.
  2. Go to Magic WAN > Connector on-ramps (beta).
  3. Select Add.
  4. In Name, enter a descriptive name for your Connector. Optionally, you can also add a description for it.
  5. You need to decide if you want to turn on high availability for the Connector. Refer to About high availability configurations for more information.
  6. Select Create and continue.
  7. Select Add Connector. This will show you a list of Magic WAN Connector devices associated with your account. You need to have bought a Connector already for it to show up here. Refer to Prerequisites if no Connector shows up in this list.
  8. If you have more than one Connector, choose the one that corresponds to the on-ramp you are creating. Connectors are identified by a serial number, also known as a service tag. Use this information to choose the right Connector. Select Select Connector when you are ready to proceed.
  9. The Connector will be added to your account with an Interrupt window defined. The interrupt window is the time period when the Magic WAN Connector software can update, which may result in interruption to existing connections. You can change this later. Refer to Interrupt window for more details on how to define when the Connector can update its systems.
  10. Select Continue to proceed to creating your WAN and LAN networks.

2. Create a WAN

  1. In WAN configuration, select Create. You can create one or more wide area networks (WANs) ↗. Configuring multiple WANs will create multiple IPsec tunnels (one IPsec tunnel per WAN port). This allows the Connector to failover between circuits according to their health.
  2. In Interface name, enter a descriptive name for your WAN.
  3. Interface number refers to the physical Magic WAN Connector Ethernet port that you are using for your WAN. The ports are labeled GE1, GE2, GE3, GE4, GE5, and GE6. Choose the number corresponding to the port that you are using in Connector.
    If you need a throughput higher than 1 Gbps, you can use one of the SFP+ ports. Refer to SFP+ port information for more information on the hardware supported.
  4. In VLAN ID, enter a number between 0 and 4094 to specify a VLAN ID.
  5. In Priority, choose the priority for your WAN. Lower numbers have higher priority. Refer to Traffic steering to learn more about how Cloudflare calculates priorities.
  6. In Health check rate configure the health check frequency for your site. Options are low, mid, and high. Refer to Update tunnel health checks frequency for more information.
  7. Addressing: Select DHCP. This is needed the first time you set up your Connector to successfully download all settings to the machine and activate it. If you need a static IP address in your network environment:
    1. Continue the set up flow below to activate your Connector.
    2. Refer to WAN with a static IP address. If you choose a static IP, you also need to specify the static IP and gateway addresses.

An example of how to configure you Magic WAN Connector WAN

  1. Select Save when you are finished.

3. Create a LAN

  1. In LAN configuration, select Create.
  2. Enter a descriptive name for your LAN in Interface name.
  3. Interface number refers to the physical Magic WAN Connector Ethernet port that you are using for your LAN. The ports are labeled GE1, GE2, GE3, GE4, GE5, and GE6. Choose a number corresponding to the port that you are using in Connector.
    If you need a throughput higher than 1 Gbps, you can use one of the SFP+ ports. Refer to SFP+ port information for more information on the hardware supported.
  4. In VLAN ID, specify a VLAN ID to create virtual LANs.
  5. In Static addressing > Static address give your Connector's LAN interface its IP address. You can also enable the following options if they suit your use case:
    • This is a DHCP server: If your Connector is a DHCP server.
    • This is a DHCP relay: If your Connector is a DHCP relay.
  6. (Optional) In Directly attached subnet > Static NAT prefix, enter a CIDR prefix to enable NAT (network address translation). The prefix you enter here should be the same size as the prefix entered in Static addressing. For example, both networks have a subnet mask of /24: 192.168.100.0/24 and 10.10.100.0/24.
  7. (Optional) If your LAN contains additional subnets behind a layer 3 router, select Add routed subnet under Routed subnets to add them:
    • Prefix: The CIDR prefix for the subnet behind the L3 router.
    • Next hop: The address of the L3 router to which the Connector should forward packets for this subnet.
    • Static NAT prefix: Optional setting. If you want to enable NAT for a routed subnet, supply an "external" prefix for the overlay-facing side of the NAT to use. It must be the same size as Prefix.
      Refer to Routed subnets for more information.
  8. Select Save.
  9. Select Done to finish your configuration. Tunnels and static routes will be automatically created for your Magic WAN Connector, once it boots up.

Network segmentation

After setting up your LANs, you can configure your Connector to enable communication between them without traffic leaving your premises. Refer to Network segmentation for more information.

DHCP options

Magic WAN Connector supports different types of DHCP configurations. Connector can:

  • Connect to a DHCP server or use a static IP address instead of connecting to a DHCP server.
  • Act as a DHCP server.
  • Use DHCP relay to connect to a DHCP server outside the location your Magic WAN Connector is in.
  • Reserve IP addresses for specific devices on your network.

Refer to DHCP options to learn more.

4. Add your Connector to a site

After finishing your Connector configuration, you need to add it to a site.

Sites represent the local network of a data center, office, or other physical location, and combine all on-ramps available there. Sites also allow you to check, at a glance, the state of your on-ramps and set up health alert settings so that you get notified when there are issues with the site's on-ramps.

Refer to Set up a site for more information.

Set up your Magic WAN Connector

Device installation

There are several deployment options for Magic WAN Connector. Connector can act like a DHCP server for your local network, or integrate with your local setup and have static IP addresses assigned to it.

When Connector acts like the WAN router for your site, deployment will be something like this:

flowchart LR
	accTitle: Magic WAN Connector set up as a DHCP server, and connecting to the Internet.
  a(Magic WAN Connector)--> b(Internet) --> c(Cloudflare)

  subgraph Customer site
  d[LAN 1] --> a
  e[LAN 2] --> a
  end

  classDef orange fill:#f48120,color: black
  class a,c orange

In the example below, the Connector sits behind the WAN router in your site, and on-ramps only some of the existing LANs to Cloudflare.

flowchart LR
	accTitle: Magic WAN Connector connects to the router in the site, and only some of the LANs connect to Connector.
  a(Magic WAN Connector)--> b((Site's router)) --> c(Internet) --> i(Cloudflare)

  subgraph Customer site
  d[LAN 1] --> a
  e[LAN 2] --> a
  g(LAN 3) --> b
  h(LAN 4) --> b
  end

  classDef orange fill:#f48120,color: black
  class a,i orange

Refer to Magic WAN Connector deployment options for a high-level explanation of the deployment options that make sense to most environments, as well as a few advanced use cases.

Firewall settings required

If there is a firewall deployed upstream of the Magic WAN Connector, configure the firewall to allow the following traffic:

Protocol/port Destination IP/URL Purpose
UDP/53 DNS destination IP 1.1.1.1 Needed to allow DNS traffic to Cloudflare DNS servers. Cloudflare uses this port for DNS lookups of control plane API.
TCP/443 - The Connector will open outbound HTTPS connections over this port for control plane operations.
UDP/4500 Destination IP 162.159.64.1 Needed for Connector's initialization and discovery traffic through outbound connections.
UDP/4500 Destination IP - Cloudflare anycast IPs Needed for the Cloudflare anycast IPs assigned to your account for tunnel outbound connections. This traffic is tunnel traffic.
TCP/7844, UDP/7844 Outbound connections This is for debugging facilities in the Connector.
UDP/123 http://time.cloudflare.com/ Needed for Magic WAN Connector to periodically contact Cloudflare's Time Services.

Activate Connector

The Magic WAN Connector is shipped to you deactivated, and will only establish a connection to the Cloudflare network when it is activated. Cloudflare recommends leaving it deactivated until you finish setting it up in the dashboard.

When the Connector is first activated, you need to have Internet connection. If you chose to set up your Connector with DHCP you will need to have one of the Connector ports connected to the Internet through a device that supports DHCP. This is required so that the Connector can reach the Cloudflare global network and download the required configurations that you set up.

If you set up your Connector with a static IP through the bootstrap method, you do not need a DHCP port. Refer to DHCP vs static IP connections for more information.

When you are ready to connect your Magic WAN Connector to the Cloudflare network:

  1. Log in to the Cloudflare dashboard ↗ and select your account.
  2. Go to Magic WAN > Configuration > Connectors.
  3. Find the Connector you want to activate, select the three dots next to it > Edit. Make sure you verify the serial number to choose the right connector you want to activate.
  4. In the new window, the Status dropdown will show as Deactivated. Select it to change the status to Activated.
  5. The Interrupt window is the time period when the Magic WAN Connector software can update, which may result in interruption to existing connections. Choose a time period to minimize disruption to your sites. Refer to Interrupt window for more details on how to define when the Connector can update its systems.
  6. Select Update.

WAN with a static IP address

After activating your Connector, you can use it in a network configuration with the WAN interface set to a static IP address — that is, an Internet configuration that is not automatically set by DHCP. To use your Connector on a network configuration with a static IP, follow the steps below.

  1. Connect Magic WAN Connector to a DHCP port with access to the Internet.
  2. Add a Connector on-ramp in the Cloudflare dashboard.
  3. Create a DHCP WAN.
  4. Activate and power on your Connector.
  5. Wait 60 seconds.
  6. Make changes to the WAN settings in the Cloudflare dashboard to a static IP set up.
  7. Wait 60 seconds again.
  8. Magic WAN Connector will go offline. This is normal and expected behavior.
  9. Adjust your physical connections as required to match the static configuration.
  10. Magic WAN Connector comes back online.

Bootstrap via Serial Console

Advanced users can locally configure their Magic WAN Connector to work in a static IP configuration. This local method does not require having access to a DHCP Internet connection. However, it does require being comfortable with using tools to access the serial port on Magic WAN Connector as well as using a serial terminal client to access the Connector's environment.

Below is a detailed description of how to use the serial port to configure your Magic WAN Connector locally.

Equipment required

To access the serial port on Magic WAN Connector you will need the following equipment:

  • The Magic WAN Connector appliance
  • A Phillips-head screwdriver
  • A micro-USB to USB-A cable (there should be one included in the packaging of your Connector)
  • A computer with an available USB port
  • A serial terminal client
  • Optional: if needed, a USB-A to USB-C converter dongle if your computer requires it

1. Access Magic WAN Connector's serial port

  1. Using the Phillips screwdriver, loosen the screw covering the serial console panel on the back of the Magic WAN Connector and turn the panel out of the way.
    1. Pictures and more instructions can be found on Dell's Technical Documents.
  2. Connect your computer to the Magic WAN Connector using the USB cable.

Default password to access Connector

Your Connector's default password is the serial number (also known as a Service Tag for Dell devices), all uppercase followed by an "!" (for example, A1B2C3D!)

2. Install a serial terminal client

To access Magic WAN Connector's environment you need a serial terminal client. Follow the instructions below to install one, based on your operating system.

Windows

Cloudflare recommends using PuTTY for Windows. Download PuTTY from the official website and then install it.

  1. Check the COM port of the USB to UART device in the Windows Device Manager. It should show up as something similar to Silicon Labs CP210x USB to UART Bridge (COMX).
  2. Take note of the value in the parentheses (COMX).
    1. Refer to the Dell Documentation Page for more details on creating a serial console connection.
  3. Launch PuTTY.
  4. Under Category, make sure that Session (the first item) is selected.
  5. Under Connection type, select Serial.
  6. In the Serial Line, type in the COM port found in step 2 (for example, COM1).
  7. In the Speed, enter 115200.
  8. Select Open on the bottom of the dialog box. A terminal window should pop up.
  9. The screen may need to be manually refreshed when a new device is connected. You can do that by pressing CTRL + C.

macOS

Cloudflare recommends installing Screen for macOS. You can install Screen via brew install screen. If you do not have brew installed, follow the instructions on Brew's Official Website to install it.

  1. Open the macOS Terminal.
  2. Run ls /dev/cu.* to list the connected serial devices.
  3. The command should return an output similar to /dev/cu.usbserial-0001. Copy this output to the clipboard or note this down somewhere else.
  4. Run sudo screen -adRUS <PATH_FROM_STEP_3> 115200.
  5. The screen may need to be manually refreshed when a new device is connected. You can do that by pressing CMD + C.

Linux

Cloudflare recommends installing Screen for Linux. You can install Screen via your package manager of choice. For example, for Debian/Ubuntu, install by running sudo apt update && sudo apt install screen

  1. Open Terminal.
  2. List the connected serial devices by running ls /dev/serial/by-id/*.
  3. The command should return an output similar to /dev/serial/by-id/usb-Silicon_Labs_CP2102_USB_to_UART_Bridge_Controller_0001-if00-port0. Copy this to the clipboard or note this down.
  4. Run sudo screen -adRUS <THE PATH FROM STEP 3>; 115200.
  5. The screen may need to be manually refreshed when a new device is connected. You can do that by pressing CTRL + C.

3. Configure a static IP on Magic WAN Connector

  1. Log into the Connector.
    1. You will be prompted to change your password if you attempt to log in with the default password.
  2. From the menu, go to Bootstrap with the arrow keys and select it with the Enter key.
  3. Select the Jack (physical port) you want to configure for the initialization of the connector.
  4. Enter the VLAN tag (if applicable) of the network. Leave it blank if untagged.
  5. Select whether the network is DHCP or static.
  6. Enter the IP address you would like the connector to have in CIDR form (for example, 10.0.0.2/24).
  7. Enter the IP address of the Internet gateway (this must be in the same subnet as the previous IP address you entered and must not be the same address).
  8. Select Save and confirm that you want to use the new settings.
  9. The Connector will download the rest of the settings from Cloudflare. The last heartbeat of the Connector should update once it has made contact with Cloudflare.

About high availability configurations

You need to deploy two Connectors in your premises before you can set up a site in high availability. When you set up a site in high availability, the WANs and LANs in your Connectors have the same configuration but are replicated on two nodes. In case of failure of a Connector, the other Connector becomes the active node, taking over configuration of the LAN gateway IP and allowing traffic to continue without disruption.

Because Connectors in high availability configurations share a single site, you need to set up:

  • Static address: The IP for the primary node in your site.
  • Secondary static address: The IP for the secondary node in your site.
  • Virtual static address: The IP that the LAN south of the Connector will forward traffic to, which is the LAN's gateway IP.

Make sure all IPs are part of the same subnet.

For detailed information about the expected behavior of high availability configurations, refer to High availability configurations.

Create a high availability configuration

You cannot enable high availability for an existing site. To add high availability to an existing site in the Cloudflare dashboard, you need to delete the site and start again.

To set up a high availability configuration:

  1. Follow the steps in Add a Connector on-ramp up until step 4.
  2. After naming your site, select Turn on high availability.
  3. Select Create and continue.
  4. Select Add Connector.
  5. From the list, choose your first Connector > Add Connector.
  6. Back on the previous screen, select Add secondary Connector.
  7. From the list, choose your second Connector > Add Connector.
  8. Select Continue to Create a WAN. If you are configuring a static IP, configure the IP for the primary node as the static address, and the IP for the secondary node as the secondary static address.
  9. To create a LAN, follow the steps mentioned above in Create a LAN up until step 4.
  10. In Static address, enter the IP for the primary node in your site. For example, 192.168.10.1/24.
  11. In Secondary static address, enter the IP for the secondary node in your site. For example, 192.168.10.2/24.
  12. In Virtual static address, enter the IP that the LAN south of the Connector will forward traffic to. For example, 192.168.10.3/24.
  13. Select Save.
  14. From the High availability probing link drop-down menu, select the port that should be used to monitor the node's health. Cloudflare recommends you choose a reliable interface as the HA probing link. The primary and secondary node's probing link should be connected over a switch, and cannot be a direct connection.
  15. Follow the instructions in Set up your Magic WAN Connector and Activate Connector to finish setting up your Connectors.

IPsec tunnels and static routes

Magic WAN Connector automatically creates IPsec tunnels and static routes for you. You cannot configure these manually.

To check the IPsec tunnels and static routes created by your Magic WAN Connector:

  1. Log in to the Cloudflare dashboard ↗ and select your account.
  2. Go to Magic WAN > Sites.
  3. Select the name of the site for which you want to check the Connector's IPsec tunnels and static routes, and select Edit.
  4. Select Tunnels to check IPsec tunnels, and Routes for the static routes.

Next steps