Configure routes

Note

If you are connecting to Cloudflare via a Direct CNI connection, refer to BGP peering to learn how to take advantage of this routing ↗ protocol. If not, continue reading.

Magic Transit uses a static configuration to route your traffic through anycast tunnels from Cloudflare's global network to your locations.

You must assign a route priority to each tunnel-subnet pair in your configuration, as follows:

• Lower values have greater priority.
• When the priority values for prefix entries match, Cloudflare uses equal-cost multi-path (ECMP) packet forwarding to route traffic. For more on how Cloudflare uses ECMP packet forwarding, refer to Traffic steering.

You can also create and edit static routes using the Magic Static Routes API.

Edge routing configuration example

Prefix	NextHop	Priority
10.10.10.100/24	TUNNEL_1_IAD	100
10.10.10.100/24	TUNNEL_2_IAD	100
10.10.10.100/24	TUNNEL_3_ATL	100
10.10.10.100/24	TUNNEL_4_ATL	100
10.10.10.100/24	TUNNEL_1_IAD	200
10.10.10.100/24	TUNNEL_2_IAD	200
10.10.10.100/24	TUNNEL_3_ATL	100
10.10.10.100/24	TUNNEL_4_ATL	100

Optionally, you can assign weights to distribute traffic more effectively among multiple tunnels. The weight values determine the proportion of traffic directed to each tunnel, with higher weights resulting in a greater share of traffic. The maximum weight value is 256.

In the example below, TUNNEL_2_IAD is likely to receive twice as much traffic as TUNNEL_1_IAD.

Prefix	NextHop	Priority	Weight
10.10.10.100/24	TUNNEL_1_IAD	100	64
10.10.10.100/24	TUNNEL_2_IAD	100	128
10.10.10.100/24	TUNNEL_3_ATL	100	192
10.10.10.100/24	TUNNEL_4_ATL	100	255

Map route prefixes smaller than /24

You must provide your prefixes and the tunnels that should be mapped to for Cloudflare to route your traffic from our global network to your data centers via anycast tunnels. Use the table below as reference.

Prefix	NextHop
103.21.244.0/29	TUNNEL_1_IAD
103.21.244.8/29	TUNNEL_2_ATL

The minimum advertising prefix is /24, but because Cloudflare uses anycast tunnels as an outer wrapper for your traffic, we can route prefixes within that /24 to different tunnel endpoints. For example, you can send x.x.x.0/29 to Data Center 1 and x.x.x.8/29 to Data Center 2. This is helpful when you operate in an environment with constrained IP resources.

Map routes prefixes bigger than onboarded prefixes

If you have multiple onboarded /24 subnets that belong to a larger contiguous block, you can configure a summary static route for the corresponding supernet (like a /23 or a /22) instead of adding each /24 individually. This eliminates the need to configure each /24 route individually, as all traffic will be routed through the same GRE tunnels.

For example, if you have two tunnels:

• 192.0.2.0/24
• 192.0.3.0/24

You can summarize these into a single 192.0.2.0/23.

Refer to Add tunnels to learn more about configuring GRE tunnels.

Note

These address blocks are a part of RFC 5737 and are reserved for use as examples in documentation.

Scoped routes for anycast GRE or IPsec tunnels

To reduce latency for your anycast GRE or IPsec tunnel configurations, especially if you operate your own anycast network, Cloudflare can steer your traffic by scoping it to specific Cloudflare data center regions. Equal cost routes maintain an equal cost on a global scale so long as the routes are not scoped to specific regions. For example, if you use region-scoped routes, traffic from end users in New York will always land at their Ashburn network unless that tunnel is unhealthy.

When you scope static routes to specific regions, the routes will only exist in the specified regions, and traffic that lands outside the specified regions will not have anywhere to go.

To configure scoping for your traffic, you must provide static routes to Cloudflare with anycast GRE or IPsec tunnel data such that all Cloudflare regions have a route for your prefixes.

Note

Regions and regional objects are automatically updated. If you route traffic through specific data centers, you will need to manually update your rules when Cloudflare adds or removes data centers.

Scoping configuration data example

Prefix	NextHop	Priority	Region code
10.10.10.100/24	TUNNEL_1_IAD	100	AFR
10.10.10.100/24	TUNNEL_2_IAD	100	EEUR
10.10.10.100/24	TUNNEL_3_ATL	100	ENAM
10.10.10.100/24	TUNNEL_4_ATL	100	ME

Region codes and associated regions

Cloudflare has nine geographic regions across the world which are listed below.

Region code	Region
AFR	Africa
APAC	Asia Pacific
EEUR	Eastern Europe
ENAM	Eastern North America
ME	Middle East
OC	Oceania
SAM	South America
WEUR	Western Europe
WNAM	Western North America

Configure scoping for your traffic in the Region code section when adding or editing a static route. Refer to Create a static route and Edit a static route more information.

Allowed IP ranges

Allowed IP ranges for static routes are:

• Cloudflare leased IPs assigned to your account
• BYOIP prefixes. For BYOIP, you have the option to use them as-is, or to create a summary route to cover all your onboarded prefixes.

Create a static route

Dashboard

1. Log in to the Cloudflare dashboard ↗, and select your account.
2. Go to Magic Transit > Configuration.
3. From the Routes tab, select Create to add a new route.
4. Enter a descriptive name for your route in Description.
5. In Prefix, enter your range of IP addresses. For example, 10.10.10.100/24.
6. In Tunnel/Next hop select which tunnel you want your route to go through. Choose from the tunnels you have created in Configure tunnel endpoints.
7. Choose the Priority for your route. Lower numbers have higher priorities.
8. (Optional) Choose a Weight for your route. Refer to Edge routing configuration example for examples.
9. (Optional) If you need to scope your route to a specific region, you can do it in Region code.
10. (Optional) We highly recommend testing your route before adding it by selecting Test routes.
11. Select Add routes when you are done.

API

Note

You will need your account ID and API Key to use the API.

Create a POST request using the API to create one or more static routes.

Example:

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/routes \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
  "routes": [
    {
      "description": "New route for new prefix",
      "prefix": "<YOUR_IP_PREFIX>",
      "nexthop": "<IP_NEXT_HOP>",
      "priority": <PRIORITY>,
      "scope": {
        "colo_names": [
          "<NAME_OF_CLOUDFLARE_SERVER>"
        ],
        "colo_regions": [
          "<NAME_OF_REGION>"
        ]
      },
      "weight": <WEIGHT>
    }
  ]
}'

Edit a static route

Dashboard

1. In Routes, select Edit next to the route you want to modify.
2. Enter the updated route information.
3. (Optional) We highly recommend testing your route before adding it by selecting Test routes.
4. Select Edit routes to save the new information when you are done.

API

Note

You will need your account ID and API Key to use the API.

Create a PUT request using the API to update one or more static routes.

Example:

curl --request PUT \
https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/routes \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
  "routes": [
    {
      "description": "New route for new prefix",
      "nexthop": "<IP_NEXT_HOP>",
      "prefix": "<YOUR_IP_PREFIX>",
      "priority": <PRIORITY>,
      "scope": {
        "colo_names": [
          "<NAME_OF_CLOUDFLARE_SERVER>"
        ],
        "colo_regions": [
          "<NAME_OF_REGION>"
        ]
      },
      "weight": <WEIGHT>
    }
  ]
}'

Delete static route

Dashboard

1. In Routes, locate the static route you want to modify and select Delete.
2. Confirm the action by selecting the checkbox and select Delete.

API

Note

You will need your account ID and API Key to use the API.

Create a DELETE request using the API to delete a static route.

Example:

curl --request DELETE \
https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/routes/{route_id} \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>"