|
| 1 | +--- |
| 2 | +title: Use with other Cloudflare products |
| 3 | +pcx_content_type: reference |
| 4 | +sidebar: |
| 5 | + order: 9 |
| 6 | + label: Other products |
| 7 | +--- |
| 8 | + |
| 9 | +Use Dedicated CDN Egress IPs in combination with different Cloudflare products. |
| 10 | + |
| 11 | +## Access and CNI |
| 12 | + |
| 13 | +You can use Dedicated CDN Egress IPs combined with [Cloudflare Network Interconnect (CNI)](/network-interconnect/) to secure your applications with [Cloudflare Access](/cloudflare-one/access-controls/policies/) without installing software or customizing code on your server. |
| 14 | + |
| 15 | +While Access allows you to enforce policies at the hostname level, other solutions are usually necessary to protect against origin IP bypass — when an attacker knows your origin server IP and uses it to directly interact with the target application. |
| 16 | + |
| 17 | +With Dedicated CDN Egress IPs, you only allow a small number of IPs (that are not publicly listed) through your network firewall. And with Cloudflare Network Interconnect, you can use a completely private path between Cloudflare and your application server, without exposure to the public Internet. |
| 18 | + |
| 19 | +Dedicated CDN Egress IPs are included within [BGP advertisement over CNI](/network-interconnect/). |
| 20 | + |
| 21 | +For details and background, refer to the [Cloudflare blog](https://blog.cloudflare.com/access-aegis-cni). |
| 22 | + |
| 23 | +## Data Localization Suite |
| 24 | + |
| 25 | +[Data Localization Suite (DLS)](/data-localization/) is an enterprise add-on that enables you to choose the location where Cloudflare encrypts, decrypts, and stores data. |
| 26 | + |
| 27 | +To ensure egress will happen from DLS-specified locations, make sure you have Dedicated CDN Egress IPs provisioned in those locations. Refer to [IPs allocation](/smart-shield/configuration/dedicated-egress-ips/about/#ips-allocation) for details. |
| 28 | + |
| 29 | +## Load Balancing |
| 30 | + |
| 31 | +[Cloudflare Load Balancing](/load-balancing/) allows you to intelligently distribute traffic across your origins by issuing regular monitors (that assess origin health) and following the traffic steering policies you define. |
| 32 | + |
| 33 | +By default, the Load Balancing monitors will use public Cloudflare IP addresses. |
| 34 | + |
| 35 | +To avoid inconsistencies between what the Load Balancing monitors report and what you observe in service traffic with Dedicated CDN Egress IPs, make sure to turn on the **Simulate Zone** option in the [monitor settings](/load-balancing/monitors/create-monitor/#create-a-monitor). |
| 36 | + |
| 37 | +## Spectrum |
| 38 | + |
| 39 | +[Spectrum](/spectrum/) allows you to route email, file transfer, games, and more over TCP or UDP through Cloudflare. This means you can mask your origin and protect it from DDoS attacks. |
| 40 | + |
| 41 | +While you can use [BYOIP](/byoip/) or static IPs to control which IPs are used for ingress with Spectrum, Dedicated CDN Egress IPs allows you to have a more strict list of [egress IPs](/smart-shield/configuration/dedicated-egress-ips/about/#egress-ips) as well. |
| 42 | + |
| 43 | +Dedicated CDN Egress IPs with Spectrum supports both TCP and UDP application types. HTTP/HTTPS types are also supported, although through a different configuration. |
| 44 | + |
| 45 | +If you are interested in any of these solutions, contact your account team. |
| 46 | + |
| 47 | +## Workers |
| 48 | + |
| 49 | +[Workers](/workers/) provides a serverless execution environment for you to create applications leveraging Cloudflare's global network. |
| 50 | + |
| 51 | +Refer to the sections below for information on how Dedicated CDN Egress IPs pair up with Workers. |
| 52 | + |
| 53 | +### `fetch` |
| 54 | + |
| 55 | +[`fetch()` requests](/workers/runtime-apis/fetch/) that access services on your origin will use Dedicated CDN Egress IP addresses. |
| 56 | + |
| 57 | +Workers subrequests — requests from one Worker to another — are expected to use different IPs. However, [`fetch()` requests](/workers/runtime-apis/fetch/) to external origins made by a Worker invoked via a subrequest will use Dedicated CDN Egress IP addresses. |
| 58 | + |
| 59 | +### `connect` |
| 60 | + |
| 61 | +For [`connect()` requests](/workers/runtime-apis/tcp-sockets/) - which create outbound TCP connections from Workers - Dedicated CDN Egress IPs are **not** used. |
0 commit comments