Skip to content

Commit 1817b6a

Browse files
Move configuration-options into other-products.mdx
1 parent d4a0ecb commit 1817b6a

File tree

2 files changed

+64
-3
lines changed

2 files changed

+64
-3
lines changed

src/content/docs/smart-shield/configuration/dedicated-egress-ips/index.mdx

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,9 @@ If you are interested in using Smart Shield Advanced with Dedicated CDN Egress I
1919

2020
With dedicated egress IPs, you can:
2121

22-
* Lock down your [network firewall](/aegis/configuration-options/network-firewall/) to only allow traffic from the your dedicated CDN egress IPs.
23-
* Use [Cloudflare Access](/aegis/configuration-options/access-cni/) to secure your applications without installing software or customizing code on your server.
24-
* Ensure only authorized [Workers](/aegis/configuration-options/workers/) can access your origin services.
22+
* Lock down your network firewall to only allow traffic from the your dedicated CDN egress IPs.
23+
* Use [Cloudflare Access](/smart-shield/configuration/dedicated-egress-ips/other-products/#access-and-cni) to secure your applications without installing software or customizing code on your server.
24+
* Ensure only authorized [Workers](/smart-shield/configuration/dedicated-egress-ips/other-products/#workers) can access your origin services.
2525

2626
## Scope
2727

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
---
2+
title: Use with other Cloudflare products
3+
pcx_content_type: reference
4+
sidebar:
5+
order: 9
6+
label: Other products
7+
---
8+
9+
Use Dedicated CDN Egress IPs in combination with different Cloudflare products.
10+
11+
## Access and CNI
12+
13+
You can use Dedicated CDN Egress IPs combined with [Cloudflare Network Interconnect (CNI)](/network-interconnect/) to secure your applications with [Cloudflare Access](/cloudflare-one/access-controls/policies/) without installing software or customizing code on your server.
14+
15+
While Access allows you to enforce policies at the hostname level, other solutions are usually necessary to protect against origin IP bypass — when an attacker knows your origin server IP and uses it to directly interact with the target application.
16+
17+
With Dedicated CDN Egress IPs, you only allow a small number of IPs (that are not publicly listed) through your network firewall. And with Cloudflare Network Interconnect, you can use a completely private path between Cloudflare and your application server, without exposure to the public Internet.
18+
19+
Dedicated CDN Egress IPs are included within [BGP advertisement over CNI](/network-interconnect/).
20+
21+
For details and background, refer to the [Cloudflare blog](https://blog.cloudflare.com/access-aegis-cni).
22+
23+
## Data Localization Suite
24+
25+
[Data Localization Suite (DLS)](/data-localization/) is an enterprise add-on that enables you to choose the location where Cloudflare encrypts, decrypts, and stores data.
26+
27+
To ensure egress will happen from DLS-specified locations, make sure you have Dedicated CDN Egress IPs provisioned in those locations. Refer to [IPs allocation](/smart-shield/configuration/dedicated-egress-ips/about/#ips-allocation) for details.
28+
29+
## Load Balancing
30+
31+
[Cloudflare Load Balancing](/load-balancing/) allows you to intelligently distribute traffic across your origins by issuing regular monitors (that assess origin health) and following the traffic steering policies you define.
32+
33+
By default, the Load Balancing monitors will use public Cloudflare IP addresses.
34+
35+
To avoid inconsistencies between what the Load Balancing monitors report and what you observe in service traffic with Dedicated CDN Egress IPs, make sure to turn on the **Simulate Zone** option in the [monitor settings](/load-balancing/monitors/create-monitor/#create-a-monitor).
36+
37+
## Spectrum
38+
39+
[Spectrum](/spectrum/) allows you to route email, file transfer, games, and more over TCP or UDP through Cloudflare. This means you can mask your origin and protect it from DDoS attacks.
40+
41+
While you can use [BYOIP](/byoip/) or static IPs to control which IPs are used for ingress with Spectrum, Dedicated CDN Egress IPs allows you to have a more strict list of [egress IPs](/smart-shield/configuration/dedicated-egress-ips/about/#egress-ips) as well.
42+
43+
Dedicated CDN Egress IPs with Spectrum supports both TCP and UDP application types. HTTP/HTTPS types are also supported, although through a different configuration.
44+
45+
If you are interested in any of these solutions, contact your account team.
46+
47+
## Workers
48+
49+
[Workers](/workers/) provides a serverless execution environment for you to create applications leveraging Cloudflare's global network.
50+
51+
Refer to the sections below for information on how Dedicated CDN Egress IPs pair up with Workers.
52+
53+
### `fetch`
54+
55+
[`fetch()` requests](/workers/runtime-apis/fetch/) that access services on your origin will use Dedicated CDN Egress IP addresses.
56+
57+
Workers subrequests — requests from one Worker to another — are expected to use different IPs. However, [`fetch()` requests](/workers/runtime-apis/fetch/) to external origins made by a Worker invoked via a subrequest will use Dedicated CDN Egress IP addresses.
58+
59+
### `connect`
60+
61+
For [`connect()` requests](/workers/runtime-apis/tcp-sockets/) - which create outbound TCP connections from Workers - Dedicated CDN Egress IPs are **not** used.

0 commit comments

Comments
 (0)