|
| 1 | +--- |
| 2 | +title: Use BYOIP with CDN and Spectrum |
| 3 | +pcx_content_type: tutorial |
| 4 | +sidebar: |
| 5 | + order: 4 |
| 6 | + label: CDN and Spectrum |
| 7 | +--- |
| 8 | + |
| 9 | +import { Render, APIRequest, Details, Example, TabItem, Tabs, GlossaryTooltip } from "~/components"; |
| 10 | + |
| 11 | + With [service bindings](/byoip/service-bindings/), CDN[^1] customers using BYOIP can take the same prefix they have onboarded to Cloudflare and use it to selectively route traffic on a per-IP address basis to [Spectrum](/spectrum/)[^2], or vice versa. This means: |
| 12 | + |
| 13 | +- You can upgrade individual IPs within a CDN prefix to a Spectrum IP. For example, if you have a CDN prefix 203.0.113.0/24, you can upgrade 203.0.113.1 to Spectrum. |
| 14 | + |
| 15 | +- You can upgrade individual IPs within a Spectrum prefix to a CDN IP. For example, if you have a Spectrum prefix 203.0.113.0/24, you can upgrade 203.0.113.1 to CDN. |
| 16 | + |
| 17 | +This guide will use the first example and consider a prefix that was onboarded to the CDN, with a few IPs upgraded to Spectrum. |
| 18 | + |
| 19 | +## Before you begin |
| 20 | + |
| 21 | +<Render |
| 22 | +file="service-bindings-prereqs" |
| 23 | +params={{ |
| 24 | + pre_existing_product: "CDN", |
| 25 | + added_product: "Spectrum" |
| 26 | +}} |
| 27 | +/> |
| 28 | + |
| 29 | +--- |
| 30 | + |
| 31 | +## Prepare your IPs |
| 32 | + |
| 33 | +### 1. Get account information |
| 34 | + |
| 35 | +<Render |
| 36 | +file="service-bindings-account-info" |
| 37 | +params={{ |
| 38 | + pre_existing_product: "CDN", |
| 39 | + added_product: "Spectrum" |
| 40 | +}} |
| 41 | +/> |
| 42 | + |
| 43 | +### 2. Create service bindings |
| 44 | + |
| 45 | +<Render |
| 46 | +file="service-bindings-create-binding" |
| 47 | +params={{ |
| 48 | + pre_existing_product: "CDN", |
| 49 | + added_product: "Spectrum" |
| 50 | +}} |
| 51 | +/> |
| 52 | + |
| 53 | +### 3. Verify all service bindings |
| 54 | + |
| 55 | +After the propagation time (four to six hours), the [List Service Bindings](/api/resources/addressing/subresources/prefixes/subresources/service_bindings/methods/get/) endpoint should return all service bindings that are part of the prefix - in this case, CDN and Spectrum. |
| 56 | + |
| 57 | +<APIRequest |
| 58 | +path="/accounts/{account_id}/addressing/prefixes/{prefix_id}/bindings" |
| 59 | +method="GET" |
| 60 | +/> |
| 61 | + |
| 62 | +--- |
| 63 | + |
| 64 | +## Set up your Cloudflare services |
| 65 | + |
| 66 | +### CDN |
| 67 | + |
| 68 | +If you already use BYOIP with CDN, you might be able to skip this step. However, if you are using this guide to upgrade a few IPs from a Spectrum prefix to the CDN, consider the following sections on [address maps](#address-maps) and [DNS records](#dns-records). |
| 69 | + |
| 70 | +:::note |
| 71 | +As described below, address maps and DNS records do not apply to Spectrum. To set up your Spectrum application with BYOIP, refer to [Spectrum](#spectrum). |
| 72 | +::: |
| 73 | + |
| 74 | +#### Address maps |
| 75 | + |
| 76 | +Use <GlossaryTooltip term="address map" link="/byoip/address-maps/">address maps</GlossaryTooltip> to specify which IPs should be used by Cloudflare in DNS responses when a record is <GlossaryTooltip term="proxy status" link="/dns/proxy-status/">proxied</GlossaryTooltip>. |
| 77 | + |
| 78 | +You can choose between two different scopes: |
| 79 | + |
| 80 | +- Account-level: uses the address map for all proxied DNS records across all of the zones within an account. |
| 81 | +- Zone-level: uses the address map for all proxied DNS records within a zone. |
| 82 | + |
| 83 | +:::note |
| 84 | +If you need to map only specific subdomains (and not all proxied DNS records) to specific IP addresses, you can use a [Subdomain setup](/dns/zone-setups/subdomain-setup/). |
| 85 | +::: |
| 86 | + |
| 87 | +<Tabs syncKey="dashPlusAPI"> |
| 88 | +<TabItem label="Dashboard" no-code="true"> |
| 89 | + |
| 90 | +1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account. |
| 91 | +2. Go to **IP Addresses** > **Address Maps**. |
| 92 | +3. Select **Create an address map**. |
| 93 | +4. Choose the scope of the address map. |
| 94 | +5. Add the zones and IP addresses that you want to map. |
| 95 | +6. Name your address map. |
| 96 | +7. Review the information and select **Save and Deploy**. |
| 97 | + |
| 98 | +</TabItem> |
| 99 | +<TabItem label="API" no-code="true"> |
| 100 | + |
| 101 | +Use the [Create Address Map](/api/resources/addressing/subresources/address_maps/methods/create/) endpoint. |
| 102 | + |
| 103 | +Make sure you have the correct Key/Token and permissions. |
| 104 | + |
| 105 | +</TabItem> |
| 106 | +</Tabs> |
| 107 | + |
| 108 | +#### DNS records |
| 109 | + |
| 110 | +While the DNS record proxy status and address map will determine how Cloudflare's authoritative DNS responds to requests for your hostnames, the IP addresses specified in `A`/`AAAA` records will determine [how Cloudflare reaches the configured origin](/fundamentals/concepts/how-cloudflare-works/#how-cloudflare-works-as-a-reverse-proxy). |
| 111 | + |
| 112 | +:::note |
| 113 | +As you create the necessary DNS records, [Total TLS](/ssl/edge-certificates/additional-options/total-tls/) can help making sure that you have SSL/TLS certificates in place for all your hostnames. |
| 114 | +::: |
| 115 | + |
| 116 | +<Tabs syncKey="dashPlusAPI"> |
| 117 | +<TabItem label="Dashboard" no-code="true"> |
| 118 | + |
| 119 | +To create a DNS record in the dashboard: |
| 120 | + |
| 121 | +1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select an account and domain. |
| 122 | +2. Go to **DNS** > **Records**. |
| 123 | +3. Select **Add record**. |
| 124 | +4. Choose an address (`A`/`AAAA`) [record type](/dns/manage-dns-records/reference/dns-record-types/). |
| 125 | +5. Complete the required fields, setting the **Proxy status** to **proxied**. |
| 126 | +6. Select **Save**. |
| 127 | + |
| 128 | +</TabItem> |
| 129 | +<TabItem label="API" no-code="true"> |
| 130 | + |
| 131 | +To create records with the API, use a [POST request](/api/resources/dns/subresources/records/methods/create/). For field definitions, select a record type under the request body specification. |
| 132 | + |
| 133 | +</TabItem> |
| 134 | +</Tabs> |
| 135 | + |
| 136 | +<Details header="Example"> |
| 137 | + |
| 138 | +| Type | Name | IP address | Proxy status | TTL | |
| 139 | +| ---- | ----- | --------------- | ------------ | ------ | |
| 140 | +| `A` | `www` | `203.0.113.150` | `Proxied` | `Auto` | |
| 141 | + |
| 142 | +At this point, if an address map for a zone `example.com` specifies that Cloudflare should use `203.0.113.100` for proxied records and the above record exists in the same zone, you can expect the following: |
| 143 | + |
| 144 | +1. Cloudflare responds to DNS requests for `www.example.com` with `203.0.113.100`. |
| 145 | +2. Cloudflare proxies requests through the CDN and then routes the requests to the origin server `203.0.113.150`. |
| 146 | +3. As the HTTP response egresses the Cloudflare network back to the client side, the source IP address of the response becomes `203.0.113.100` (the IP address that the HTTP request originally landed on). |
| 147 | + |
| 148 | +</Details> |
| 149 | + |
| 150 | +:::note |
| 151 | +Having the same IP address as ingress IP (defined in the address map) and origin IP (listed in the DNS record) will not cause any loops. |
| 152 | +::: |
| 153 | + |
| 154 | +<Details header="Example"> |
| 155 | + |
| 156 | +Assuming `203.0.113.100` was also the origin IP, the DNS record would look like the following: |
| 157 | + |
| 158 | +| Type | Name | IP address | Proxy status | TTL | |
| 159 | +| ---- | ----- | --------------- | ------------ | ------ | |
| 160 | +| `A` | `www` | `203.0.113.100` | `Proxied` | `Auto` | |
| 161 | + |
| 162 | +</Details> |
| 163 | + |
| 164 | +### Spectrum |
| 165 | + |
| 166 | +Configuring Spectrum to use your own IP address is only possible via the [Cloudflare API](/api/resources/spectrum/). |
| 167 | + |
| 168 | +The `origin_direct` field takes the origin IP address, while `edge_ips` allows you to define which IP address from your BYOIP prefix Cloudflare should use to process requests for your Spectrum application. |
| 169 | + |
| 170 | +<APIRequest |
| 171 | +path="/zones/{zone_id}/spectrum/apps" |
| 172 | +method="POST" |
| 173 | +json={[ |
| 174 | + { |
| 175 | + "protocol":"tcp/22", |
| 176 | + "dns":{ |
| 177 | + "type":"CNAME", |
| 178 | + "name":"ssh.example.com" |
| 179 | + }, |
| 180 | + "origin_direct":["tcp://192.0.2.1:22"], |
| 181 | + "proxy_protocol":"off", |
| 182 | + "ip_firewall":true, |
| 183 | + "tls":"full", |
| 184 | + "edge_ips":{ |
| 185 | + "type":"static", |
| 186 | + "ips":["203.0.113.18"] |
| 187 | + }, |
| 188 | + "traffic_type":"direct", |
| 189 | + } |
| 190 | + ]} |
| 191 | + code={{ |
| 192 | + mark: [17, 18, 19, 20, 21, "203.0.113.18"] |
| 193 | + }} |
| 194 | +/> |
| 195 | + |
| 196 | +--- |
| 197 | + |
| 198 | +## (Optional) Add layer 7 functionality |
| 199 | + |
| 200 | +<Render file="service-bindings-related-products" /> |
| 201 | + |
| 202 | +[^1]: Layer 7 HTTP-based |
| 203 | +[^2]: Layer 4 or Layer 7 HTTP with custom ports |
0 commit comments