Apply suggestions from code review

Co-authored-by: marciocloudflare <[email protected]>

Author: securitypedant

src/content/docs/reference-architecture/diagrams/network/protect-data-center-networks.mdx

@@ -25,18 +25,18 @@ But these firewalls and security appliances are often expensive, complex to conf
 - [Magic Transit](https://www.cloudflare.com/network-services/products/magic-transit/) provides instant detection and mitigation against network-layer DDoS attacks on your public, Internet-facing networks.
 - [Magic WAN](https://www.cloudflare.com/network-services/products/magic-wan/) provides any-to-any, hybrid/multi-cloud secure connectivity between your private, enterprise networks.
 - [Magic Firewall](/magic-firewall/) is a cloud-native network firewall service that can be used to filter traffic that is routed to and from your networks that are protected by Magic Transit. It also supports functionalities such as [Intrusion Detection](/magic-firewall/about/ids/) (IDS) and [packet capture](/magic-firewall/packet-captures/).
-- [Gateway](https://www.cloudflare.com/zero-trust/products/gateway/) is a secure web gateway (SWG) service that allows you to inspect and control both Internet bound traffic that is originated from your networks, as well as private network-to-private network traffic (that is, east-west), by proxying such traffic through Cloudflare's global network while applying DNS, network and HTTP based [policies](/cloudflare-one/policies/gateway/).
+- [Gateway](https://www.cloudflare.com/zero-trust/products/gateway/) is a secure web gateway (SWG) service that allows you to inspect and control both Internet-bound traffic that is originated from your networks, as well as private network-to-private network traffic (that is, east-west), by proxying such traffic through Cloudflare's global network while applying DNS, network and HTTP based [policies](/cloudflare-one/policies/gateway/).
 
 This document focuses specifically on the reference architectures of using Cloudflare Magic Transit, Magic WAN, Magic Firewall and Cloudflare Gateway services to protect both external and internal communications to your data center networks. For details of how Magic Transit, Magic WAN, Magic Firewall and Cloudflare Gateway works and how it can be architected for various use cases, see the linked resources at the end of the document.
 
 To illustrate the architecture and how it works, the following diagrams visualize an example corporation with a set of data center networks that are either public-facing, connecting to users on the Internet or private, internal facing, used for communication within the enterprise. These networks are deployed at two on-premises locations. The prefixes of the public-facing networks are to be protected by Cloudflare Magic Transit.
 
 | Data center 1                       | Data center 2                         |
 | :---------------------------------- | :------------------------------------ |
-| Public-facing network: 192.0.2.0/24 | Public-facing network: 203.0.113.0/24 |
-| Private network: 192.168.1.0/24     | Private network: 172.16.2.0/24        |
+| Public-facing network: `192.0.2.0/24` | Public-facing network: `203.0.113.0/24` |
+| Private network: `192.168.1.0/24`     | Private network: `172.16.2.0/24`        |
 
-The edge router(s) at each data center is connected to Cloudflare network via two Direct [Cloudflare Network Interconnect](/network-interconnect/) (CNI) connections, which are direct, private connections between your network and Cloudflare network, one for carrying public-facing network traffic, one for carrying private network traffic. Optionally, you can choose to carry both public and private network traffic over a single CNI connection but many organizations do desire to transport external and internal network traffic over separate connections in their security practice.
+The edge router(s) at each data center is connected to Cloudflare network via two Direct [Cloudflare Network Interconnect](/network-interconnect/) (CNI) connections, which are direct, private connections between your network and Cloudflare network. One of the Direct CNI connections is for carrying public-facing network traffic, while the other is for carrying private network traffic. Optionally, you can choose to carry both public and private network traffic over a single CNI connection but many organizations do desire to transport external and internal network traffic over separate connections in their security practice.
 
 - For data center 1, CNI connection 1 is used to transport public-facing network traffic and connection 2 is used to transport private network traffic.
 - For data center 2, CNI connection 3 is used to transport public-facing network traffic and connection 4 is used to transport private network traffic.
@@ -74,10 +74,11 @@ The reference architecture diagram below illustrates how Cloudflare services - M
 
 ## Protect site-to-site, inter-data center, private network traffic
 
-The reference architecture diagrams below illustrate how Cloudflare services \- Magic WAN, Magic Firewall and Cloudflare Gateway, can be used to protect site-to-site, inter-data center traffic between your private networks.
+The reference architecture diagrams below illustrate how Cloudflare services — Magic WAN, Magic Firewall and Cloudflare Gateway — can be used to protect site-to-site, inter-data center traffic between your private networks.
 
 **Site to Site Private Network Traffic Connectivity**
-First, let us look at the use case where you do not intend to subject site-to-site private network traffic to Cloudflare Gateway proxy firewall service and simply route it using Magic WAN service.
+
+First, let us examine the use case where you do not intend to subject site-to-site private network traffic to Cloudflare Gateway proxy firewall service and simply route it using Magic WAN service.
 
 ![Figure 3.1. Protect inter-data center non-gateway-proxied traffic between private networks.](~/assets/images/reference-architecture/protect-data-center-networks/figure3.1.svg "Figure 3.1. Protect inter-data center non-gateway-proxied traffic between private networks.")
 
@@ -87,6 +88,7 @@ First, let us look at the use case where you do not intend to subject site-to-si
 4. Traffic that clears the Magic Firewall rules and is not intended to be further proxied by Cloudflare Gateway service, is routed back to the destination network via the corresponding CNI.
 
 **Site to Site Private Network Traffic with Application Level Security Controls**
+
 For the use case where you do want to apply application level policy for fine-grain control and security on certain private network traffic, you can route and proxy such traffic through Magic WAN and Cloudflare Gateway service. The following diagram illustrates the architecture and packet flow of such use cases.
 
 ![Figure 3.2: Figure 3.2. Protect inter-data center gateway-proxied traffic between private networks.](~/assets/images/reference-architecture/protect-data-center-networks/figure3.2.svg "Figure 3.2. Protect inter-data center gateway-proxied traffic between private networks.")
@@ -100,7 +102,7 @@ For the use case where you do want to apply application level policy for fine-gr
 
 ## Protect outbound Internet traffic from private networks
 
-The reference architecture diagram below illustrates how Cloudflare services \- Magic WAN, Magic Firewall and Cloudflare Gateway, can be used to protect outbound Internet traffic originating from the data centers' private networks. The use cases and the protection provided to the servers on the private networks are very similar to those described in the previous section about protecting Internet access from public-facing networks. The differences are that the servers have private IP addresses and that Magic WAN service is used in this section, as opposed to the previous section where servers are assigned with public IP addresses and Magic Transit server is used.
+The reference architecture diagram below illustrates how Cloudflare services — Magic WAN, Magic Firewall and Cloudflare Gateway — can be used to protect outbound Internet traffic originating from the data centers' private networks. The use cases and the protection provided to the servers on the private networks are very similar to those described in the previous section about protecting Internet access from public-facing networks. The differences are that the servers have private IP addresses and that Magic WAN service is used in this section, as opposed to the previous section where servers are assigned with public IP addresses and Magic Transit server is used.
 
 ![Figure 4. Protect outbound traffic from private networks.](~/assets/images/reference-architecture/protect-data-center-networks/figure4.svg "Figure 4. Protect outbound traffic from private networks.")