|
| 1 | +--- |
| 2 | +title: Use BYOIP with Magic Transit and CDN |
| 3 | +pcx_content_type: tutorial |
| 4 | +sidebar: |
| 5 | + order: 3 |
| 6 | + label: Magic Transit with CDN |
| 7 | + |
| 8 | +--- |
| 9 | + |
| 10 | +import { Details, Example, TabItem, Tabs, GlossaryTooltip } from "~/components"; |
| 11 | + |
| 12 | +[Magic Transit](/magic-transit/) customers using BYOIP can also benefit from the performance, reliability, and security that Cloudflare offers for HTTP-based applications. |
| 13 | + |
| 14 | +This documentation covers using the Cloudflare API to configure [service bindings](/byoip/service-bindings/) within Cloudflare's IP Address Management framework. Service bindings allow BYOIP customers to selectively route traffic on a per-IP address basis to the CDN pipeline (which includes [Cache](/cache/), [Web Application Firewal (WAF)](/waf/), and more). |
| 15 | + |
| 16 | +It is also possible to define service bindings to route traffic to the Spectrum pipeline selectively. However, this is not in the scope of this guide. |
| 17 | + |
| 18 | +It is important to note that traffic routed to the CDN pipeline is protected at Layers 3 and 4 by the inherent DDoS protection capabilities native to the CDN pipeline. |
| 19 | + |
| 20 | +## Before you begin |
| 21 | + |
| 22 | +Efficiency is paramount when planning how you will implement service bindings. Implementing service bindings through an aggregated CIDR block is strongly recommended. |
| 23 | + |
| 24 | + <Details header="Example" > |
| 25 | + |
| 26 | + **Magic Transit protected prefix:** `203.0.113.100/24` |
| 27 | + |
| 28 | + **IPs to upgrade to the CDN:** |
| 29 | + |
| 30 | + `203.0.113.16` |
| 31 | + `203.0.113.17` |
| 32 | + `203.0.113.18` |
| 33 | + `203.0.113.19` |
| 34 | + `203.0.113.20` |
| 35 | + `203.0.113.21` |
| 36 | + `203.0.113.22` |
| 37 | + `203.0.113.23` |
| 38 | + |
| 39 | + **Best practice:** Add one discrete CDN service binding for `203.0.113.16` with a `/29` netmask. |
| 40 | + |
| 41 | + </Details> |
| 42 | + |
| 43 | +Once a service binding is created (or deleted), it will take four to six hours to propagate across Cloudflare's global network. Services for the IP addresses in scope will likely be disrupted during this window. |
| 44 | + |
| 45 | + |
| 46 | +## 1. Get account information |
| 47 | + |
| 48 | +1. Log in to your Cloudflare account and get your [account ID](/fundamentals/setup/find-account-and-zone-ids/) and [API token](/fundamentals/api/get-started/create-token/). The token permissions should include `Account` - `IP Prefixes` - `Edit`. |
| 49 | +2. Make a `GET` request to the [List Services](/api/operations/ip-address-management-service-bindings-list-services) endpoint and take note of the `id` associated with the CDN service. |
| 50 | +3. Use the [List Prefixes](/api/operations/ip-address-management-prefixes-list-prefixes) endpoint and take note of the `id` associated with the prefix (`cidr`) you will configure. |
| 51 | + |
| 52 | +<Example> |
| 53 | + |
| 54 | +At this point, continuing the [example](#before-you-begin), you should have a mapping similar to the following: |
| 55 | + |
| 56 | +| Variables | Description | |
| 57 | +|-------------------------------|----------------------------------------------------| |
| 58 | +| `{service_id}` | The ID of the CDN service within Cloudflare. <br /><br /> Example: `969xxxxxxxx000xxx0000000x00001bf` | |
| 59 | +| `{prefix_id}` | The ID of the Magic Transit protected prefix (`203.0.113.100/24`) you want to configure. <br /><br /> Example: `6b25xxxxxxx000xxx0000000x0000cfc` | |
| 60 | + |
| 61 | +</Example> |
| 62 | + |
| 63 | +4. To confirm you currently only have a Magic Transit service binding and that it spans across your entire prefix, make a `GET` request to the [List Service Bindings](/api/operations/ip-address-management-service-bindings-list-service-bindings) endpoint. Replace the `{prefix_id}` in the URI path by the actual prefix ID you got from the previous step. |
| 64 | + |
| 65 | +<Example> |
| 66 | + |
| 67 | +```bash |
| 68 | +curl https://api.cloudflare.com/client/v4/accounts/{account_id}/addressing/prefixes/{prefix_id}/bindings \ |
| 69 | +--header "Authorization: Bearer <API_TOKEN>" |
| 70 | +``` |
| 71 | + |
| 72 | +</Example> |
| 73 | + |
| 74 | +## 2. Create service binding |
| 75 | + |
| 76 | +:::caution[Caution] |
| 77 | +Once a service binding is created (or deleted), it will take four to six hours to propagate across Cloudflare's global network. Services for the IP addresses in scope will likely be disrupted during this window. |
| 78 | +::: |
| 79 | + |
| 80 | +1. Make a `POST` request to the [Create service binding](/api/operations/ip-address-management-service-bindings-create-service-binding) endpoint, indicating the IP address you want to bind to the CDN. Specify the **corresponding network mask** as needed. |
| 81 | + |
| 82 | +<Example> |
| 83 | + |
| 84 | +Continuing the example, `203.0.113.100/32` designates an IP address that is within the Magic Transit protected prefix `203.0.113.0/24`. |
| 85 | + |
| 86 | +Replace the `{prefix_id}` in the URI with your prefix ID from previous steps. Within the request body, the `cidr` value should correspond to the IP address or subnet that you are configuring for use with CDN. |
| 87 | + |
| 88 | +```bash |
| 89 | + |
| 90 | +curl https://api.cloudflare.com/client/v4/accounts/{account_id}/addressing/prefixes/{prefix_id}/bindings \ |
| 91 | +--header "Authorization: Bearer <API_TOKEN>" \ |
| 92 | +--header "Content-Type: application/json" \ |
| 93 | +--data '{ |
| 94 | + "cidr": "203.0.113.100/32", |
| 95 | + "service_id": <SERVICE_ID> |
| 96 | +}' |
| 97 | +``` |
| 98 | + |
| 99 | +In the response body, the initial provisioning state should be `provisioning`. |
| 100 | + |
| 101 | +```json |
| 102 | +{ |
| 103 | + "errors": [], |
| 104 | + "messages": [], |
| 105 | + "success": true, |
| 106 | + "result": { |
| 107 | + "cidr": "203.0.113.100/32", |
| 108 | + "id": <CDN_SERVICE_BINDING_ID>, |
| 109 | + "provisioning": { |
| 110 | + "state": "provisioning" |
| 111 | + }, |
| 112 | + "service_id": <SERVICE_ID>, |
| 113 | + "service_name": "CDN" |
| 114 | + } |
| 115 | +} |
| 116 | +``` |
| 117 | +</Example> |
| 118 | + |
| 119 | +You can periodically check the service binding status using the [List Service Bindings](/api/operations/ip-address-management-service-bindings-list-service-bindings) endpoint. |
| 120 | + |
| 121 | +## 3. Create address maps |
| 122 | + |
| 123 | +Once you have configured your IPs to have CDN service, you can use <GlossaryTooltip term="address map" link="/byoip/address-maps/">address maps</GlossaryTooltip> to specify which IPs should be used by Cloudflare in DNS responses when a record is <GlossaryTooltip term="proxy status" link="/dns/manage-dns-records/reference/proxied-dns-records/#proxied-records">proxied</GlossaryTooltip>. |
| 124 | + |
| 125 | +You can choose between two different scopes: |
| 126 | + |
| 127 | +* Account-level: uses the address map for all proxied DNS records across all of the zones within an account. |
| 128 | + |
| 129 | +* Zone-level: uses the address map for all proxied DNS records within a zone. |
| 130 | + |
| 131 | +:::note |
| 132 | +If you need to map only specific subdomains to specific IP addresses - and not all proxied DNS records -, you can use a [Subdomain setup](/dns/zone-setups/subdomain-setup/). |
| 133 | +::: |
| 134 | + |
| 135 | +<Tabs labels="Dashboard | API"> |
| 136 | +<TabItem label="dashboard" no-code="true"> |
| 137 | + |
| 138 | +1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account. |
| 139 | +2. Go to **IP Addresses** > **Address Maps**. |
| 140 | +3. Select **Create an address map**. |
| 141 | +4. Choose the scope of the address map. |
| 142 | +5. Add the zones and IP addresses that you want to map. |
| 143 | +6. Name your address map. |
| 144 | +7. Review the information and select **Save and Deploy**. |
| 145 | + |
| 146 | +</TabItem> |
| 147 | +<TabItem label="api" no-code="true"> |
| 148 | + |
| 149 | +Use the [Create Address Map](/api/operations/ip-address-management-address-maps-create-address-map) endpoint. |
| 150 | + |
| 151 | +Make sure you have the correct Key/Token and permissions. |
| 152 | + |
| 153 | +</TabItem> |
| 154 | +</Tabs> |
| 155 | + |
| 156 | +## 4. Create DNS records |
| 157 | + |
| 158 | +<Tabs labels="Dashboard | API"> |
| 159 | +<TabItem label="dashboard" no-code="true"> |
| 160 | + |
| 161 | +To create a DNS record in the dashboard: |
| 162 | + |
| 163 | +1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select an account and domain. |
| 164 | +2. Go to **DNS** > **Records**. |
| 165 | +3. Select **Add record**. |
| 166 | +4. Choose an address (`A`/`AAAA`) [record type](/dns/manage-dns-records/reference/dns-record-types/). |
| 167 | +5. Complete the required fields, setting the **Proxy status** to **proxied**. |
| 168 | +6. Select **Save**. |
| 169 | + |
| 170 | +</TabItem> |
| 171 | + |
| 172 | +<TabItem label="api" no-code="true"> |
| 173 | + |
| 174 | +To create records with the API, use a [POST request](/api/operations/dns-records-for-a-zone-create-dns-record). For field definitions, select a record type under the request body specification. |
| 175 | + |
| 176 | +</TabItem> |
| 177 | +</Tabs> |
| 178 | + |
| 179 | +:::note |
| 180 | +As you create the necessary DNS records, [Total TLS](/ssl/edge-certificates/additional-options/total-tls/) can help making sure that you have SSL/TLS certificates in place for all your hostnames. |
| 181 | +::: |
| 182 | + |
| 183 | +While the DNS record proxy status and address map will determine how Cloudflare's authoritative DNS responds to requests for your hostnames, the IP addresses specified in `A`/`AAAA` records will determine [how Cloudflare reaches the configured origin](/fundamentals/concepts/how-cloudflare-works/#how-cloudflare-works-as-a-reverse-proxy). |
| 184 | + |
| 185 | +<Details header="Example" > |
| 186 | + |
| 187 | +| Type | Name | IP address | Proxy status | TTL | |
| 188 | +| --- | --- | --- | --- | --- | |
| 189 | +| `A` | `www` | `203.0.113.150` | `Proxied` | `Auto` | |
| 190 | + |
| 191 | +At this point, if an address map for a zone `example.com` specifies that Cloudflare should use `203.0.113.100` for proxied records and the above record exists in the same zone, you can expect the following: |
| 192 | + |
| 193 | +1. Cloudflare responds to DNS requests with `203.0.113.100`. |
| 194 | +2. Cloudflare proxies requests through the CDN and then routes the requests via [GRE](/magic-transit/reference/tunnels/#gre-and-ipsec-tunnels) or [CNI](/magic-transit/network-interconnect/) to the origin server `203.0.113.150` (Magic Transit protected prefix). |
| 195 | +3. Depending on whether Magic Transit is implemented with [direct server return model or with Magic Transit egress](/magic-transit/how-to/configure-tunnels/#bidirectional-vs-unidirectional-health-checks), the origin server responds back to Cloudflare either: |
| 196 | + |
| 197 | + * Directly over the Internet in a Magic Transit direct server return model |
| 198 | + * Back through the Magic GRE tunnel(s) in a Magic Transit egress model |
| 199 | +4. As the HTTP response egresses the Cloudflare network back to the client side, the source IP address of the response becomes `203.0.113.100` (the IP address that the HTTP request originally landed on). |
| 200 | + |
| 201 | +</Details> |
| 202 | + |
| 203 | +Having the same IP address as ingress IP (defined in the address map) and origin IP (listed in the DNS record) will not cause any loops. |
| 204 | + |
| 205 | +<Details header="Example" > |
| 206 | + |
| 207 | +Assuming `203.0.113.100` was also the origin IP, the DNS record would look like the following: |
| 208 | + |
| 209 | +| Type | Name | IP address | Proxy status | TTL | |
| 210 | +| --- | --- | --- | --- | --- | |
| 211 | +| `A` | `www` | `203.0.113.100` | `Proxied` | `Auto` | |
| 212 | + |
| 213 | +</Details> |
| 214 | + |
| 215 | +## 5.(Optional) Add layer 7 functionality |
| 216 | + |
| 217 | +Leverage other features according to your needs: |
| 218 | + |
| 219 | +- [Cache](/cache/) |
| 220 | +- [WAF custom rules](/waf/custom-rules/#custom-rules) |
| 221 | +- [Security analytics](/waf/analytics/security-analytics/#security-analytics) |
0 commit comments