You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* on-ramps partial
* vars and cond rendering
* get started partial
* vars
* vars
* supported routers mdx
* sup routers partial
* recommended-sampling-rate partial
* content
* netflow partial
* vars
* sflow partial
* content
* vars
* vars
* static-threshold partial
* content
* vars
* vars
* refined text
* vars
* dynamic partial
* content
* vars
* vars
* vars
* sflow partial and content
* vars
* vars
* vars
* rule not partial
* vars
* cloud flow partial and content
* encrypt tut partial and vars
* graphql-analytics partial
* vars
* ddos partial
* params
* vars
* mnm free partial
* free partial and vars
* api partial and content
* faq partial and content
* vars
* vars
* vars
Copy file name to clipboardExpand all lines: src/content/docs/magic-network-monitoring/api.mdx
+9-15Lines changed: 9 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,18 +6,12 @@ sidebar:
6
6
7
7
---
8
8
9
-
Use Magic Network Monitoring's API to configure your [account](/api/resources/magic_network_monitoring/subresources/configs/methods/get/) and [rules](/api/resources/magic_network_monitoring/subresources/rules/methods/list/).
10
-
11
-
## Account configuration
12
-
13
-
Refer to [account configuration](/api/resources/magic_network_monitoring/subresources/configs/methods/get/) to:
14
-
15
-
- Create, list, update, and delete Magic Network Monitoring configurations
16
-
- List default sampling, router IPs, and rules for an account
17
-
18
-
## Rules configuration
19
-
20
-
Refer to [rules configuration](/api/resources/magic_network_monitoring/subresources/rules/methods/list/) to:
Copy file name to clipboardExpand all lines: src/content/docs/magic-network-monitoring/cloud-flow-logs.mdx
+9-3Lines changed: 9 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,8 +8,14 @@ sidebar:
8
8
text: Beta
9
9
---
10
10
11
-
Customers using Magic Network Monitoring can export virtual private cloud (VPC) flow logs from their cloud environment to Cloudflare's network. Cloudflare will then process these VPC flow logs and display analytics on your cloud traffic in the dashboard. Customers can also ingest data on their cloud traffic via our public GraphQL API which powers the cloud traffic analytics in the dashboard.
11
+
import { Render } from"~/components";
12
12
13
-
Currently, Magic Network Monitoring only supports AWS VPC flow logs via AWS Firehose. AWS VPC flow logs can only be configured via Cloudflare's API for Magic Network Monitoring.
Copy file name to clipboardExpand all lines: src/content/docs/magic-network-monitoring/faq.mdx
+14-55Lines changed: 14 additions & 55 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,58 +6,17 @@ sidebar:
6
6
order: 11
7
7
---
8
8
9
-
Below you will find answers to our most commonly asked questions. If you cannot find the answer you are looking for, refer to the [community page](https://community.cloudflare.com/) to explore more resources.
10
-
11
-
## I am getting an "Invalid account settings request body: account name format contains illegal characters or is not supported" error when trying to create a rule.
12
-
13
-
This probably means that your account name has unsupported characters. Make sure your account name does not have characters like, for example, `&`, `<`, `>`, `"`, `'`, ``` ` ```.
14
-
15
-
Refer to [Account name](/fundamentals/account/create-account/#account-name) to learn how to change your account name.
16
-
17
-
## Can I send NetFlow/sFlow data to Cloudflare in a secure, encrypted way?
18
-
19
-
Yes. Both enterprise and free customers can send encrypted network flow data to Cloudflare.
20
-
21
-
Enterprise customers with Magic Transit or Magic WAN are able to send encrypted network flow data via an IPsec tunnel to Cloudflare's network. You can achieve this by:
22
-
23
-
1. Configuring your [NetFlow](/magic-network-monitoring/routers/netflow-ipfix-config/) or [sFlow](/magic-network-monitoring/routers/sflow-config/) data to be sent to Cloudflare's network for parsing.
24
-
2. Directing that network flow data to be sent over [Magic Transit IPsec tunnels](/magic-transit/how-to/configure-tunnel-endpoints/) or [Magic WAN IPsec tunnels](/magic-wan/configuration/manually/how-to/configure-tunnel-endpoints/) to Cloudflare's network.
25
-
26
-
Cloudflare's network will then identify this traffic via the destination IP address/port, and direct the network flow traffic to Magic Network Monitoring for parsing.
27
-
28
-
Free customers can route their network flow traffic through a device that is running the WARP client. Then, network flow traffic can be forwarded from the WARP enabled device to Cloudflare's network flow endpoints. You can learn more about this in the [Encrypt network flow data tutorial](/magic-network-monitoring/tutorials/encrypt-network-flow-data).
29
-
30
-
## I have Auto-Advertisement enabled and it was triggered by an attack. Do I have to turn Magic Transit off manually?
31
-
32
-
Once Auto-Advertisement is activated for an IP prefix that is under attack, the IP prefix will continue to be advertised by Cloudflare even if the attack ends. You will then need to manually disable advertisement for that IP prefix. Refer to [Configure dynamic advertisement](/byoip/concepts/dynamic-advertisement/best-practices/#configure-dynamic-advertisement) to learn how to withdraw your prefixes, and stop using Magic Transit.
33
-
34
-
## If Auto-Advertisement is enabled, and the threshold has been triggered, will the IP prefix show as advertised in the dashboard?
35
-
36
-
Yes, the IP prefix will show as advertised under the [IP Prefixes tab](/byoip/concepts/dynamic-advertisement/best-practices/#configure-dynamic-advertisement).
37
-
38
-
## Does Auto-advertisement also work with BGP-controlled advertisements?
39
-
40
-
No. Auto-advertisement only works with API-controlled advertisement, not BGP-controlled advertisement.
41
-
42
-
## In the API, Magic Network Monitoring rules have a `bandwidth_threshold` data field. Does the value for this field refer to bytes transferred or current throughput?
43
-
44
-
The threshold for a [Magic Network Monitoring (MNM) rule](/api/resources/magic_network_monitoring/subresources/rules/methods/list/) has two values. The first value is `bandwidth_threshold`. This value is a measure of the total ingress throughput on a network at any given moment. The second value is `duration`. The `duration`value refers to the amount of time that `bandwidth_threshold` must be exceeded before an alert is sent to the customer.
45
-
46
-
For example, you create a MNM rule with the following parameters:
47
-
48
-
```txt
49
-
"bandwidth_threshold": 50000000
50
-
"duration": "1m0s"
51
-
```
52
-
53
-
With this rule, your network needs to receive a throughput greater than 50,000,000 bits per second (50 Gigabits per second or Gbps) for 60 seconds. If both of these conditions are met, then MNM will send you an alert.
54
-
55
-
## My router's public IP address is different from the IP address of my network flow `agent-ip`. I cannot change my network flow `agent-ip`, and I am not seeing my router's traffic in MNM analytics
56
-
57
-
It is recommended that you set your router's public IP address and network flow `agent-ip` to the same value. However, if you are unable to do this, you can register both your router's public IP and your network flow `agent-ip` in the Magic Network Monitoring (MNM) [router configuration](/magic-network-monitoring/get-started/). This will prevent MNM from blocking network traffic received from any unknown IP addresses, and will show your router's network flow data underneath the router's `agent-ip`.
58
-
59
-
## What is Magic Network Monitoring's data retention policy for Netflow/sFlow received from customer's routers?
60
-
61
-
Currently, all data received from a customer's router goes to our servers in the US. If you enable data sovereignty in Europe, you cannot currently use Magic Network Monitoring.
62
-
63
-
GraphQL analytics is retained for 90 days for enterprise customers. For non-enterprise customers, data retention is seven days. Cloudflare also retains data for six hours in the US, for threshold crossing detection.
Magic Network Monitoring includes an onboarding workflow that guides you step-by-step through the product configuration process. If you are unable to complete the configuration in one session, you can exit the workflow and resume it at any time.
11
-
12
-
To begin using Magic Network Monitoring for network and/or cloud traffic visibility, complete the list of tasks below.
13
-
14
-
-[NetFlow and sFlow guide](#netflow-and-sflow-guide)
15
-
-[VPC flow log guide (beta)](#vpc-flow-log-guide)
16
-
17
-
If you are an Enterprise customer, Cloudflare can significantly accelerate the onboarding timeline during active-attack scenarios. Enterprise customers that would like to use Magic Network Monitoring and Magic Transit On Demand together can begin by [configuring Magic Transit](/magic-transit/get-started/).
18
-
19
-
## NetFlow and sFlow guide
20
-
21
-
### 1. Verify NetFlow or sFlow capabilities
22
-
23
-
Verify your routers are capable of exporting <GlossaryTooltipterm="NetFlow">NetFlow</GlossaryTooltip> or <GlossaryTooltipterm="sFlow">sFlow</GlossaryTooltip> to an IP address on Cloudflare's network. Magic Network Monitoring supports NetFlow v5, NetFlow v9, IPFIX, and sFlow.
24
-
25
-
Refer to [Supported routers](/magic-network-monitoring/routers/supported-routers) to view a list of supported routers. The list is not exhaustive.
26
-
27
-
### 2. Register your router with Cloudflare
28
-
29
-
When you register your router with Cloudflare, your router links your NetFlow or sFlow data to your Cloudflare account.
30
-
31
-
1. In the Cloudflare dashboard, go to the **Magic Monitoring** page.
4. (Optional) Under **IP Address**, enter your router's public IP address.
38
-
5. Under **Default router sampling rate**, enter a value for the <GlossaryTooltipterm="sampling">sampling</GlossaryTooltip> rate. The value should match the sampling rate of your NetFlow or sFlow configuration.
39
-
6. Select **Next**.
40
-
41
-
### 3. Configure your router
42
-
43
-
Next, configure your router to send NetFlow/SFlow data to Cloudflare. For this step, you will also need to have your router's configuration menu open to input the values shown in the Cloudflare dashboard.
44
-
45
-
Refer to the [NetFlow/IPFIX configuration](/magic-network-monitoring/routers/netflow-ipfix-config/) or the [sFlow configuration guide](/magic-network-monitoring/routers/sflow-config/) for more information.
46
-
47
-
1. From **Configure routers** in the dashboard, select either **NetFlow Configuration** or **sFlow configuration**.
48
-
2. Follow the configuration steps for the selected configuration type.
49
-
3. Enter the values shown in your router's configuration.
50
-
4. Select **Next**.
51
-
52
-
### 4. Check your router configuration
53
-
54
-
After setting up your router, confirm the configuration was successfully set up.
55
-
56
-
From the **Check routers** page on the dashboard, you can view the status of your routers. Keep in mind that router data takes five to ten minutes to be sent to Cloudflare.
57
-
58
-
Refer to **Router status description** to confirm whether data is successfully being sent.
59
-
60
-
When you are done with router configuration, select **Finish onboarding**.
61
-
62
-
:::note
63
-
This will only be visible during the onboarding process. When you are finished onboarding, this page will no longer be visible.
64
-
:::
65
-
66
-
### 5. Create rules
67
-
68
-
Create rules to analyze data for a specific set of destinations or to implement thresholds. Refer to [Rules](/magic-network-monitoring/rules/) for more information.
Verify that your AWS account is capable of exporting AWS VPC flow logs via AWS Firehose. Currently, Magic Network Monitoring only supports VPC flow log ingestion for AWS.
75
-
76
-
### 2. Set up AWS Firehose to export VPC flow logs to Cloudflare
77
-
78
-
:::note
79
-
AWS VPC flow logs can only be configured via the Cloudflare API for Magic Network Monitoring. There are no inputs in the dashboard for configuring AWS VPC flow logs.
80
-
:::
81
-
82
-
1. Create an authorization token via [Cloudflare's API for Magic Network Monitoring](/api/resources/magic_network_monitoring/subresources/vpc_flows/subresources/tokens/methods/create/). This authorization token allows Cloudflare to identify and verify the account sending VPC flow logs to our endpoint.
83
-
84
-
<APIRequest
85
-
path="/accounts/{account_id}/mnm/vpc-flows/token"
86
-
method="POST"
87
-
/>
88
-
89
-
2. Set the `HTTP Headers - X-Amz-Firehose-Access-Key` in the stream configuration for the authorization token generated in the previous step.
90
-
91
-
3. Send your AWS Firehose VPC flow log stream towards `https://aws-flow-logs.cloudflare.com/`.
92
-
93
-
4. Select all of the AWS VPC flow log data fields that you want to send to Cloudflare. You should select the highest number AWS VPC flow log version that supports all the fields you want to export to Cloudflare (refer to [AWS flow log documentation](https://docs.aws.amazon.com/vpc/latest/userguide/flow-log-records.html) for more information). For example, if you need a version 8 field like `reject-reason`, you must export all fields from versions 1 through 8. Cloudflare supports all seven templates for AWS VPC Flow logs.
94
-
95
-
### 3. Verify your cloud traffic via analytics
96
-
97
-
After setting up AWS Firehose to send VPC flow logs to Magic Network Monitoring, you can confirm that Cloudflare is receiving the logs as expected by searching for your cloud traffic data in the analytics page of the Magic Network Monitoring dashboard.
98
-
99
-
1. In the Cloudflare dashboard, go to the **Magic Monitoring** page.
Copy file name to clipboardExpand all lines: src/content/docs/magic-network-monitoring/magic-network-monitoring-free.mdx
+10-25Lines changed: 10 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,28 +8,13 @@ head:
8
8
content: Magic Network Monitoring free version
9
9
---
10
10
11
-
import { DashButton } from"~/components";
12
-
13
-
The free version of Magic Network Monitoring (MNM) is generally available to everyone with a Cloudflare account by default.
14
-
15
-
All free customers are encouraged to join [Cloudflare's Discord server](https://discord.com/invite/cloudflaredev) to discuss the use cases, configuration, and troubleshooting of Magic Network Monitoring. Free customers are always welcome to provide product feedback and discuss feature requests. The product and engineering team that works on Magic Network Monitoring regularly engages with the Discord community.
16
-
17
-
You can find the channel by joining the Cloudflare Developers Discord server. Then scroll down in the side bar navigation to the **Cloudflare One** category and select **magic-network-monitoring**.
18
-
19
-
## Access the free version of MNM
20
-
21
-
The free version includes all the features of the enterprise version, but has network flow volume and configuration limitations. These limits are detailed below.
22
-
23
-
1. In the Cloudflare dashboard, go to the **Magic Monitoring** page.
2. Complete the onboarding wizard to configure Magic Network Monitoring. Refer to [Get started](/magic-network-monitoring/get-started/) for more information.
Copy file name to clipboardExpand all lines: src/content/docs/magic-network-monitoring/routers/recommended-sampling-rate.mdx
+5-12Lines changed: 5 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,16 +8,9 @@ description: The best sampling rate recommendations for your network's traffic v
8
8
9
9
---
10
10
11
-
import { GlossaryTooltip } from"~/components"
11
+
import { Render } from"~/components";
12
12
13
-
<GlossaryTooltipterm="NetFlow">NetFlow</GlossaryTooltip> or <GlossaryTooltipterm="sFlow">sFlow</GlossaryTooltip> data is created by <GlossaryTooltipterm="sampling">sampling</GlossaryTooltip> the traffic that passes through your router. Lower sampling rates increase network flow data accuracy but require more router memory and CPU when the data is generated. Additionally, network flow data accuracy is maintained if customer select a higher sampling rate but also receive a larger amount of traffic.
14
-
15
-
The table below gives general recommendations for sampling rates depending on your traffic volume. Customers are encouraged to test different sampling rates to find the best option.
| Low | Between 1 in 100 packets - 1 in 500 packets |
20
-
| Medium | Between 1 in 1,000 - 1 in 2,000 packets |
21
-
| High | Between 1 in 2,000 - 1 in 4,000 packets |
22
-
23
-
As a general rule, customers may begin to notice a loss in data accuracy (depending on their network volume) as their network flow sampling rate climbs above 1 in 5,000 packets.
0 commit comments