diff --git a/public/__redirects b/public/__redirects index 713410196300cf..bb1484b1676987 100644 --- a/public/__redirects +++ b/public/__redirects @@ -366,6 +366,25 @@ /network-interconnect/set-up-cni/configure-bgp/ /network-interconnect/classic-cni/set-up/configure-bgp-bfd/ 301 /network-interconnect/set-up-cni/peering-portal/ /network-interconnect/pni-and-peering/ 301 +/network-interconnect/about/ /network-interconnect/ 301 +/network-interconnect/alerts/ /network-interconnect/monitoring-and-alerts/ 301 +/network-interconnect/classic-cni/alerts/ /network-interconnect/ 301 +/network-interconnect/classic-cni/ /network-interconnect/ 301 +/network-interconnect/classic-cni/set-up/configure-bgp-bfd/ /network-interconnect/ 301 +/network-interconnect/classic-cni/set-up/configure-cross-connect/ /network-interconnect/ 301 +/network-interconnect/classic-cni/set-up/ /network-interconnect/ 301 +/network-interconnect/classic-cni/set-up/partners/console-connect/ /network-interconnect/ 301 +/network-interconnect/classic-cni/set-up/partners/equinix-fabric/ /network-interconnect/ 301 +/network-interconnect/classic-cni/set-up/partners/ /network-interconnect/ 301 +/network-interconnect/classic-cni/set-up/partners/megaport/ /network-interconnect/ 301 +/network-interconnect/classic-cni/set-up/partners/packet-fabric/ /network-interconnect/ 301 +/network-interconnect/classic-cni/set-up/scope-config/ /network-interconnect/ 301 +/network-interconnect/cloud-cni/ /network-interconnect/ 301 +/network-interconnect/express-cni/bgp-peering/ /network-interconnect/ 301 +/network-interconnect/express-cni/create-interconnects/ /network-interconnect/ 301 +/network-interconnect/express-cni/ /network-interconnect/ 301 +/network-interconnect/pni-and-peering/ /network-interconnect/ 301 + # Constellation /constellation/ /workers-ai/ 301 diff --git a/public/network-interconnect/static/cni-locations-04-08-2025.pdf b/public/network-interconnect/static/cni-locations-04-08-2025.pdf new file mode 100644 index 00000000000000..701a10bc40cb7c Binary files /dev/null and b/public/network-interconnect/static/cni-locations-04-08-2025.pdf differ diff --git a/src/content/docs/aegis/about/index.mdx b/src/content/docs/aegis/about/index.mdx index 7281b0d598d1c3..a30a69a042d00c 100644 --- a/src/content/docs/aegis/about/index.mdx +++ b/src/content/docs/aegis/about/index.mdx @@ -52,4 +52,4 @@ Refer to the [introductory blog post](https://blog.cloudflare.com/cloudflare-aeg You can assign Aegis IPs to single or multiple Cloudflare zones, and across different Cloudflare accounts. -Aegis IPs are included within [BGP advertisement over CNI](/network-interconnect/classic-cni/set-up/configure-bgp-bfd/). +Aegis IPs are included within [BGP advertisement over CNI](/network-interconnect/). diff --git a/src/content/docs/aegis/configuration-options/access-cni.mdx b/src/content/docs/aegis/configuration-options/access-cni.mdx index 51f871dd0b1b37..89dc9875ad7cf1 100644 --- a/src/content/docs/aegis/configuration-options/access-cni.mdx +++ b/src/content/docs/aegis/configuration-options/access-cni.mdx @@ -13,6 +13,6 @@ While Access allows you to enforce policies at the hostname level, other solutio With Aegis IPs, you only allow a small number of IPs (that are not publicly listed) through your [network firewall](/aegis/configuration-options/network-firewall/). And with Cloudflare Network Interconnect, you can use a completely private path between Cloudflare and your application server, without exposure to the public Internet. -Aegis IPs are included within [BGP advertisement over CNI](/network-interconnect/classic-cni/set-up/configure-bgp-bfd/). +Aegis IPs are included within [BGP advertisement over CNI](/network-interconnect/). For details and background, refer to the [Cloudflare blog](https://blog.cloudflare.com/access-aegis-cni). diff --git a/src/content/docs/fundamentals/reference/partners.mdx b/src/content/docs/fundamentals/reference/partners.mdx index dbdf42a6dd4d38..7165242c630905 100644 --- a/src/content/docs/fundamentals/reference/partners.mdx +++ b/src/content/docs/fundamentals/reference/partners.mdx @@ -19,9 +19,7 @@ Learn how to configure a variety of products with Cloudflare Analytics: ## Cloudflare Network Interconnect -Connect your network infrastructure with Cloudflare network fabric partners for increased reliability and security. - - +Connect your network infrastructure with Cloudflare [network connectivity partners](/network-interconnect/get-started/#connectivity-partners) for increased reliability and security. ## Cloudflare Zero Trust Technology Partners @@ -35,7 +33,7 @@ Enterprise customers have access to detailed logs of the metadata generated by o -## ​​Cloudflare Technology Partners for Magic WAN +## Cloudflare Technology Partners for Magic WAN Cloudflare Magic WAN integrates with a number of third-party partners, which enables our users to securely route their Internet traffic. diff --git a/src/content/docs/magic-transit/network-interconnect.mdx b/src/content/docs/magic-transit/network-interconnect.mdx index d1e4d5a6111852..96ba24c053eb0e 100644 --- a/src/content/docs/magic-transit/network-interconnect.mdx +++ b/src/content/docs/magic-transit/network-interconnect.mdx @@ -10,12 +10,4 @@ head: import { Render } from "~/components"; - \ No newline at end of file + \ No newline at end of file diff --git a/src/content/docs/magic-wan/network-interconnect.mdx b/src/content/docs/magic-wan/network-interconnect.mdx index 5a627fe21434f3..23bfd27992d35d 100644 --- a/src/content/docs/magic-wan/network-interconnect.mdx +++ b/src/content/docs/magic-wan/network-interconnect.mdx @@ -10,14 +10,6 @@ head: import { Render } from "~/components"; - + diff --git a/src/content/docs/network-interconnect/about.mdx b/src/content/docs/network-interconnect/about.mdx deleted file mode 100644 index 376f347d304d04..00000000000000 --- a/src/content/docs/network-interconnect/about.mdx +++ /dev/null @@ -1,25 +0,0 @@ ---- -title: About -pcx_content_type: concept -sidebar: - order: 2 -head: - - tag: title - content: About Cloudflare Network Interconnect ---- - -Cloudflare supports a variety of options to connect your network to Cloudflare: - -- Direct CNI, for Magic WAN and Magic Transit. -- Classic CNI, for Magic Transit. -- Cloud CNI, for Magic WAN and Magic Transit. -- Peering via either an Internet exchange, or a private network interconnect (PNI). - -Below is a brief overview of the options to help you decide which method best fits your network. - -| Network interconnect mode | Use cases | Capabilities | -| --- | --- | --- | -| [Direct CNI](/network-interconnect/express-cni/) | Use for Magic WAN or Magic Transit, interconnecting directly with on-premise locations. | - 10, 100 Gbps
- Available at Direct CNI-capable Cloudflare locations
- No tunnel required
- Set up via dashboard in less than three minutes. | -| [Classic CNI](/network-interconnect/classic-cni/) | Use for Magic Transit, interconnecting directly or via a partner with on-premise locations. | - 10, 100 Gbps
- Available at classic CNI capable Cloudflare data centers
- Overlay GRE tunnel required for egress
- BGP route reflector signaling
- Setup facilitated by account team. | -| [Cloud CNI](/network-interconnect/cloud-cni/) | Use for Magic WAN or Magic Transit, interconnecting directly with virtual networks (VPCs) from public cloud providers. | - Speed depends on cloud provider
- Available at Cloud CNI capable Cloudflare locations
- Setup facilitated by account team. | -| [Peering, or private network interconnect (PNI)](/network-interconnect/pni-and-peering/) | Use for connecting your users to any Cloudflare services, via a more direct, performant and potentially cost-effective network path. | - No requirement to be a customer
- Speed depends on IX or PNI
- Available at PNI capable Cloudflare locations (PNI) and any Internet Exchange (IX) where Cloudflare peers today.
- Setup facilitated by `peering@cloudflare.com` | diff --git a/src/content/docs/network-interconnect/alerts.mdx b/src/content/docs/network-interconnect/alerts.mdx deleted file mode 100644 index 3e7ea19eb037d6..00000000000000 --- a/src/content/docs/network-interconnect/alerts.mdx +++ /dev/null @@ -1,15 +0,0 @@ ---- -title: Alerts -pcx_content_type: reference -sidebar: - order: 6 - ---- - -import { AvailableNotifications, Render } from "~/components" - -You can configure alerts to receive notifications for changes in your network. - - - - diff --git a/src/content/docs/network-interconnect/changelog.mdx b/src/content/docs/network-interconnect/changelog.mdx index 6c00c95ca88e2d..70e051c279d3fc 100644 --- a/src/content/docs/network-interconnect/changelog.mdx +++ b/src/content/docs/network-interconnect/changelog.mdx @@ -2,7 +2,7 @@ pcx_content_type: changelog title: Changelog sidebar: - order: 7 + order: 99 head: [] description: Review recent changes to Cloudflare Network Interconnect. --- diff --git a/src/content/docs/network-interconnect/classic-cni/alerts.mdx b/src/content/docs/network-interconnect/classic-cni/alerts.mdx deleted file mode 100644 index 9e5e1c64fb7425..00000000000000 --- a/src/content/docs/network-interconnect/classic-cni/alerts.mdx +++ /dev/null @@ -1,15 +0,0 @@ ---- -title: Alerts -pcx_content_type: how-to ---- - -Set up alerts for Classic CNI to be notified of routine maintenance that may affect your service. - -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account. -2. Go to **Notifications** > **Add**. -3. From the drop-down menu, select _Cloudflare Network Interconnect_. -4. Select **Connection Maintenance Alert**. -5. Enter a name for the notification and select your preferred alert method. -6. Select **Save**. - -You will now be alerted when there are routine maintenance events that impact Classic CNI. \ No newline at end of file diff --git a/src/content/docs/network-interconnect/classic-cni/index.mdx b/src/content/docs/network-interconnect/classic-cni/index.mdx deleted file mode 100644 index 0f88044f6b7c19..00000000000000 --- a/src/content/docs/network-interconnect/classic-cni/index.mdx +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Classic CNI -pcx_content_type: concept -sidebar: - order: 5 ---- - -## Types of interconnect - -Cloudflare supports two classic CNI connectivity options: direct and partner. The network interconnect is the link between your infrastructure and Cloudflare's network. - -The use case for classic CNI is Magic Transit. If your origins are behind Magic Transit over a classic CNI, then all Cloudflare services that work with public origins will run over the CNI (for example Load Balancer, WAF, Cache, etc). - -## Classic CNI (Direct) - -Direct connections are available at any of our [private peering facilities](https://www.peeringdb.com/net/4224). - -Choose a direct connection if you are co-located with a Cloudflare data center. We also recommend a direct connect if: - -- Your link size is 10G or higher -- You want higher throughput than a partner connection -- You want to eliminate as many intermediaries from an interconnect as possible - -### Limitations - -Classic CNI (Direct) supports 10G or 100G interfaces. - -## Classic CNI (Partner) - -Cloudflare partners with Equinix, Megaport, Console Connect, PacketFabric, Coresite, Epsilon and Zayo to provide circuits that easily connect you with Cloudflare at any of our interconnection platform locations. For more information about our partner program, see [Network Interconnect Partner Program](https://www.cloudflare.com/network-interconnect-partnerships/). - -Choose a partner connection when you are already using our partner providers or when you want a quick and easy way to onboard a secure cloud experience. - -### Limitations - -Classic CNI (Partner) bandwidth may be limited by the interconnection platform partner. diff --git a/src/content/docs/network-interconnect/classic-cni/set-up/configure-bgp-bfd.mdx b/src/content/docs/network-interconnect/classic-cni/set-up/configure-bgp-bfd.mdx deleted file mode 100644 index 04bbbac2058ce3..00000000000000 --- a/src/content/docs/network-interconnect/classic-cni/set-up/configure-bgp-bfd.mdx +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: BGP and Bidirectional Forwarding Detection -pcx_content_type: tutorial -sidebar: - order: 3 -head: - - tag: title - content: Configure the BGP session and Bidirectional Forward Detection - ---- - -You can use Border Gateway Protocol (BGP) with classic CNI if you are a Magic Transit customer. You can build a BGP session over your Classic CNI connection to signal when Cloudflare should advertise and anycast your IP prefixes for DDoS mitigation. You can also optionally use [Bidirectional Forwarding Detection (BFD)](#bfd) on this BGP session. - -## BGP - -### Configure the BGP session - -After establishing your connection, the next steps include provisioning the Generic Route Encapsulation (GRE) IPs and configuring the BGP peering information. This process takes approximately one week. - -### Provision the IP - -Cloudflare sends a set of IPs that you assign to your connection before Cloudflare establishes the BGP connection. The set of IPs will look similar to the example below. - -```txt -Cloudflare v4: 192.0.2.10/31 -Acme v4: 192.0.2.11/31 -Cloudflare v6: 2001:db8:12:3::7ac2:d64a/127 -Acme: 2001:db8:12:3::7ac2:d64b/127 -``` - -Assign the set of IPs to your connection. Next, perform a series of ping tests to ensure the connection is established. Although you may see the green connection from [configuring the cross-connect](/network-interconnect/classic-cni/set-up/configure-cross-connect/), the ping tests confirm [packets](https://www.cloudflare.com/learning/network-layer/what-is-a-packet/) are flowing over the link. - -If you have a virtual link via Megaport, the IP provisioning may fail if you have not configured the VLAN with the VLAN provided by your Customer Success Manager. - -### Configure the BGP session - -After you provision the IPs and the ping tests confirm the connection, accept the routes from the BGP session Cloudflare configured. Configuring the BGP session on both the Cloudflare and user sides requires a BGP call and an approximately two hour maintenance window that you provide to Cloudflare. - -Cloudflare advertises all of its available anycast prefixes, including [BYOIP](/byoip/) prefixes, over a private CNI link between Cloudflare and the customer data center. However, this can exclude other location-specific prefixes that may not be available at that datacenter. - -:::note -Your CNI needs to accept all of Cloudflare's prefixes to ensure it is fully utilized, and traffic routed from the data centers back to the CNI is secure, fast, and reliable. -::: - -After you accept the BGP session, traffic begins flowing over the CNI. To confirm traffic is flowing correctly, contact your solutions engineer who can see whether traffic is flowing. - -### Go live - -When traffic begins flowing over the connection, you are fully set up with CNI. - -## BFD - -Bidirectional Forwarding Detection (BFD) is a networking protocol that constantly monitors links and BGP sessions down to the second by sending a constant stream of traffic across the session. - -If a small number of packets do not make it to the other side of the session, the session is considered down. This solution is useful for users who cannot tolerate any amount of packet loss during a session. - -Bidirectional Forwarding Detection is only supported for users with direct connections. To begin using BFD, contact your account team. diff --git a/src/content/docs/network-interconnect/classic-cni/set-up/configure-cross-connect.mdx b/src/content/docs/network-interconnect/classic-cni/set-up/configure-cross-connect.mdx deleted file mode 100644 index 6c33f9f83abdc2..00000000000000 --- a/src/content/docs/network-interconnect/classic-cni/set-up/configure-cross-connect.mdx +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Configure the cross-connect -pcx_content_type: tutorial -sidebar: - order: 2 -head: - - tag: title - content: Configure the network cross-connect - ---- - -The Cloudflare infrastructure uses your information to configure the cross-connect. The configuration process varies slightly for physical and virtual links. This process can take one to two weeks, or longer depending on the provider. Your Customer Success Manager will remain in contact with you to ensure your cross-connect is on track. - -## Physical links - -To configure the network cross-connect for physical links, Cloudflare generates a Letter of Authorization (LOA)/service key - sometimes referred to as a Letter of Agency - and sends it to you. After you receive the LOA, you can: - -- Order cross-connects at the locations the LOA specifies. -- Verify when the cross-connects are complete. - -:::note -To review physical interconnection locations, see [Partners](/network-interconnect/classic-cni/set-up/partners/). -::: - -## Virtual Links - -To configure the network cross-connect for virtual links, you must create a request from the partner dashboard. Cloudflare will then review and accept the request. - -:::note -When using a virtual partner network interconnect, provision cross-connects using the appropriate partner portals. -For more information, see the [Cloudflare Network Interconnect Partner Program](https://www.cloudflare.com/network-interconnect-partnerships/). -::: - -### Follow your partner's instructions below - -- [Console Connect](/network-interconnect/classic-cni/set-up/partners/console-connect/) -- [Equinix Fabric](/network-interconnect/classic-cni/set-up/partners/equinix-fabric/) -- [Megaport](/network-interconnect/classic-cni/set-up/partners/megaport/) -- [PacketFabric](/network-interconnect/classic-cni/set-up/partners/packet-fabric/) -- CoreSite OCX (*coming soon*) -- Epsilon Infiny (*coming soon*) -- Zayo (*coming soon*) diff --git a/src/content/docs/network-interconnect/classic-cni/set-up/index.mdx b/src/content/docs/network-interconnect/classic-cni/set-up/index.mdx deleted file mode 100644 index 3a3a54436ea42b..00000000000000 --- a/src/content/docs/network-interconnect/classic-cni/set-up/index.mdx +++ /dev/null @@ -1,17 +0,0 @@ ---- -title: Setup -pcx_content_type: get-started -sidebar: - order: 4 -head: - - tag: title - content: Classic Network Interconnect Setup - ---- - -Setup starts with onboarding, which is broken out into a few steps. During onboarding, Cloudflare works closely with your organization to accomplish the onboarding tasks: - -- [Scope your configuration](/network-interconnect/classic-cni/set-up/scope-config/) (Kickoff call) -- [Configure the network cross-connect](/network-interconnect/classic-cni/set-up/configure-cross-connect/) (Duration: 1-2 weeks) -- [Configure Cloudflare Border Gateway Protocol (BGP)](/network-interconnect/classic-cni/set-up/configure-bgp-bfd/) (Duration: 1 week) -- [Go live](/network-interconnect/classic-cni/set-up/configure-bgp-bfd/#go-live) (Duration: 1-2 days) diff --git a/src/content/docs/network-interconnect/classic-cni/set-up/partners/console-connect.mdx b/src/content/docs/network-interconnect/classic-cni/set-up/partners/console-connect.mdx deleted file mode 100644 index 9ad9ec31c3ffc8..00000000000000 --- a/src/content/docs/network-interconnect/classic-cni/set-up/partners/console-connect.mdx +++ /dev/null @@ -1,18 +0,0 @@ ---- -title: Console Connect -pcx_content_type: tutorial -sidebar: - order: 2 -head: - - tag: title - content: Console Connect Users - ---- - -1. Select **+** to create a new connection. -2. From the **Choose source port** dropdown, choose your source port. -3. Select **Another Company**, and then enter **Cloudflare**. -4. For **Rate Limit (speed)**, choose your rate limit. -5. Select **Next**. -6. Review the pricing information, and when you are done, select **Save Payment**. -7. Cloudflare will accept the connection and your account team will get in touch with next steps for BGP session establishment. diff --git a/src/content/docs/network-interconnect/classic-cni/set-up/partners/equinix-fabric.mdx b/src/content/docs/network-interconnect/classic-cni/set-up/partners/equinix-fabric.mdx deleted file mode 100644 index 23bed6a2e8231e..00000000000000 --- a/src/content/docs/network-interconnect/classic-cni/set-up/partners/equinix-fabric.mdx +++ /dev/null @@ -1,25 +0,0 @@ ---- -title: Equinix Fabric -pcx_content_type: tutorial -sidebar: - order: 3 -head: - - tag: title - content: Equinix Users - ---- - -## Order an Equinix Fabric Connection - -After you confirm the locations and speed with your account team, order the Equinix Fabric connections to Cloudflare. - -1. Go to [Equinix Fabric](https://fabric.equinix.com/) -2. Under **I want to connect to:**, select **A Service Provider**. -3. Under **Select a Service Provider**, search for **Cloudflare** > **Select**. -4. Select **Magic Transit** or **Cloudflare NaaS**. If you are unsure, select **Cloudflare NaaS** which can be used to configure any service. -5. Under **Origin** > **Connect Using**, select your port. -6. Under **Destination**, select your location. If the location you want is not listed, contact your Cloudflare account team to request a new location under the Interconnect Anywhere program. -7. Under **Connection Information** > **VLAN ID**, enter a VLAN ID. Cloudflare chooses its own VLAN ID and Equinix Fabric maps between the two. To use the same VLAN ID as Cloudflare, ask your account team for Cloudflare's VLAN ID and they will provide it. -8. Select **Next** and then **Submit Order**. - -Cloudflare will accept the connection and your account team will contact you to establish the BGP session. diff --git a/src/content/docs/network-interconnect/classic-cni/set-up/partners/index.mdx b/src/content/docs/network-interconnect/classic-cni/set-up/partners/index.mdx deleted file mode 100644 index 87e7e6fc71cb6a..00000000000000 --- a/src/content/docs/network-interconnect/classic-cni/set-up/partners/index.mdx +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Technology Partners -pcx_content_type: reference -sidebar: - order: 4 -head: - - tag: title - content: Technology Partner Program - ---- - -## Classic CNI (Partner) - -Cloudflare partners with multiple network fabric providers to offer as many connectivity options and locations as possible. During the [configure the cross-connect](/network-interconnect/classic-cni/set-up/configure-cross-connect/) step, you will initiate a connection from your chosen provider's admin portal. - -:::note -You can read more about the partner program on our website. Refer to -the [Cloudflare Network Interconnect Partner Program](https://www.cloudflare.com/network-interconnect-partnerships/). -::: - -- [365 Partners](https://www.cloudflare.com/partners/technology-partners/365-data-centers/) -- [Console Connect](/network-interconnect/classic-cni/set-up/partners/console-connect/) -- [CoreSite](https://www.cloudflare.com/partners/technology-partners/coresite/) -- [Cyxtera](https://www.cloudflare.com/partners/technology-partners/cyxtera/) -- [Digital Realty](https://www.cloudflare.com/partners/technology-partners/digital-realty/) -- [Edge Connex](https://www.cloudflare.com/partners/technology-partners/edgeconnex/) -- [Epsilon](https://www.cloudflare.com/partners/technology-partners/epsilon/) -- [Equinix Fabric](/network-interconnect/classic-cni/set-up/partners/equinix-fabric/) -- [Megaport](/network-interconnect/classic-cni/set-up/partners/megaport/) -- [Netrality](https://www.cloudflare.com/partners/technology-partners/netrality/) -- [PacketFabric](/network-interconnect/classic-cni/set-up/partners/packet-fabric/) -- [Teraco](https://www.cloudflare.com/partners/technology-partners/teraco/) -- BBIX -- Databrink -- Zayo - -:::note -If you cannot find a Cloudflare port close to your infrastructure from your fabric provider's dashboard, contact `interconnection@cloudflare.com` to request a port closer to your location under the Interconnect Anywhere program. -::: diff --git a/src/content/docs/network-interconnect/classic-cni/set-up/partners/megaport.mdx b/src/content/docs/network-interconnect/classic-cni/set-up/partners/megaport.mdx deleted file mode 100644 index f8772ecdbe0af0..00000000000000 --- a/src/content/docs/network-interconnect/classic-cni/set-up/partners/megaport.mdx +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Megaport -pcx_content_type: tutorial -sidebar: - order: 4 -head: - - tag: title - content: Megaport Users - ---- - -## Create a VXC with a service key - -The Cloudflare account team creates the Service Key and sends it to you via email. After the Service Key is sent, anyone who has the key can use it to create a connection. - -1. Log in to the [Megaport Portal](https://portal.megaport.com/). - -2. Select **Megaport Marketplace** as the destination type. - -3. Search the destination ports for the service provider. - -4. Select a destination port. Typically, you should select the destination port closest to your port. - -5. Select **Next**. - -6. Specify these connection details: - - **Name your connection** - The name of your VXC shown in the Megaport Portal. - - **Invoice Reference (Optional)** - This can be any text, such as a PO number or billing reference number. - - **Rate Limit** - The speed of your connection in Mbps up to the maximum limit defined by the key. - - **Preferred A-End VLAN (Optional)** - Specifies an unused VLAN ID for the connection. This must be a unique VLAN ID on the Megaport and can range from `2` to `4093`. If you do not specify a value, Megaport assigns one. - - The B-End VLAN for the Cloudflare side termination automatically populates based on the service key. - -7. Select **Next**. A summary page appears that includes the monthly cost. - -8. Select **Back** to make changes or select **Add VXC** to move this configuration to your cart. Once you have finished this configuration, you can configure additional VXCs or proceed through the checkout process. - -Cloudflare will accept the connection and your account team will contact you to establish the BGP session. diff --git a/src/content/docs/network-interconnect/classic-cni/set-up/partners/packet-fabric.mdx b/src/content/docs/network-interconnect/classic-cni/set-up/partners/packet-fabric.mdx deleted file mode 100644 index a505d1522fc381..00000000000000 --- a/src/content/docs/network-interconnect/classic-cni/set-up/partners/packet-fabric.mdx +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: PacketFabric -pcx_content_type: tutorial -sidebar: - order: 5 -head: - - tag: title - content: PacketFabric Users - ---- - -1. From the PacketFabric dashboard, select **Marketplace**. -2. In the Search bar, enter **Cloudflare**. -3. Select **Cloudflare** as the provider. -4. From **Choose a Location**, choose a location from the dropdown. -5. Under **Select Source Port**, choose a port. -6. Under **Select Virtual Circuit Speed**, choose a speed from the dropdown. -7. Select **Place Order**. -8. Select **Okay** in the Virtual Circuit Request Dispatched notice. -9. Cloudflare will accept the connection and your account team will contact you to establish the BGP session. diff --git a/src/content/docs/network-interconnect/classic-cni/set-up/scope-config.mdx b/src/content/docs/network-interconnect/classic-cni/set-up/scope-config.mdx deleted file mode 100644 index fc4f7514ce9016..00000000000000 --- a/src/content/docs/network-interconnect/classic-cni/set-up/scope-config.mdx +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: Scope your configuration -pcx_content_type: tutorial -sidebar: - order: 1 - ---- - -Cloudflare engages with your organization in an initial kickoff call to confirm the scope and timeline for the classic CNI setup. To prepare for the initial kickoff call, have the configuration data for the type of cross-connect you want to use (direct physical or partner virtual) ready to provide to your Customer Success Manager. - -## Classic CNI (Direct) setup - -To set up a direct classic CNI connection, provide the following information: - -- Colocation facility where you want to connect. The location must be accessible from one of [Cloudflare's peering locations](https://www.peeringdb.com/net/4224). -- Port speeds. - -Cloudflare will issue you a Letter of Authorization for you to order a cross connect to fulfill your CNI. - -:::caution[Important] -To set up a cross-connect in a metropolitan area network (MAN) that does not have a physical Cloudflare location, you must purchase an Equinix Metro Connect or a similar product to interconnect locations. For example, if Cloudflare has a peering facility in NY5 and you are in NY1, you must use Metro Connect to cross-connect from NY1 to NY5. -::: - -## Classic CNI (Partner) setup - -To establish a classic CNI connection through a partner, provide the following information: - -- Locations to interconnect. You must choose locations supported by our [Network Interconnect Partner Program](https://www.cloudflare.com/network-interconnect-partnerships/). -- Preferred link size -- Number of VLANs -- Rate Limit - -Use one of our partner's dashboards to place the order, and the interconnect platform will establish the connection. diff --git a/src/content/docs/network-interconnect/cloud-cni.mdx b/src/content/docs/network-interconnect/cloud-cni.mdx deleted file mode 100644 index 6c7498cddc1c3e..00000000000000 --- a/src/content/docs/network-interconnect/cloud-cni.mdx +++ /dev/null @@ -1,23 +0,0 @@ ---- -title: Cloud CNI -pcx_content_type: concept -sidebar: - order: 4 ---- - -Cloud Interconnect allows you to connect your virtual private cloud (VPC) virtual networks directly with Cloudflare — for a more reliable and secure experience. - -Connecting to Cloudflare directly with a Cloud Interconnect reduces latency, makes your network more stable by bypassing Internet performance potential bottlenecks, and will often reduce your cloud provider network egress bandwidth charges. The use case for Cloud Interconnect is Magic WAN. - -## Supported cloud providers - -Cloudflare supports interconnect with: - -- Amazon Web Services (AWS) Direct Connect -- Google Cloud (GCP) Interconnect - -Azure ExpressRoute support is coming soon. - -## Cloud Interconnect Setup - -To create a new cloud interconnect, contact your customer success manager to get started with the set up. \ No newline at end of file diff --git a/src/content/docs/network-interconnect/express-cni/bgp-peering.mdx b/src/content/docs/network-interconnect/express-cni/bgp-peering.mdx deleted file mode 100644 index 656ba7f0d885d8..00000000000000 --- a/src/content/docs/network-interconnect/express-cni/bgp-peering.mdx +++ /dev/null @@ -1,10 +0,0 @@ ---- -pcx_content_type: concept -sidebar: - order: 3 -title: BGP peering ---- - -import { Render } from "~/components"; - - diff --git a/src/content/docs/network-interconnect/express-cni/create-interconnects.mdx b/src/content/docs/network-interconnect/express-cni/create-interconnects.mdx deleted file mode 100644 index d7af962ce19dbb..00000000000000 --- a/src/content/docs/network-interconnect/express-cni/create-interconnects.mdx +++ /dev/null @@ -1,8 +0,0 @@ ---- -title: Create interconnects -pcx_content_type: how-to -sidebar: - order: 2 ---- - -To create a new interconnect, contact your customer success manager to get started with the set up. \ No newline at end of file diff --git a/src/content/docs/network-interconnect/express-cni/index.mdx b/src/content/docs/network-interconnect/express-cni/index.mdx deleted file mode 100644 index 143e27f5da5e26..00000000000000 --- a/src/content/docs/network-interconnect/express-cni/index.mdx +++ /dev/null @@ -1,29 +0,0 @@ ---- -title: Direct CNI -pcx_content_type: concept -sidebar: - order: 3 ---- - -Direct CNI allows you to connect your network infrastructure directly with Cloudflare — rather than using the public Internet — for a more reliable and secure experience. - -Connecting to Cloudflare directly with a Direct CNI reduces latency, makes your network more stable by bypassing Internet performance potential bottlenecks, and may even reduce your ISP bandwidth bills. Direct CNI also gives you more control over how Cloudflare routes traffic back to your network. - -The use case for Direct CNI is Magic Transit or Magic WAN. If you have publicly routable origins that are behind Magic Transit over a Direct CNI, then all Cloudflare services that work with public origins will run over the CNI (for example, Load Balancer, WAF, Cache, etc). - -In the Cloudflare dashboard you can find Cloudflare's nearest Cloudflare data center, and order a Direct CNI connection with speeds up to 100 gigabits per second, as well as create a Letter of Authorization (LoA). - -## Supported connection types - -- Small Form-factor Pluggable (SFP) optics supported - - 10GBASE-LR optics will support up to 10 Km - - 100GBASE-LR4 optics will support up to 10 Km -- Maximum MTU is 1500 bytes - -### Limitations - -The following functionality is not yet supported on Direct CNI's dedicated ports. -- Virtual LAN (VLAN) tagging (802.1Q) -- Link Aggregation Control Protocol (LACP) and link aggregation (Use ECMP instead) -- Bidirectional Forwarding Detection (BFD) -- IPv6 (you cannot create CNIs in an account with IPv6 beta enabled) diff --git a/src/content/docs/network-interconnect/get-started.mdx b/src/content/docs/network-interconnect/get-started.mdx new file mode 100644 index 00000000000000..7d76e439f4f660 --- /dev/null +++ b/src/content/docs/network-interconnect/get-started.mdx @@ -0,0 +1,133 @@ +--- +pcx_content_type: get-started +title: Get started +sidebar: + order: 2 +--- + +import { Render } from "~/components" + +## Prerequisites + +### CNI port availability + +Eligibility for CNI and port availability is determined in coordination with your Cloudflare account team. Notably: + +- CNI ports are currently offered at no charge to Enterprise customers. Non-Enterprise customers (and any third party) may peer with Cloudflare via Internet Exchange/PNI according to our [open peering policy](https://www.cloudflare.com/peering-policy/). +- CNI provides benefits for certain Cloudflare products. Refer to [Product use cases](/network-interconnect/get-started/#product-use-cases) section to confirm that CNI is the right solution for your technical and business requirements. +- CNI is available in a subset of Cloudflare data centers: + - The type of dataplane offered in that location (v1.0 or v1.1) will determine specifications of the supported connection, such as the MTU. + - The diversity offered in the location will vary. + +### Product use cases + + + +### Technical specifications + +- **Supported port types (Direct CNI):** 10G-LR (single-mode fiber) and 100G-LR (single-mode fiber). +- **Distance limitations:** Cloudflare does not support optical links longer than 10 km. For longer distances, you must use intermediate hardware or a third-party provider to extend the connection. +- **IP addressing:** All CNI connections use a `/31` subnet for point-to-point IP connectivity between your router and Cloudflare's. +- **VLAN support:** CNI ports may be assigned a single 802.1Q VLAN tag. +- **MTU considerations:** + - **Dataplane 1.0:** Requires GRE tunneling for Magic Transit / WAN traffic, limiting the MTU to 1,476 bytes. + - **Dataplane 1.1:** Supports a native 1,500-byte MTU for traffic from Cloudflare to you (ingress), but still requires a 1,476-byte MTU for traffic from you to Cloudflare (egress). +- **Bidirectional Forwarding Detection (BFD):** BFD provides fast failure detection for BGP sessions and is supported on direct connections. To enable BFD, contact your account team. Note that BFD on a CNI does not impact the failover time for Magic Transit / WAN tunnels, which rely on separate health checks. + +#### Performance characteristics + +The following are the maximum throughput rates supported by the CNI connection. Actual performance will depend on your specific use case and configuration. + +| Direction (use case) | 10G Circuit | 100G Circuit | +|----------------------|-------------|--------------| +| From Cloudflare to Customer (all use cases) | Up to 10 Gbps | Up to 100 Gbps | +| From Customer to Cloudflare (peering use case) | Up to 10 Gbps | Up to 100 Gbps | +| From Customer to Cloudflare (Magic Transit/WAN) | Up to 1 Gbps per GRE tunnel over the CNI | Up to 1 Gbps per GRE tunnel over the CNI | + +### Service Expectations + +Consider the following service levels when planning your deployment: +- **No Formal SLA**: + - CNI is currently offered at no charge and without a formal Service Level Agreement (SLA). + - Cloudflare will work to restore CNI service in the event of a Cloudflare issue. In some Cloudflare data centers the recovery time could be several days. Therefore we always recommend backup connectivity to a different device or via an Internet tunnel. +- **Observability**: There is no visibility of the interconnect config/status within the Cloudflare dashboard. +- **Availability**: While network-resilient locations are designed to maintain connectivity during maintenance, single-homed locations can experience full service disruption. +- **Backup Connectivity**: You are required to maintain alternative Internet connectivity as a backup for all CNI implementations. + +## Location Alignment + +### Available Locations + +Direct connections are available at any Cloudflare data center where you are also located. Make sure to check whether the location of interest has the right dataplane version and diversity requirements for your use case. Refer to [available locations](/network-interconnect/static/cni-locations-04-08-2025.pdf) (PDF) for details. + +### Connectivity Partners + +Cloudflare partners with leading global providers, including: Console Connect, CoreSite, Digital Realty, Equinix Fabric, Megaport, PacketFabric, and Zayo. + +## End-to-End Implementation Workflow + +The process of provisioning a CNI can take several weeks, depending on the complexity and third-party provider timelines. The most common delays occur during the physical connection phase, which is outside of Cloudflare's direct control. + +1. **Submit Request**: Work with your account team to create a CNI request ticket, providing your desired CNI type, location, use case, and technical details. An Implementation Manager will be assigned to guide the process. +2. **Review Configuration**: The Implementation Manager will provide a detailed configuration document covering IP addressing, VLANs, and other technical specifications. You must review and approve this document. +3. **Order Connection**: + - For a Direct Interconnect, you will receive a Letter of Authorization (LOA) from Cloudflare to order the physical cross-connect from the data center facility operator. + - For a Partner Interconnect, you will use the provided details to order a virtual circuit from the partner's portal. +4. **Configure Network**: Both Cloudflare and your network team will configure the respective network devices according to the approved document. +5. **Test and Verify**: Once the connection is physically established, teams will perform basic connectivity tests (for example, ping) and verify that the BGP session can be established. +6. **Activate Services**: Configure your Cloudflare products (for example, Magic Transit) to route traffic over the new CNI. The Implementation Manager will verify end-to-end traffic flow before marking the deployment as complete. +7. [Add maintenance notifications](/network-interconnect/monitoring-and-alerts/#enable-cloudflare-status-maintenance-notification). +8. Enable tunnel health checks for Magic [Transit](/magic-transit/how-to/configure-tunnel-endpoints/#add-tunnels) / [WAN](/magic-wan/configuration/manually/how-to/configure-tunnel-endpoints/#add-tunnels). + +## How-To Guides + +### How-To: Provision a Direct Interconnect + +1. **Project Kickoff**: In an initial kickoff call, you will confirm the scope and timeline with Cloudflare. Be prepared to provide the following information: + - desired colocation facility + - required port speeds (10G or 100G) + - BGP ASN for Peering/Magic Transit + - BGP password (optional) +2. **Order Cross-Connect**: Cloudflare will issue a Letter of Authorization (LOA). This document grants you permission to order a physical cross-connect between your equipment and a specific port on Cloudflare's hardware within the data center. This process can take one to two weeks or more, depending on the facility provider. Cloudflare's demarcation is the port that is specified in the LOA: you are responsible for the deployment, provisioning and ongoing support and operation of this connection and the commercial relationships with the facility provider and any third-party connectivity providers. + +### How-To: Provision a Partner Interconnect + +Cloudflare partners with leading connectivity providers globally. To provision a Partner Interconnect, you will initiate a connection request from your chosen provider's administrative portal. Cloudflare will then review and accept the request to activate the virtual circuit. + +### How-To: Configure BGP and Routing + +Once your physical cross-connect or virtual circuit is provisioned, the next phase is to configure IP routing using Border Gateway Protocol (BGP). This process typically takes about one week to complete. + +#### Step 1: IP Address Provisioning + +1. Cloudflare will send you a set of IPv4 and IPv6 addresses for your connection. +2. Assign the provided IPs to your router's interface that connects to Cloudflare. +3. Perform ping tests between your router and Cloudflare's router to confirm that the physical or virtual link is active and passing packets correctly. + - **For Partner Interconnects**: If you are using a partner like Megaport, ensure you have configured the correct VLAN provided by your Customer Success Manager, as an incorrect VLAN can cause IP provisioning to fail. + +#### Step 2: BGP Session Establishment + +After you confirm connectivity with successful ping tests, the next step is to establish the BGP session. + +1. Cloudflare will configure its side of the BGP session, and notify you once ready. +2. You will configure your side of the BGP session and accept the routes. +3. Once the session is established, traffic will begin to flow over the CNI. Contact your solutions engineer to verify that traffic is routing as expected. + +#### BGP Configuration Options and Use Cases + +Depending on the Cloudflare services you use, your BGP configuration may vary: + +- **Standard Peering**: This is the most common scenario, where BGP is used to exchange routes between your network and Cloudflare. Cloudflare learns your network routes, which is useful for services like CDN-only deployments or on-demand Magic Transit. It is important to note that prefixes Cloudflare learns via CNI remain local to that specific data center and are not propagated to other Cloudflare locations. +- **Magic Transit with Controlled Advertisement**: Magic Transit customers can use a second BGP session to control which prefixes are advertised to the Internet. In this setup, Cloudflare advertises no prefixes to you, and you advertise only the specific prefixes you want Cloudflare to announce on your behalf. + +#### Important Note on Accepting Routes from Cloudflare + +If you wish to use the CNI for egress traffic from your network to Cloudflare-advertised prefixes (such as anycast or BYOIP addresses), you can accept the BGP prefixes you receive from Cloudflare (typically there will be around 4,000 routes advertised by Cloudflare). However, be aware that there is a 1 Gbps capacity limitation for traffic you send to Cloudflare over the CNI link. + +#### Optional: Bidirectional Forwarding Detection (BFD) + +For configurations that are highly sensitive to packet loss, Bidirectional Forwarding Detection (BFD) can be enabled to monitor link status on a sub-second basis. + +- BFD works by sending a rapid stream of small packets over the BGP session. If a few packets are lost, the link is immediately considered down, enabling faster failover. +- BFD is only supported for Direct Interconnect connections. Contact your account team to enable it. +- Note that enabling BFD on a CNI BGP session does not change the failover time for Magic Transit/WAN, which is controlled by its own tunnel health checks. \ No newline at end of file diff --git a/src/content/docs/network-interconnect/index.mdx b/src/content/docs/network-interconnect/index.mdx index 7732db633cc331..7dba6f78f095c3 100644 --- a/src/content/docs/network-interconnect/index.mdx +++ b/src/content/docs/network-interconnect/index.mdx @@ -8,7 +8,7 @@ head: content: Overview --- -import { Description, Plan, RelatedProduct } from "~/components" +import { Description, Plan, RelatedProduct, Render } from "~/components" Connect your network infrastructure directly to Cloudflare @@ -16,7 +16,41 @@ Connect your network infrastructure directly to Cloudflare -Cloudflare Network Interconnect (CNI) allows you to connect your network infrastructure directly with Cloudflare – rather than using the public Internet – for a more reliable and secure experience. With CNI, you can bring Cloudflare's full suite of network functions to your physical network edge. +Cloudflare Network Interconnect (CNI) allows you to connect your network infrastructure directly to Cloudflare — rather than using the public Internet — for a more reliable and secure experience. With CNI, you can bring Cloudflare's full suite of network functions to your physical network edge. + +## Why Use CNI? Key Benefits + +Enterprises use CNI to achieve: +- **Enhanced Performance**: Gain lower latency and more consistent network throughput. +- **Increased Security**: Reduce your network's attack surface by connecting privately and avoiding the public Internet. + +## Connection Types + +Choose the model that best fits your infrastructure and operational needs. + +| | Direct Interconnect | Partner Interconnect | +| - | - | - | +| **Port type** | A dedicated physical fiber connection between your network equipment and Cloudflare's hardware in a shared data center. | A virtual connection to Cloudflare established through one of our global connectivity partners. | +| **Operations** | You are responsible for procuring and managing the physical cross-connect to Cloudflare's equipment. | Your partner manages the connection logistics, often through a software-defined networking portal. | +| **Ideal use case** | For customers collocated with Cloudflare who require maximum control, performance, and reliability. | For customers who are not in the same data center as Cloudflare or prefer a managed connectivity solution. | + +## Dataplane + +Cloudflare's data centers may support one or more interconnect dataplanes. The dataplane is the type of equipment that terminates your direct connection: +- **Dataplane v1.0**: A peering connection to a Cloudflare edge data center that supports GRE tunnels for connecting with the Magic Networking overlay. +- **Dataplane v1.1**: An enhanced version of the 1.0 dataplane that supports GRE-less delivery for Magic Transit Direct Server Return. + +When you review the [available locations](/network-interconnect/static/cni-locations-04-08-2025.pdf) (PDF), you can see which dataplane version(s) are available. + +## Product Use Cases + + + +### Designing for high availability + +To protect against a single point of failure, it is critical to design your CNI deployment for resilience. For business-critical applications, seek Cloudflare locations that support diversity on the device level, which ensures your connections terminate on physically separate hardware. + +Refer to [Service Expectations](/network-interconnect/get-started/#service-expectations) for more information. *** diff --git a/src/content/docs/network-interconnect/monitoring-and-alerts.mdx b/src/content/docs/network-interconnect/monitoring-and-alerts.mdx new file mode 100644 index 00000000000000..58367c5820702f --- /dev/null +++ b/src/content/docs/network-interconnect/monitoring-and-alerts.mdx @@ -0,0 +1,50 @@ +--- +pcx_content_type: concept +title: Monitoring and alerts +sidebar: + order: 5 +--- + +import { Render } from "~/components" + +You can configure notifications for upcoming CNI maintenance events using the Notifications feature in the Cloudflare dashboard. It is recommended to subscribe to two types of notifications to stay fully informed. + +**CNI Connection Maintenance Alert (beta):** This alert informs you about maintenance events (scheduled, updated, or canceled) that directly impact your CNI circuits used with the Magic Networking overlay only. +- You will receive warnings up to two weeks in advance for maintenance impacting your Magic Transit/WAN CNI connections. +- You will be notified if the details of a scheduled maintenance change or if it is canceled. +- For recently added maintenance, notifications are sent after a six-hour delay to prevent alerting fatigue from minor adjustments. + +**Cloudflare Status Maintenance Notification:** This alert informs you about maintenance for an entire Cloudflare Point of Presence (PoP). While not specific to your CNI, this maintenance will impact all CNI services in that location, including connections that are being used only for peering use cases without Magic Networking. +- You will be warned about potentially disruptive maintenance at the PoP level. +- By default, you are notified for all event types (Scheduled, Changed, Canceled), but you can filter these. +- By default, you are notified for all Cloudflare PoPs, but you can filter for only the specific locations where you have CNI circuits. + +## How to Configure Alerts + +### Enable CNI Connection Maintenance Alert (beta) + +1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account. +2. Go to **Notifications**. +3. Select **Add**. +4. From the product drop-down menu, select **Cloudflare Network Interconnect**. +5. Select **Connection Maintenance Alert**. +6. Give your notification a name and an optional description. +7. Choose your preferred notification method (for example, email address). +8. Select **Save**. + +### Enable Cloudflare Status Maintenance Notification + +1. First, identify the PoP code for your CNI circuit: + - Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account. + - Navigate to **Magic Transit / WAN > Configuration > Interconnects**. + - Select the CNI you want to enable notifications for. + - In the menu that appears, note the Data Center code (for example, `gru-b`). +2. Now, configure the alert: + - Go to **Notifications** and select **Add**. + - From the product drop-down menu, select **Cloudflare Status**. + - Select **Maintenance Notification**. + - Give your notification a name and choose your notification method. + - Select **Next**. + - Optionally, use the **Filter on Event Type** to select only the event types you want to be alerted for (Scheduled, Changed, Canceled). + - In **Filter on Points of Presence**, enter the three-letter code for your PoP (for example, for `gru-b`, enter `gru`). You can add multiple PoPs, separated by commas. + - Select **Create**. diff --git a/src/content/docs/network-interconnect/operational-guidance.mdx b/src/content/docs/network-interconnect/operational-guidance.mdx new file mode 100644 index 00000000000000..73a1c4b4aa1327 --- /dev/null +++ b/src/content/docs/network-interconnect/operational-guidance.mdx @@ -0,0 +1,29 @@ +--- +pcx_content_type: concept +title: Operational guidance +sidebar: + order: 7 +--- + +import { Render } from "~/components" + +## Understanding Maintenance and Availability + +Also refer to [Monitoring and alerts](/network-interconnect/monitoring-and-alerts). + +Cloudflare performs regular network maintenance that may impact CNI connectivity. + +- **Maintenance Impact**: Maintenance windows average six hours. Customers who are not redundantly connected to diverse devices, for instance in single-homed PoPs, will experience a complete service disruption on CNI in that location. +- **Designing for Availability**: For critical applications, deploy CNI in locations that support diversity on the device level (multi-homed PoPs) to ensure protection against a single point of hardware failure and routine maintenance. Cloudflare does not guarantee coordinated maintenance between PoP locations. This means connecting to two different PoPs does not ensure protection against coincident service disruption. + +## Troubleshooting + +When facing connectivity problems, your first action should be to check for broader service disruptions. Visit `https://www.cloudflarestatus.com/` to see if any scheduled maintenance or active incidents are impacting services. This helps determine if the issue originates outside your network. Refer to [Monitoring and alerts](/network-interconnect/monitoring-and-alerts/). + +If no system-wide problems are reported, gather the following information before submitting a support case. Providing comprehensive details facilitates a faster resolution: + +- **Timeline**: When the issue began and ended (if applicable), including the timezone. +- **Identification**: The CNI IP address or point-to-point prefix for the impacted CNI. If your CNI is part of a Magic setup, please also provide the name of the Magic Transit/WAN interconnect as listed in your dashboard. +- **Physical Layer**: Light levels of the CNI link (if applicable). +- **Service Impact**: Confirmation whether Magic Transit / WAN traffic was affected. +- **Problem Description**: A clear summary of the issue (for example, CNI down, BGP session down, prefixes withdrawn). \ No newline at end of file diff --git a/src/content/docs/network-interconnect/pni-and-peering.mdx b/src/content/docs/network-interconnect/pni-and-peering.mdx deleted file mode 100644 index d7a2aa9d3d118d..00000000000000 --- a/src/content/docs/network-interconnect/pni-and-peering.mdx +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: PNI and peering setup -pcx_content_type: tutorial -reviewed: 2023-04-04 -sidebar: - order: 5 - ---- - -Cloudflare has an [open peering policy](https://www.cloudflare.com/peering-policy/). There is no requirement to be a Cloudflare customer for public peering, or a Private Network Interconnect (PNI). - -You can use BGP to peer with Cloudflare at any of the Public Internet Exchanges listed on [Cloudflare's PeeringDB page](https://www.peeringdb.com/net/4224). If you have many users accessing websites protected and proxied by Cloudflare, then peering with Cloudflare may help you remove bandwidth from your Internet transit links, and increase performance by reducing latency to Cloudflare. - -You may also optionally sign up for the [Cloudflare Peering Portal](https://www.cloudflare.com/partners/peering-portal/), which allows operators of public BGP Autonomous System Number (ASN) listed on PeeringDB to view where their network exchanges traffic with Cloudflare. Finally, if our networks exchange more than 1 Gbps of traffic in a single location, we can move your peering from the Internet Exchange to a Private Network Interconnect (PNI). - -If you operate a public autonomous system on the BGP table, and would like to peer with Cloudflare at a Public Internet Exchange listed on [Cloudflare's PeeringDB page](https://www.peeringdb.com/asn/13335), you can request peering by emailing `peering@cloudflare.com`. - -## PNI and peering setup - -You can use a peering portal, such as PeeringDB, to view and maintain your database of peering locations. - -Before you begin using PeeringDB, you must create an account and affiliate with Cloudflare. - -### Log in to the PeeringDB portal - -:::note -You must first [create PeeringDB portal account](https://www.peeringdb.com/register) before you can log in. -::: - -1. [Log in](https://www.peeringdb.com/account/login/?next=/register) to your account. -2. Ensure your email address is affiliated with the ASN you want to request access for. - Select the **OIDC PeeringDB** and follow the log in process. - -If you receive a message stating your account has not been affiliated with an organization, you will need to request affiliation. - -![Error message about missing organization affiliation](~/assets/images/network-interconnect/peeringdb-request-affiliation.png) - -When your affiliation is approved, **Cloudflare, Inc.** appears under **Existing affiliations** on your profile. - -![List of existing affiliations](~/assets/images/network-interconnect/peeringdb-affiliation-approved.png) - -### Request peer sessions - -Before you can request a peering session for an ASN, you must be an admin for that ASN. - -1. On the **ASN** page on [PeeringDB](https://www.peeringdb.com/), select **Users**. Confirm your email address in the **Admin** group. -2. From the **Peering Portal**, locate **Peering Locations**. -3. From the **Sessions** toggle, select **Potential**. - -The **Peer** button under **Peering Request** only appears active to admins. - -![Admin view of peering locations list](~/assets/images/network-interconnect/peeringdb-admin-view.png) - -Non-admin users will be unable to select **Peer** and hovering over the button will display a message about the need for admin access. - -![Non-admin view of peering locations list](~/assets/images/network-interconnect/peeringdb-nonadmin-view.png) diff --git a/src/content/docs/reference-architecture/architectures/sase.mdx b/src/content/docs/reference-architecture/architectures/sase.mdx index c6bba5de659d90..afb6c84aff9aa2 100644 --- a/src/content/docs/reference-architecture/architectures/sase.mdx +++ b/src/content/docs/reference-architecture/architectures/sase.mdx @@ -303,7 +303,7 @@ In situations where deploying the WAN Connector is not feasible or desirable, or There may also be situations where network-layer encryption is not necessary — for example, when a site's WAN-bound traffic is already encrypted at the application layer (via TLS), or when an IPsec network device offers very limited throughput performance as it encrypts and decrypts IPsec traffic. Under these circumstances, organizations can connect to the Cloudflare network using [GRE tunnels](/magic-wan/configuration/manually/how-to/configure-tunnel-endpoints/). -Organizations may also connect their network locations directly to the Cloudflare network via [Cloudflare Network Interconnect](https://www.cloudflare.com/network-services/products/network-interconnect/) (CNI). Cloudflare [supports a variety of options](/network-interconnect/about) to connect your network to Cloudflare: +Organizations may also connect their network locations directly to the Cloudflare network via [Cloudflare Network Interconnect](https://www.cloudflare.com/network-services/products/network-interconnect/) (CNI). Cloudflare [supports a variety of options](/network-interconnect/) to connect your network to Cloudflare: - Direct CNI for Magic WAN and Magic Transit - Classic CNI for Magic Transit diff --git a/src/content/partials/networking-services/cni-product-use-cases.mdx b/src/content/partials/networking-services/cni-product-use-cases.mdx new file mode 100644 index 00000000000000..b8c397ca6b9e32 --- /dev/null +++ b/src/content/partials/networking-services/cni-product-use-cases.mdx @@ -0,0 +1,16 @@ +--- +{} +--- + +CNI provides a private point-to-point IP connection with Cloudflare. There are two dataplanes that come with different technical specifications. + + +| | Dataplane v1.0 | Dataplane v1.1 | +| ---- | ---- | ---- | +| **Magic Transit Direct Server Return (DSR)**
DDoS protection for all ingress traffic from the Internet to your public network. Send egress traffic via your ISP. | Supported with a GRE tunnel established over the interconnect circuit. | Supported with or without a GRE tunnel established over the interconnect circuit. | +| **Magic Transit with Egress**
DDoS protection for all ingress traffic from the Internet to your public network. Send egress traffic via Cloudflare. | Supported with a GRE tunnel established over the interconnect circuit. | Supported with a GRE tunnel established over the interconnect circuit. | +| **Magic WAN and Zero Trust**
Build a secure, private network backbone connecting your Zero Trust users and applications with all your sites, data centers, and clouds. | Supported with a GRE tunnel established over the interconnect circuit. | Supported with or without a GRE tunnel established over the interconnect circuit. | +| **Peering**
Exchange public routes with a single Cloudflare PoP (Point of Presence). | Supported. All customers connecting with the edge data center will exchange public routes at that PoP with AS13335. Connectivity is established at each individual PoP. Routes for other edge locations in Cloudflare's network may not be available. Routes for customer-advertised prefixes will be available only in the connected PoP. | | +| **Application Security and Performance**
Improve the performance and security of your web applications | **Supported via peering**: Customers can use Argo Smart Routing to direct origin traffic via the edge peering connection when it is determined to be the lowest latency option. Customers must maintain a direct Internet connection which will always be used for a portion of traffic and during failure scenarios.
**Supported Via Magic Transit**: Customers may configure any product with an origin server IP address that is protected by Magic Transit. Magic Transit will direct this traffic via the overlay and customer can control interconnect next-hops using the Magic networking routing table. | | + +For more details refer to the [prerequisites section](/network-interconnect/get-started/#prerequisites). \ No newline at end of file diff --git a/src/content/partials/networking-services/magic-cni.mdx b/src/content/partials/networking-services/magic-cni.mdx index 33e507cec990d1..108430c7d6a4e8 100644 --- a/src/content/partials/networking-services/magic-cni.mdx +++ b/src/content/partials/networking-services/magic-cni.mdx @@ -1,65 +1,9 @@ --- -params: - - magic - - productName - - legacyHCLink +{} --- import { Aside, GlossaryTooltip } from "~/components"; Cloudflare Network Interconnect (CNI) allows you to connect your network infrastructure directly with Cloudflare — rather than using the public Internet — for a more reliable and secure experience. With CNI, you can bring Cloudflare's full suite of network functions to your physical network edge. -{ props.magic === "Magic Transit" && ( - <> -

Use Cloudflare Network Interconnect with Magic Transit to improve throughput and harden infrastructure to attack.

- - ) -} - -## Guidelines - -When working with { props.productName } and Cloudflare Network Interconnect (CNI), there are a few guidelines you should follow. - -### Direct CNI - -With [Direct CNI](/network-interconnect/express-cni/) you can use the Cloudflare dashboard to provision a connection to Cloudflare in three minutes or less. This type of connection supports IP packets with 1,500 bytes, both for ingress and egress traffic. - -With Direct CNI you can also setup BGP peering between your network and Cloudflare. - -#### Bidirectional health checks - -Bidirectional health checks do not work when you use Direct CNI to onboard your traffic to Cloudflare. You will need to resort to the legacy health check system. - -{ props.magic === "Magic WAN" && ( - <> - - - ) -} - -### Classic CNI - -With Classic CNI you need to [set up an onboarding process](/network-interconnect/classic-cni/) with Cloudflare. There is no self-serving option through the dashboard. - -{ props.magic === "Magic Transit" && ( - <> -

With Classic CNI, you can create:

-
    -
  • GRE tunnels over CNI: For ingress and egress traffic. To accommodate overhead from additional headers, you will need to set the MTU size of your GRE tunnel interface to 1,476 bytes and your MSS clamp to be 1,436 bytes. These are used to backhaul data from the data center where traffic is ingested — close to the end user — to the facility with the CNI link.
    • -
  • CNI connections without GRE tunnels: For ingress traffic from Cloudflare to customer device. There is no need to set MSS clamping, as this supports IP packets with 1,500 bytes.
    • -
- - ) -} - -{ props.magic === "Magic WAN" && ( - <> -

Magic WAN only supports GRE tunnels over CNI. To accommodate overhead from additional headers, you will need to set the MTU size of your GRE tunnel interface to 1,476 bytes and your MSS clamp to be 1,436 bytes. These are used to backhaul data from the data center where traffic is ingested — close to the end user — to the facility with the CNI link.

-

Magic WAN with Classic CNI does not support BGP for the private encapsulated traffic. You need to create policy-based routes to ensure traffic is routed correctly. Classic CNI does support BGP for the outer GRE packet, and this can be used for re-routing the tunnel over a backup CNI in the event of an issue with the primary.

- - ) -} - For more information about Network Interconnect, refer to the [Cloudflare Network Interconnect documentation](/network-interconnect/). diff --git a/src/content/partials/networking-services/reference/traffic-steering.mdx b/src/content/partials/networking-services/reference/traffic-steering.mdx index 4cdd4f605d038e..7c50684cd1d75a 100644 --- a/src/content/partials/networking-services/reference/traffic-steering.mdx +++ b/src/content/partials/networking-services/reference/traffic-steering.mdx @@ -327,7 +327,7 @@ For more on {props.productName} tunnel weights, contact your Cloudflare customer ## BGP information -When using a [Direct CNI](/network-interconnect/express-cni/) connection as an on-ramp, {props.productName} customers can also use BGP peering between their networks and their Magic routing table. +When using a [Direct CNI](/network-interconnect/) connection as an on-ramp, {props.productName} customers can also use BGP peering between their networks and their Magic routing table. Using BGP peering with a CNI allows customers to: @@ -344,7 +344,7 @@ With this functionality, customers can: {props.productName} BGP peering is with the Magic networking routing table (as opposed to peering with the Cloudflare Internet global network). BGP peers configured by following this guide will receive advertisements for all prefixes in the Magic routing table plus any additional prefixes configured in the per-interconnect Advertised prefix list. -If instead you are seeking to do public peering with the Cloudflare ASN 13335 at one of the Cloudflare data centers, refer to [PNI and peering setup](/network-interconnect/pni-and-peering/). Note that it is not currently possible to share Magic network BGP peering and PNI on the same physical interconnect port. +If instead you are seeking to do public peering with the Cloudflare ASN 13335 at one of the Cloudflare data centers, refer to [PNI and peering setup](/network-interconnect/). Note that it is not currently possible to share Magic network BGP peering and PNI on the same physical interconnect port. ### BGP route distribution and convergence diff --git a/src/content/partials/networking-services/routing/configure-routes.mdx b/src/content/partials/networking-services/routing/configure-routes.mdx index cd8041b2633245..f1aefbd6b934d4 100644 --- a/src/content/partials/networking-services/routing/configure-routes.mdx +++ b/src/content/partials/networking-services/routing/configure-routes.mdx @@ -255,7 +255,7 @@ Example: ## Configure BGP routes -BGP peering is available when using a [Direct CNI](/network-interconnect/express-cni/) as an on-ramp. +BGP peering is available when using a [Direct CNI](/network-interconnect/) as an on-ramp. ### Choose an ASN for BGP peering