Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file modified public/network-interconnect/static/cni-locations-30-10-2025.pdf
Binary file not shown.
17 changes: 8 additions & 9 deletions src/content/docs/network-interconnect/get-started.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,9 @@ Eligibility for CNI and port availability is determined in coordination with you
- CNI ports are currently offered at no charge to Enterprise customers.
- Non-Enterprise customers (and any third party) may peer with Cloudflare via Internet Exchange according to our [open peering policy](https://www.cloudflare.com/peering-policy/).
- CNI is available at select Cloudflare data centers:
- The type of dataplane offered in that location (v1 or v1.1) will determine specifications of the supported connection, such as the MTU.
- The type of dataplane offered in that location will determine specifications of the supported connection, such as the MTU.
- The diversity offered in the location will vary.
- Customers must have a BGP session established for CNI v1/1.1 to be operational.
- Customers must have a BGP session established for CNI v1 to be operational.

### Product use cases

Expand All @@ -27,22 +27,21 @@ Eligibility for CNI and port availability is determined in coordination with you
### Technical specifications

- **Supported port types (Direct CNI)**:
- **Dataplane v1 & v1.1**: 10GBASE-LR (single-mode fiber) and 100GBASE-LR (single-mode fiber).
- **Dataplane v1**: 10GBASE-LR (single-mode fiber) and 100GBASE-LR (single-mode fiber).
- **Dataplane v2 (beta)**: 10GBASE-LR (single-mode fiber) and 100GBASE-LR4 (single-mode fiber) optics are supported.
- **Distance limitations:** Cloudflare does not support optical links longer than 10 km. For longer distances, you must use intermediate hardware or a third-party provider to extend the connection.
- **IP addressing:** All Direct and Partner CNI connections use a `/31` subnet for point-to-point IP connectivity between your router and Cloudflare.
- **VLAN support:**
- **Dataplane v1 & v1.1**: CNI ports may be assigned a single 802.1Q VLAN tag.
- **Dataplane v1**: CNI ports may be assigned a single 802.1Q VLAN tag.
- **Dataplane v2 (beta)**: VLAN tagging (802.1Q) and QinQ are not yet supported.
- **MTU considerations:**
- **Dataplane v1**: Requires GRE tunneling for Magic Transit / WAN traffic, limiting the MTU to 1,476 bytes.
- **Dataplane v1.1**: Supports a native 1,500-byte MTU for traffic from Cloudflare to you (ingress), but still requires a 1,476-byte MTU for traffic from you to Cloudflare (egress).
- **Dataplane v1**: Supports a native 1,500-byte MTU for traffic from Cloudflare to you (ingress), but still requires a 1,476-byte MTU for traffic from you to Cloudflare (egress).
- **Dataplane v2 (beta)**: Supports a maximum MTU of 1,500 bytes bidirectionally with no GRE requirement.
- **Bidirectional Forwarding Detection (BFD):**
- **Dataplane v1 & v1.1**: BFD provides fast failure detection for BGP sessions and is supported on direct connections. To enable BFD, contact your account team. Note that BFD on a CNI does not impact the failover time for Magic Transit / WAN tunnels, which rely on separate health checks.
- **Dataplane v1**: BFD provides fast failure detection for BGP sessions and is supported on direct connections. To enable BFD, contact your account team. Note that BFD on a CNI does not impact the failover time for Magic Transit / WAN tunnels, which rely on separate health checks.
- **Dataplane v2 (beta)**: Not yet supported.
- **Link Aggregation Control Protocol (LACP)**:
- **Dataplane v1 & v1.1**: To increase bandwidth and provide link resiliency, Cloudflare supports combining multiple physical CNI ports into a single logical channel using Link Aggregation Control Protocol (LACP). You can bundle multiple connections to increase total throughput and add redundancy to your private connection with Cloudflare.
- **Dataplane v1**: To increase bandwidth and provide link resiliency, Cloudflare supports combining multiple physical CNI ports into a single logical channel using Link Aggregation Control Protocol (LACP). You can bundle multiple connections to increase total throughput and add redundancy to your private connection with Cloudflare.
- **Dataplane v2 (beta)**: Not yet supported. Use ECMP instead.

### Performance characteristics
Expand All @@ -53,7 +52,7 @@ The following are the maximum throughput rates supported by the CNI connection.
|----------------------|-------------|--------------|
| From Cloudflare to Customer (all use cases) | Up to 10 Gbps | Up to 100 Gbps |
| From Customer to Cloudflare (peering use case) | Up to 10 Gbps | Up to 100 Gbps |
| From Customer to Cloudflare (Magic Transit/WAN) | &#x2022; **v1 & v1.1**: Up to 1 Gbps per GRE tunnel over the CNI <br /> &#x2022; **v2 (beta)**: Up to 1 Gbps per CNI connection | &#x2022; **v1 & v1.1**: Up to 1 Gbps per GRE tunnel over the CNI <br /> &#x2022; **v2 (beta)**: Up to 1 Gbps per CNI connection |
| From Customer to Cloudflare (Magic Transit/WAN) | &#x2022; **v1**: Up to 1 Gbps per GRE tunnel over the CNI <br /> &#x2022; **v2 (beta)**: Up to 1 Gbps per CNI connection | &#x2022; **v1**: Up to 1 Gbps per GRE tunnel over the CNI <br /> &#x2022; **v2 (beta)**: Up to 1 Gbps per CNI connection |

### Service expectations

Expand Down
4 changes: 1 addition & 3 deletions src/content/docs/network-interconnect/index.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -37,11 +37,9 @@ Choose the model that best fits your infrastructure and operational needs.
## Dataplane

Cloudflare's data centers may support one or more interconnect dataplanes. The dataplane is the type of equipment that terminates your direct connection:
- **Dataplane v1**: A peering connection to a Cloudflare edge data center that supports GRE tunnels for connecting with the Magic Networking overlay.
- **Dataplane v1.1**: An enhanced version of the v1 dataplane that supports GRE-less delivery for Magic Transit Direct Server Return.
- **Dataplane v1**: A peering connection to a Cloudflare edge data center that supports GRE tunnels for connecting with the Magic Networking overlay, with optional GRE-less delivery for Magic Transit Direct Server Return.
- **Dataplane v2 (beta)**: Is based on the Customer Connectivity Router (CCR), which is specifically designed for customer connectivity. It provides simplified routing without GRE tunneling and supports a 1,500-byte MTU bidirectionally.


When you review the [available locations](/network-interconnect/static/cni-locations-30-10-2025.pdf) (PDF), you can see which dataplane version(s) are available.

## Product use cases
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,11 @@
CNI provides a private point-to-point IP connection with Cloudflare. There are two dataplanes that come with different technical specifications.


| | Dataplane v1 & 1.1 | Dataplane v2 (beta) |
| | Dataplane v1 | Dataplane v2 (beta) |
| ---- | ---- | ---- |
| **Magic Transit Direct Server Return (DSR)** <br /> DDoS protection for all ingress traffic from the Internet to your public network. Send egress traffic via your ISP. | Supported with a GRE tunnel established over the interconnect circuit. For v1.1, supported with or without a GRE tunnel established over the interconnect circuit. | Supported. |
| **Magic Transit with Egress** <br /> DDoS protection for all ingress traffic from the Internet to your public network. Send egress traffic via Cloudflare. | Supported with a GRE tunnel established over the interconnect circuit. For v1.1, supported with or without a GRE tunnel established over the interconnect circuit. | Supported. |
| **Magic WAN and Zero Trust** <br /> Build a secure, private network backbone connecting your Zero Trust users and applications with all your sites, data centers, and clouds. | Supported with a GRE tunnel established over the interconnect circuit. For v1.1, supported with or without a GRE tunnel established over the interconnect circuit. | Supported. |
| **Magic Transit Direct Server Return (DSR)** <br /> DDoS protection for all ingress traffic from the Internet to your public network. Send egress traffic via your ISP. | Supported with or without a GRE tunnel established over the interconnect circuit. | Supported. |
| **Magic Transit with Egress** <br /> DDoS protection for all ingress traffic from the Internet to your public network. Send egress traffic via Cloudflare. | Supported with or without a GRE tunnel established over the interconnect circuit. | Supported. |
| **Magic WAN and Zero Trust** <br /> Build a secure, private network backbone connecting your Zero Trust users and applications with all your sites, data centers, and clouds. | Supported with or without a GRE tunnel established over the interconnect circuit. | Supported. |
| **Peering** <br /> Exchange public routes with a single Cloudflare PoP (Point of Presence). | Supported. <br /><br /> All customers connecting with the edge data center will exchange public routes at that PoP with AS13335. Connectivity is established at each individual PoP. Routes for other edge locations in Cloudflare's network may not be available. Routes for customer-advertised prefixes will be available only in the connected PoP. | Not supported. |
| **Application Security and Performance** <br /> Improve the performance and security of your web applications | **Supported via peering**: Customers can use Argo Smart Routing to direct origin traffic via the edge peering connection when it is determined to be the lowest latency option. Customers must maintain a direct Internet connection which will always be used for a portion of traffic and during failure scenarios. <br /> **Supported Via Magic Transit**: Customers may configure any product with an origin server IP address that is protected by Magic Transit. Magic Transit will direct this traffic via the overlay and customer can control interconnect next-hops using the Magic networking routing table. | When the origin IPs are behind Magic Transit over a CNI v2, all Cloudflare services that work with public origins (like Load Balancer, WAF, Cache) will run over the CNI. |

Expand Down