You can install up to two Magic WAN Connectors for redundancy at each of your sites. If one of your Connectors fail, traffic will fail over to the other Connector ensuring that you never lose connectivity to that site.
In this type of high availability (HA) configuration, you will choose a reliable LAN interface as the HA link which will be used to monitor the health of the peer connector. HA links can be dedicated links or can be shared with other LAN traffic.
You must decide the type of configuration you want for your site from the beginning: no redundancy or with redundancy. You cannot add redundancy after finishing configuring your dashboard settings. If, at a later stage, you decide to enable redundancy, you will need to delete your site configuration in the Cloudflare dashboard, and start again.
Do you need a high availability configuration?
If you need a high availability configuration for your premises, refer to About high availability configurations for more information and learn how to configure your Connector in this mode.
If you do not need a high availability configuration for you premises, proceed to Set up Cloudflare dashboard.
You need to purchase Magic WAN ↗ before you can purchase and use the Magic WAN Connector. The Magic WAN Connector can function as your primary edge device for your network, or be deployed in-line with existing network gear.
You also need to purchase a Magic WAN Connector before you can start configuring your settings in the Cloudflare dashboard. After buying a Magic WAN Connector, the device will be registered with your Cloudflare account and show up in your Cloudflare dashboard.
Contact your account representative to learn more about purchasing options for the Magic WAN Connector device.
The hardware version of the Magic WAN connector includes two SFP+ ports ↗ that support 10G throughput, as well as six RJ45 ports that support 1G throughput.
Refer to SFP+ port information for details on this topic.
Sites represent the local network where you have installed your Magic WAN Connector — for example, a branch office location.
You need to create a site and set up all the settings associated with it before you can connect your Magic WAN Connector to the Internet.
To add a site:
Create a POST request using the API to create a site.
Example:
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/sites \--header "X-Auth-Email: <EMAIL>" \--header "X-Auth-Key: <API_KEY>" \--header "Content-Type: application/json" \--data '{ "name": "<SITE_NAME>" "description": "<SITE_DESCRIPTION>",}'{ "result": { "site": { "id": "<SITE_ID>", "name": "<SITE_NAME>", "description": "<SITE_DESCRIPTION>", "connector_id": null, "secondary_connector_id": null, "ha_mode": false } }, "success": true, "errors": [], "messages": []}Take note of the site id parameter, as you will need it to create WANs and LANs.
GE1, GE2, GE3, GE4, GE5, and GE6. Choose the number corresponding to the port that you are using in Connector. 0 and 4094 to specify a VLAN ID.
Create a POST request using the API to create a WAN.
The static_addressing object is optional. Omit it if you are using DHCP. If you are using static addressing, add the secondary_address parameter when your site is in high availability (HA) mode.
Example:
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/sites/{site_id}/wans \--header "X-Auth-Email: <EMAIL>" \--header "X-Auth-Key: <API_KEY>" \--header "Content-Type: application/json" \--data '{ "name": "<YOUR_WAN_NAME>", "physport": 1, "priority": 0, "vlan_tag": 0}'In LAN configuration, select Create.
Enter a descriptive name for your LAN in Interface name.
Interface number refers to the physical Magic WAN Connector Ethernet port that you are using for your LAN. The ports are labeled GE1, GE2, GE3, GE4, GE5, and GE6. Choose a number corresponding to the port that you are using in Connector.
If you need a throughput higher than 1 Gbps, you can use one of the SFP+ ports. Refer to SFP+ port information for more information on the hardware supported.
In VLAN ID, specify a VLAN ID to create virtual LANs.
In Static addressing > Static address give your Connector's LAN interface its IP address. You can also enable the following options if they suit your use case:
(Optional) In Directly attached subnet > Static NAT prefix, enter a CIDR prefix to enable NAT (network address translation). The prefix you enter here should be the same size as the prefix entered in Static addressing. For example, both networks have a subnet mask of /24: 192.168.100.0/24 and 10.10.100.0/24.
(Optional) If your LAN contains additional subnets behind a layer 3 router, select Add routed subnet under Routed subnets to add them:
Prefix: The CIDR prefix for the subnet behind the L3 router.
Next hop: The address of the L3 router to which the Connector should forward packets for this subnet.
Static NAT prefix: Optional setting. If you want to enable NAT for a routed subnet, supply an "external" prefix for the overlay-facing side of the NAT to use. It must be the same size as Prefix.
Refer to Routed subnets for more information.
Select Save.
Select Save and exit to finish your configuration. Tunnels and static routes will be automatically created and associated with your site once the Magic WAN Connector boots up (refer to the next step).
Create a POST request using the API to create a LAN.
Example:
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/sites/{site_id}/lans \--header "X-Auth-Email: <EMAIL>" \--header "X-Auth-Key: <API_KEY>" \--header "Content-Type: application/json" \--data '{ "name": "<YOUR_LAN_NAME>", "physport": 2, "static_addressing": { "address": "172.16.14.0/24" }, "vlan_tag": 0}'After setting up your LANs, you can configure your Connector to enable communication between them without traffic leaving your premises. Refer to Network segmentation for more information.
Magic WAN Connector supports different types of DHCP configurations. Connector can:
Refer to DHCP options to learn more.
There are several deployment options for Magic WAN Connector. Connector can act like a DHCP server for your local network, or integrate with your local setup and have static IP addresses assigned to it.
When Connector acts like the WAN router for your site, deployment will be something like this:
flowchart LR
accTitle: Magic WAN Connector set up as a DHCP server, and connecting to the Internet.
a(Magic WAN Connector)--> b(Internet) --> c(Cloudflare)
subgraph Customer site
d[LAN 1] --> a
e[LAN 2] --> a
end
classDef orange fill:#f48120,color: black
class a,c orange
In the example below, the Connector sits behind the WAN router in your site, and on-ramps only some of the existing LANs to Cloudflare.
flowchart LR
accTitle: Magic WAN Connector connects to the router in the site, and only some of the LANs connect to Connector.
a(Magic WAN Connector)--> b((Site's router)) --> c(Internet) --> i(Cloudflare)
subgraph Customer site
d[LAN 1] --> a
e[LAN 2] --> a
g(LAN 3) --> b
h(LAN 4) --> b
end
classDef orange fill:#f48120,color: black
class a,i orange
Refer to Magic WAN Connector deployment options for a high-level explanation of the deployment options that make sense to most environments, as well as a few advanced use cases.
If there is a firewall deployed upstream of the Magic WAN Connector, configure the firewall to allow the following traffic:
| Protocol/port | Destination IP/URL | Purpose |
|---|---|---|
UDP/53 | DNS destination IP 1.1.1.1 | Needed to allow DNS traffic to Cloudflare DNS servers. Cloudflare uses this port for DNS lookups of control plane API |
TCP/443 | - | The Connector will open outbound HTTPS connections over this port for control plane operations. |
UDP/4500 | Destination IP 162.159.64.1 | Needed for Connector's initialization and discovery traffic through outbound connections. |
UDP/4500 | Destination IP - Cloudflare anycast IPs | Needed for the Cloudflare anycast IPs assigned to your account for tunnel outbound connections. This traffic is tunnel traffic. |
TCP/7844, UDP/7844 | Outbound connections | This is for debugging facilities in the Connector. |
UDP/123 | http://time.cloudflare.com/ | Needed for Magic WAN Connector to periodically contact Cloudflare's Time Services. |
The Magic WAN Connector is shipped to you deactivated, and will only establish a connection to the Cloudflare network when it is activated. Cloudflare recommends leaving it deactivated until you finish setting it up in the dashboard.
When the Connector is first activated, one of the ports must be connected to the Internet through a device that supports DHCP. This is required so that the Connector can reach the Cloudflare global network and download the required configurations that you set up in the site configuration step.
When you are ready to connect your Magic WAN Connector to the Cloudflare network:
After activating your Connector, you can use it in a network configuration with the WAN interface set to a static IP address — that is, an Internet configuration that is not automatically set by DHCP.
To use your Connector on a network configuration with a static IP:
When you set up a site in high availability, the WANs and LANs in your Connectors have the same configuration but are replicated on two nodes. In case of failure of a Connector, the other Connector becomes the active node, taking over configuration of the LAN gateway IP and allowing traffic to continue without disruption.
Because Connectors in high availability configurations share a single site, you need to set up:
Make sure all IPs are part of the same subnet.
You cannot enable high availability for an existing site. To add high availability to an existing site in the Cloudflare dashboard, you need to delete the site and start again.
To set up a high availability configuration:
192.168.10.1/24.192.168.10.2/24.192.168.10.3/24.Magic WAN Connector automatically creates IPsec tunnels and static routes for you. You cannot configure these manually.
To check the IPsec tunnels and static routes created by your Magic WAN Connector: