🌐 Trang này chưa được dịch sang tiếng Việt — đang hiển thị nội dung tiếng Anh.

Module 8 — Cloudflare WAN (Connect Offices & Data Centers)

Goal: Connect entire sites — offices, data centers, cloud networks — to Cloudflare, so all their traffic (not just laptops with the WARP app) is routed and protected, replacing expensive MPLS links and site-to-site VPN meshes.

⚠️ This module touches production networking. Schedule a maintenance window, have console access to your router, and a rollback plan. Do one site first.

We'll do: (0) pre-flight MSS → (A) pick an on-ramp → (B) build tunnels → (C) routing → (D) security → (E) test & failover.

Part 0 — Pre-flight: MSS clamping (don't skip this!)

Because Cloudflare wraps your packets in an extra header, large packets can get silently dropped unless you cap the TCP segment size (MSS) on your edge device.

Set this on your router/firewall before bringing tunnels up:

Example (Cisco): ip tcp adjust-mss 1436 · (Juniper): set …​ tcp-mss 1436

⚠️ The classic symptom of forgetting this: plain http:// sites work but https:// sites hang or time out. If you see that later, come back here.

Part A — Choose your on-ramp

Pick how each site connects:

This guide walks through an IPsec tunnel (most common with existing firewalls). GRE is nearly identical.

Part B — Build the tunnels (with redundancy)

⭐ Always build TWO tunnels from TWO separate routers at each site. Cloudflare's side is "anycast" — one tunnel already reaches every Cloudflare location — so redundancy is about protecting against your hardware failing.

Step B1 — Create the first IPsec tunnel in Cloudflare

1. 👉 Cloudflare dashboard → Cloudflare WAN → Configuration → Tunnels.
2. 👉 Click Create → IPsec tunnel.
3. ⌨️ Fill in:

   Field	Value
   Tunnel name	hq-london-fw1
   Customer endpoint	your firewall's public IP (leave blank if behind NAT)
   Cloudflare endpoint	the anycast IP Cloudflare assigns you
   Interface address	the small /31 Cloudflare provides for the tunnel
   Pre-shared key (PSK)	click generate, or paste your own — store it safely
   Health check	On (recommended)

4. 👉 Click Save.

Step B2 — Match these settings on your firewall

Configure the matching IPsec tunnel on your device using exactly these:

(NAT traversal on UDP 500→4500 is handled automatically.)

Step B3 — Repeat for the second tunnel

👉 Create hq-london-fw2 on your second router and a matching second tunnel in Cloudflare.

✅ Checkpoint: In Cloudflare WAN → Tunnels, both tunnels show Healthy (health checks passing).

Part C — Tell Cloudflare how to route your networks

1. 👉 Cloudflare WAN → Configuration → Routes.
2. Choose your approach:

Option 1 — Static routes (simple, stable sites)

1. 👉 Click Create route.
2. ⌨️ Fill in:

   Field	Value
   Prefix	your site's subnet, e.g. 10.10.0.0/16
   Tunnel / next hop	hq-london-fw1
   Priority	100 (lower = preferred)
   Weight	for sharing load across both tunnels (ECMP)

3. 👉 Add a matching route via hq-london-fw2 (e.g. priority 100 too, for load-sharing, or 200 for standby).

Option 2 — BGP (recommended for multiple/changing sites)

1. 👉 Enable BGP on the tunnel and configure an eBGP peer: your router's ASN, Cloudflare's ASN, and an MD5 password.
2. 📺 Routes are now exchanged automatically — add a subnet at the site and it propagates without dashboard edits.

⚠️ Watch out: Plan your IP space. If two sites use overlapping subnets (e.g. both 192.168.1.0/24), Cloudflare WAN routing breaks. Re-IP or use unique ranges.

✅ Checkpoint: Your site subnets appear in the Magic routing table, reachable via the tunnels.

Part D — Add security & send traffic through Gateway

1. Firewall the network traffic: 👉 go to Magic Firewall → Create rule to allow/deny traffic at the network layer (L3/L4). ⚠️ Until you add rules, this network traffic is unfiltered.
2. Apply your web policies to the whole site: route the site's internet-bound traffic through Gateway so the DNS/HTTP/DLP policies from Modules 5–6 protect every device at the site — even those without the WARP app.
3. Get alerted: 👉 Cloudflare Notifications → Add → Magic Tunnel Health → pick your tunnels → add recipients, so you hear about a tunnel problem before users do.

Part E — Test and prove failover

Test 1 — connectivity

1. 👉 From a machine at the site, reach something across the tunnel (another site, or the internet via Cloudflare).
2. 👉 Run curl http://ifconfig.me and curl https://ifconfig.me.
3. 📺 Both should return quickly. If http works but https hangs → your MSS clamp is wrong (Part 0).

Test 2 — failover

1. 👉 Disable the first tunnel (or take router 1 offline) in a controlled test.
2. 📺 Traffic should re-converge over the second tunnel within seconds; the dashboard marks tunnel 1 unhealthy.
3. 👉 Re-enable it and confirm it recovers.

✅ Checkpoint: Site connectivity works, HTTPS is healthy (MSS correct), failover works, and site traffic is filtered by Gateway. 🎉

✅ Module 8 complete!

You now have:

• ✅ MSS clamping set correctly
• ✅ Redundant tunnels (two routers) showing healthy
• ✅ Routing configured (static or BGP) with a clean IP plan
• ✅ Magic Firewall rules + site traffic flowing through Gateway
• ✅ Verified connectivity and failover, plus health alerts

Quick troubleshooting

🏁 You've reached the end of the onboarding!

Go back to the Master checklist and confirm every box is ticked. Final go-live items:

• [ ] Logs flowing to your SIEM (Logpush)
• [ ] Pilot validated, rollout expanded company-wide
• [ ] Old VPN decommissioned for migrated apps
• [ ] Renewal reminders set for any IdP client secrets / certificates

Congratulations — you've deployed Cloudflare Zero Trust end to end. 🎉