Cloudflare recommends two tunnels for each ISP and network location router combination, one per Cloudflare endpoint. Shortly after your onboarding kickoff call, Cloudflare will assign two Cloudflare endpoint addresses that you can use as the tunnel destinations on your network location's routers/endpoints.

To configure the tunnels between Cloudflare and your locations, you must provide the following data for each tunnel:

* **Tunnel name**: For GRE tunnels, the name must have 15 or fewer characters. IPsec tunnels have no character limit. For both GRE and IPsec tunnels, the name cannot contain spaces or special characters, and cannot be shared with other tunnels.

* **Cloudflare endpoint address**: The public IP address of the Cloudflare side of the tunnel.

* **Customer endpoint**: A public Internet routable IP address which is outside of the prefixes that Cloudflare will advertise on your behalf. These are generally IP addresses provided by your ISP. If you intend to use a physical or virtual connection like [Cloudflare Network Interconnect](https://developers.cloudflare.com/network-interconnect/), you do not need to provide endpoints because Cloudflare will provide them.\
  This value is not required for IPsec tunnels, unless your router is using an Internet Key Exchange (IKE) ID of type `ID_IPV4_ADDR`.

* **Interface address**: A 31-bit (recommended) or 30-bit subnet (`/31` or `/30` in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space:

  * `10.0.0.0/8`

  * `172.16.0.0/12`

  * `192.168.0.0/16`

  * `169.254.240.0/20` (this address space is also a link-local address)

    Warning

    Make sure the prefixes are always within the allowed Cloudflare ranges, especially for cloud service providers that might automatically generate prefixes for you. Otherwise, the tunnel will not work.

* **TTL**: Time to Live (TTL) in number of hops for the GRE tunnel. The default value is 64.

* **MTU**: Maximum transmission unit (MTU) in bytes for the GRE tunnel. The default value is 1476.

## Ways to onboard traffic to Cloudflare

### GRE and IPsec tunnels

You can use GRE or IPsec tunnels to onboard your traffic to Magic WAN, and set them up via the Cloudflare dashboard or the API. However, if you want to use the API, be sure to have your [account ID](https://developers.cloudflare.com/fundamentals/setup/find-account-and-zone-ids/) and [API key](https://developers.cloudflare.com/fundamentals/api/get-started/keys/#view-your-global-api-key) ready before you begin.

Note

IPsec tunnels only support Internet Key Exchange version 2 (IKEv2).

#### IPsec supported ciphers

Refer to [Tunnels and encapsulation](https://developers.cloudflare.com/magic-wan/reference/tunnels/) to learn more about the technical requirements for GRE and IPsec tunnels used in Magic WAN. In this page, you can also find the [supported ciphers for IPsec](https://developers.cloudflare.com/magic-wan/reference/tunnels/#supported-configuration-parameters).

#### Anti-replay protection

If you use Magic WAN and anycast IPsec tunnels, we recommend disabling anti-replay protection. This setting is disabled on Cloudflare's side by default. However, it can be enabled via the API or the Cloudflare dashboard for devices that do not support disabling it, including Cisco Meraki, Velocloud, and AWS VPN Gateway.

Refer to [Anti-replay protection](https://developers.cloudflare.com/magic-wan/reference/anti-replay-protection/) for more information on this topic, or [Add IPsec tunnels](#add-tunnels) below to learn how to enable this feature.

### Network Interconnect (CNI)

Beyond GRE and IPsec tunnels, you can also use Network Interconnect (CNI) to onboard your traffic to Magic WAN. Refer to [Network Interconnect (CNI)](https://developers.cloudflare.com/magic-wan/network-interconnect/) for more information.

## Add tunnels

Warning

Internet Control Message Protocol (ICMP) traffic is subject to Magic Firewall rules. If you have Magic Firewall enabled, ensure your rules allow ICMP traffic sourced from Cloudflare public IPs. Otherwise, health checks will fail. Refer to [Magic Firewall rules](https://developers.cloudflare.com/magic-firewall/about/ruleset-logic/#magic-firewall-rules-and-magic-transit-endpoint-health-checks) for more information.

* Dashboard

  1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account.
  2. Select **Magic WAN > Configuration**.
  3. From the **Tunnels** tab, select **Create**.
  4. On the **Add tunnels** page, choose either a **GRE tunnel** or **IPsec tunnel**.

* API

  Note

  You will need your [account ID](https://developers.cloudflare.com/fundamentals/setup/find-account-and-zone-ids/) and [API Key](https://developers.cloudflare.com/fundamentals/api/get-started/keys/#view-your-global-api-key) to use the API.

## Bidirectional vs unidirectional health checks

To check for tunnel health, Cloudflare sends a [health check probe](https://developers.cloudflare.com/magic-wan/reference/tunnel-health-checks/) consisting of ICMP (Internet Control Message Protocol) reply [packets](https://www.cloudflare.com/learning/network-layer/what-is-a-packet/) to your network. Cloudflare needs to receive these probes to know if your tunnel is healthy.

Cloudflare defaults to bidirectional health checks for Magic WAN, and unidirectional health checks for Magic Transit (direct server return). However, routing unidirectional ICMP reply packets over the Internet to Cloudflare is sometimes subject to drops by intermediate network devices, such as stateful firewalls. Magic Transit customers with egress traffic can modify this setting to bidirectional.

### Legacy bidirectional health checks

For customers using the legacy health check system with a public IP range, Cloudflare recommends:

* Configuring the tunnel health check target IP address to one within the `172.64.240.252/30` prefix range.
* Applying a policy-based route that matches [packets](https://www.cloudflare.com/learning/network-layer/what-is-a-packet/) with a source IP address equal to the configured tunnel health check target (for example `172.64.240.253/32`), and route them over the tunnel back to Cloudflare.

## Next steps

* Now that you have set up your tunnel endpoints, you need to configure [static routes](https://developers.cloudflare.com/magic-wan/configuration/manually/how-to/configure-static-routes/) to route your traffic through Cloudflare.\
  If you are connecting to Cloudflare through a [Direct CNI connection](https://developers.cloudflare.com/network-interconnect/express-cni/), you can [configure BGP routing](https://developers.cloudflare.com/magic-wan/configuration/manually/how-to/bgp-peering/) instead.

* After configuring either static routes or BGP routing, you will have to [set up a site](https://developers.cloudflare.com/magic-wan/configuration/common-settings/sites/).
