Configure tunnel endpoints

5. In Tunnel name, give your tunnel a descriptive name. This name must be unique, must not contain spaces or special characters, and must be 15 or fewer characters. Hover the mouse over i in the dashboard for more information.
6. Give your tunnel a description in Description. You do not have character restrictions here.
7. In Interface address, enter the internal IP address for your tunnel along with the interface’s prefix length (either /31 or /30). This is used to route traffic through the tunnel on the Cloudflare side. We recommend using an RFC1918 address scheme with a /31 netmask, as it provides the most efficient use of IP address space.
8. In Customer GRE endpoint, enter your router’s public IP address. This value is not needed if you intend to use a physical or virtual connection like Cloudflare Network Interconnect because Cloudflare will provide it.
9. In Cloudflare GRE endpoint, enter the Anycast address you received from your account team.
10. Leave the default values for TTL and MTU.
11. (Optional) Enable Tunnel health checks if you want to use this feature. If you do not enable Tunnel health checks, your tunnels will appear 100% down in your tunnel health dashboard even when working. Cloudflare will keep sending traffic through the tunnel, without the means to detect if the tunnel goes down. You will have to set up your own system to detect down tunnels, as Cloudflare will not be able to warn you about down tunnels. Refer to Tunnel health checks for more information.
12. (Optional) If you enabled Tunnel health checks, choose the Health check rate for your tunnel. Available options are Low, Medium, and High.
13. The Health check type defaults to Reply and to creating an ICMP reply. If your firewall drops this type of packet for assuming it is a type of attack, change this option to Request which will create an ICMP request. Refer to Tunnel health checks for more information.
14. The Health check direction defaults to bidirectional for Magic WAN. Refer to Bidirectional vs unidirectional health checks for more details.
15. (Optional) Health check target is the customer end of the tunnel. This field is only visible when the Health check direction is set to Unidirectional.
16. (Optional) We recommend you test your tunnel before officially adding it. To test the tunnel, select Test tunnels.
17. To add multiple tunnels, select Add GRE tunnel for each new tunnel.
18. After adding your tunnel information, select Add tunnels to save your changes.

5. In Tunnel name, give your tunnel a descriptive name. This name must be unique, must not contain spaces or special characters, and must be 15 or fewer characters. Hover the mouse over i in the dashboard for more information.
6. Give your tunnel a description in Description. You do not have character restrictions here.
7. In Interface address, enter the internal IP address for your tunnel along with the interface’s prefix length (either /31 or /30). This is used to route traffic through the tunnel on the Cloudflare side. We recommend using an RFC1918 address scheme with a /31 netmask, as it provides the most efficient use of IP address space.
8. In Customer endpoint, enter your router’s public IP address. This value is only required if your router is using an IKE ID of type ID_IPV4_ADDR.
9. In Cloudflare endpoint, enter the Anycast address you received from your account team.
10. (Optional) Enable Tunnel health checks if you want to use this feature. If you do not enable Tunnel health checks, your tunnels will appear 100% down in your tunnel health dashboard even when working. Cloudflare will keep sending traffic through the tunnel, without the means to detect if the tunnel goes down. You will have to set up your own system to detect down tunnels, as Cloudflare will not be able to warn you about down tunnels. Refer to Tunnel health checks for more information.
11. (Optional) If you enabled Tunnel health checks, choose the Health check rate for your tunnel. Available options are Low, Medium and High.
12. (Optional) The Health check type defaults to Reply and to creating an ICMP reply. If your firewall drops this type of packet for assuming it is a type of attack, change this option to Request which will create an ICMP request. Refer to Tunnel health checks for more information.
13. (Optional) The Health check direction defaults to bidirectional for Magic WAN. Refer to Bidirectional vs unidirectional health checks for more details.
14. (Optional) Health check target is the customer end of the tunnel. This field is only visible when the Health check direction is set to Unidirectional.

14. If you do not have a pre-shared key yet:

    1. Select Add pre-shared key later.
    2. (Optional) We recommend you test your tunnel configuration before officially adding it. To test the tunnel, select Test tunnels.
    3. Select Add tunnels.
    4. The Cloudflare dashboard will load the list of tunnels you have configured. The IPsec tunnel you have just created will be listed with a warning in the form of a triangle to let you know it is not yet functional. Select Edit.
    5. Choose Generate a new pre-shared key > Update and generate a pre-shared key. Save the key to a safe place, and select Done.

15. If you already have a pre-shared key:

    1. Select Use my own pre-shared key.
    2. Paste your key in Your pre-shared key.
    3. (Optional) We recommend you test your tunnel before officially adding it. To test the tunnel, select Test tunnels.
    4. Select Add tunnels.

16. (Optional) Enable Replay protection if you have devices that do not support disabling it. Refer to Anti-replay protection for more information.

Create a POST request using the API Open API docs link to create a GRE tunnel. You will need your API Key.

Example:

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/gre_tunnels \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
  "gre_tunnels": [
    {
      "name": "<TUNNEL_NAME>",
      "description": "<TUNNEL_DESCRIPTION>",
      "interface_address": "<INTERFACE_ADDRESS>",
      "cloudflare_gre_endpoint": "<CLOUDFLARE_ENDPOINT>",
      "customer_gre_endpoint": "<CUSTOMER_ENDPOINT>"
    }
  ]
}'

1. Create a POST request using the API Open API docs link to create an IPsec tunnel. You will need your API Key.

Note that in example below, replay protection is disabled by default. You can enable it with the flag "replay_protection": true for each IPsec tunnel, if the devices you use do not support disabling this feature. If you have already created IPsec tunnels, update them with a PUT request Open API docs link .
Refer to Refer to Anti-replay protection for more information on this topic.

Example:

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/ipsec_tunnels \
--header 'X-Auth-Email: <EMAIL>' \
--header 'X-Auth-Key: <API_KEY>' \
--header 'Content-Type: application/json' \
--data '{
  "ipsec_tunnels": [
    {
      "name": "<TUNNEL_NAME>",
      "description": "<TUNNEL_DESCRIPTION>",
      "interface_address": "<INTERFACE_ADDRESS>",
      "cloudflare_endpoint": "<CLOUDFLARE_ENDPOINT>",
      "customer_endpoint": "<CUSTOMER_ENDPOINT>",
      "replay_protection": false
    }
  ]
}'

This will generate a response like the following:

{
  "result": {
    "ipsec_tunnels": [
      {
        "id": "<YOUR_TUNNEL_ID>",
        "interface_address": "<INTERFACE_ADDRESS>",
        "created_on": "2023-04-21T10:42:22.138586Z",
        "modified_on": "2023-04-21T10:42:22.138586Z",
        "name": "<TUNNEL_NAME>",
        "cloudflare_endpoint": "<CLOUDFLARE_ENDPOINT>",
        "customer_endpoint": "<CUSTOMER_ENDPOINT>",
        "remote_identities": {
          "hex_id": "<HEX_ID>",
          "fqdn_id": "<FQDN_ID>.ipsec.cloudflare.com",
          "user_id": "ipsec@<USER_ID>.ipsec.cloudflare.com"
        },
        "description": " test",
        "health_check": {
          "enabled": true,
          "target": "<TARGET>",
          "type": "reply",
          "rate": "mid"
        }
      }
    ]
  },
  "success": true,
  "errors": [],
  "messages": []
}

2. Create a POST request to generate a PSK. Use the tunnel id you received from the previous command (exemplified by <YOUR_TUNNEL_ID> above):

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/ipsec_tunnels/{your_tunnel_id}/psk_generate \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>"

You will receive a response like the following:

{
  "result": {
    "ipsec_id": "<IPSEC_ID>",
    "ipsec_tunnel_id": "<IPSEC_TUNNEL>",
    "psk": "<YOUR_PSK_KEY>",
    "psk_metadata": {
      "last_generated_on": "2023-04-21T10:48:15.953887008Z"
    }
  },
  "success": true,
  "errors": [],
  "messages": []
}

3. Use the above psk value to configure the IPsec tunnel on your equipment. You do not need to take further action to use the PSK on Cloudflare’s side, as this value is automatically set.

Bidirectional health checks are available for GRE and IPsec tunnels. For Magic WAN this option defaults to bidirectional, while for Magic Transit it defaults to unidirectional.

You can enable bidirectional health checks via the API with --data '{"health_check": {"direction": "bidirectional"}}'. For example:

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/ipsec_tunnels \
--header "Content-Type: application/json" \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--data '{"health_check": {"direction": "bidirectional"}}'