Use BYOIP with Magic Transit and CDN

Magic Transit customers using BYOIP can also benefit from the performance, reliability, and security that Cloudflare offers for HTTP-based applications.

This configuration will use the IP address management service bindings to enable Cloudflare CDN services (Cache) on top of Magic Transit, on individual IP addresses or on a subnet.

​​ Before you begin

• Consider the service bindings scope and limitations.

• Plan for what IP addresses you want to configure. If you want to add CDN to multiple contiguous IP addresses, specifying a CIDR block that incorporates all IPs is more efficient.

  Example

  Magic Transit protected prefix: 203.0.113.100/24

  IPs to upgrade to the CDN:

  203.0.113.16 203.0.113.17 203.0.113.18 203.0.113.19 203.0.113.20 203.0.113.21 203.0.113.22 203.0.113.23

  Best practice: Add one discrete CDN Service Binding for 203.0.113.16 with a /29 netmask.

• Note that a transitional state will take place for four to six hours after you create the service binding. During this time, traffic destined to your origins will slowly transition from the Magic Transit pipeline to the CDN pipeline.

​​ 1. Get account information

1. Log in to your Cloudflare account and get your account ID and API token. The token permissions should include Account - IP Prefixes - Edit.
2. Make a GET request to the List Services Open API docs link endpoint and take note of the id associated with the CDN service.
3. Use the List Prefixes Open API docs link endpoint and take note of the id associated with the prefix (cidr) you will configure.

4. To confirm you currently only have a Magic Transit service binding and that it spans across your entire prefix, make a GET request to the List Service Bindings Open API docs link endpoint. Replace the {prefix_id} in the URI path by the actual prefix ID you got from the previous step.

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/addressing/prefixes/{prefix_id}/bindings \
--header "Authorization: Bearer <API_TOKEN>"

​​ 2. Create service binding

1. Make a POST request to the Create Service Binding Open API docs link endpoint, indicating the IP address you want to bind to the CDN. Don’t forget to specify the corresponding network mask.

# Replace the cidr value by the IP address you are configuring.

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/addressing/prefixes/{prefix_id}/bindings \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{
  "cidr": "203.0.113.100/32",
  "service_id": <SERVICE_ID>
}'

{
  "errors": [],
  "messages": [],
  "success": true,
  "result": {
    "cidr": "203.0.113.100/32",
    "id": <CDN_SERVICE_BINDING_ID>,
    "provisioning": {
      "state": "provisioning"
      },
    "service_id": <SERVICE_ID>,
    "service_name": "CDN"
  }
}

2.(Optional) Through the four to six hours that your change will take to propagate, you can use the List Service Bindings Open API docs link endpoint to programmatically check for the active provisioning state.

​​ 3. Create address maps

Once you have configured your IPs to have CDN service, you can use address maps to specify which IPs should be used by Cloudflare in DNS responses when a record is proxied.

You can choose between two different scopes:

• Account-level: uses the address map for all proxied DNS records across all of the zones within an account.

• Zone-level: uses the address map for all proxied DNS records within a zone.

​​ 4. Create DNS records

While the DNS record proxy status and address map will determine how Cloudflare’s authoritative DNS responds to requests for your hostnames, the IP addresses specified in A/AAAA records will determine how Cloudflare reaches the configured origin.

​​ 5.(Optional) Add layer 7 functionality

Leverage other features according to your needs:

• Cache
• WAF custom rules
• Security analytics