Documentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt
Use this file to discover all available pages before exploring further.

[]DocsDirectoryAPISDKsChangelog

SearchCtrlK

Log in

Cloudflare One

/

• Overview
• Get started

  • Overview
  • Replace your VPN

    • Overview
    • Device to network
    • Device to device
    • Network to network
  • Secure private apps

    • Overview
    • Private web application
    • Clientless SSH
    • In-browser remote desktop
• Implementation guides

  • Overview
  • Secure your Internet traffic and SaaS apps
  • Replace your VPN
  • Deploy clientless access
  • Secure your email with Email security
  • Holistic AI security with Cloudflare One
• Videos
• Insights

  • Overview
  • Analytics overview
  • Dashboards

    • Overview
    • Access event analytics
    • Gateway analytics (DNS, HTTP, network sessions)
    • Shadow IT SaaS analytics
    • AI prompt logs
    • Network session analytics
    • AI security
    • Application Access Report
    • Data security analytics
  • Digital experience

    • Overview
    • Device monitoring
    • Synthetic tests

      • Overview
      • HTTP test
      • Traceroute test
      • View test results
    • Rules
    • Diagnostics

      • Overview
      • Client packet capture
      • Speed test
    • Notifications
    • IP visibility
    • DEX MCP server
    • Troubleshoot Digital Experience Monitoring
    • MCP serverMCP
  • Network visibility

    • Diagnostics

      • Overview
      • Packet captures
      • Buckets
  • Logs

    • Overview
    • Dashboard logs

      • Overview
      • Admin activity logs
      • Access authentication logs
      • Gateway activity logs

        • Overview
        • Manage PII
      • SSH command logs
      • SCIM provisioning logs
      • Posture logs
      • Tunnel audit logs
    • Logpush integration

      • Overview
      • Email security logs
      • IDS logs
      • Network Firewall log filters
• Team and resources

  • Application Library
  • Devices

    • Overview
    • Cloudflare One Client

      • Overview
      • Downloads

        • Stable releases
        • LTS releases
        • Beta releases
        • Update the client
        • Support lifecycle
        • Migrate 1.1.1.1 app
      • First-time setup
      • Deploy

        • Overview
        • Managed deployment

          • Overview
          • Partners

            • Overview
            • Fleet
            • Hexnode
            • Intune
            • Jamf
            • JumpCloud
            • Kandji
          • Parameters
          • Block internet access until user authenticates
          • Connect before Windows login
          • Multiple users on a Windows device
          • Switch between Zero Trust organizations
          • Automated registration
          • Path MTU Discovery
          • Client version assignments
          • Hardware-backed registration
        • Manual deployment
        • Device enrollment permissions
        • Firewalls
        • Legacy VPNs
      • Configure

        • Overview
        • Client modes

          • Overview
          • Enable Posture only mode
        • Client settings

          • Overview
          • Captive portal detection
          • Emergency Disconnect
        • Device profiles
        • Managed networks
        • Route traffic

          • Overview
          • Local Domain Fallback
          • Split Tunnels
          • Client architecture
        • Device IPsBeta
        • Client sessions
      • Troubleshoot

        • Overview
        • Troubleshooting guide
        • Common issues
        • Client errors
        • Diagnostic logs
        • Known limitations
        • Connectivity status
      • Business Continuity Guide
      • Uninstall
    • User-side certificates

      • Overview
      • Install certificate using the Cloudflare One Client
      • Install certificate manually
      • Deploy custom certificate
    • Device registration
  • Users

    • Overview
    • Seat management
    • SCIM provisioning
    • User logs
    • Risk score
• Networks

  • Connectivity options
  • Connectors

    • Cloudflare Tunnel

      • Overview
      • Get started

        • Overview
        • Create a tunnel (dashboard)
        • Create a tunnel (API)
        • Useful terms
      • Downloads

        • Overview
        • Update cloudflared
        • License
        • Copyrights
      • Configure a tunnel

        • Overview
        • Tunnel with firewall
        • Tunnel availability and failover

          • Overview
          • Deploy cloudflared replicas
          • System requirements
        • Tunnel run parameters
        • Origin parameters
        • Tunnel permissions
        • Cipher suites
      • Use cases

        • Overview
        • SSH

          • Overview
          • SSH with client-side cloudflared
          • SSH with Access for Infrastructure
          • Self-managed SSH keys
          • Browser-rendered SSH terminal
        • RDP

          • Overview
          • Browser-based RDP
          • RDP with Cloudflare One Client
          • RDP with client-side cloudflared
        • SMB
        • gRPC
        • VNC
      • Environments

        • Overview
        • Ansible
        • AWS
        • Azure
        • GCP
        • Kubernetes
        • Terraform
      • Private networks

        • Overview
        • Connect with cloudflared

          • Overview
          • Connect a private hostname
          • Connect an IP/CIDR
          • Private DNS
          • Virtual networks
      • Published applications

        • Overview
        • DNS records
        • Public load balancers
        • Protocols
      • Monitor tunnels

        • Overview
        • Log streams
        • Notifications
        • Metrics
      • Troubleshoot tunnels

        • Overview
        • Diagnostic logs
        • Private network connectivity
        • Common errors
        • Connectivity pre-checks
      • Other tunnel types

        • Overview
        • Locally-managed tunnels

          • Overview
          • Create a locally-managed tunnel
          • Configuration file
          • Run as a service

            • Overview
            • Linux
            • macOS
            • Windows
          • Useful commands
          • Tunnel permissions
          • Useful terms
        • Quick Tunnels
    • Cloudflare MeshBeta

      • Overview
      • Get started
      • Connect client devices
      • Run Mesh in Docker / Kubernetes
      • Routes
      • High availability
      • Tips and best practices
    • Cloudflare WAN

      • Overview
      • WAN transformation
      • Get started
      • On-ramps
      • Configuration

        • Configure with Connector

          • Overview
          • Configure hardware Connector

            • Configure hardware Connector
            • SFP+ port information
          • Configure Virtual Appliance
          • Network options

            • Application-aware policies

              • Overview
              • Breakout traffic
              • Prioritized traffic
            • Configure link aggregation groupsBeta
            • DHCP options

              • DHCP relay
              • DHCP server
              • DHCP static address reservation
            • Enable NAT for a subnet
            • Network segmentation
            • Routed subnets
          • Maintenance

            • Register Connector
            • Activate Connector
            • Edit basic information
            • Remove connectors
            • Edit network settings
            • Edit traffic steering settings
            • Edit sites
            • Deactivate Connector
            • Default password
            • Heartbeat
            • Interrupt window
            • Appliance operations
          • Device metrics
          • Reference
          • Troubleshooting
        • How to

          • Configure tunnel endpoints
          • Configure routes
          • Configure Cloudflare source IPs (beta)Beta
          • Run traceroute
        • Third-party integration

          • Alibaba Cloud VPN Gateway
          • Amazon AWS Transit Gateway
          • Aruba EdgeConnect Enterprise
          • Cisco IOS XE
          • Cisco Meraki MX (static routing)
          • Cisco SD-WAN
          • Fortinet
          • Furukawa Electric FITELnet
          • Google Cloud VPN
          • HPE Juniper Networking SRX Series Firewalls
          • Microsoft Azure

            • Microsoft Azure Virtual WAN
            • Microsoft Azure VPN Gateway
          • Oracle Cloud
          • Palo Alto Networks NGFW
          • pfSense
          • SonicWall
          • Sophos Firewall
          • strongSwan
          • Ubiquiti
          • Velocloud
          • VyOS
          • Yamaha RTX Router
        • Common settings

          • Overview
          • Set up a site
          • Check tunnel health in the dashboard
          • Update tunnel health checks frequency
          • Configure tunnel health alerts
          • Enable Magic user roles
          • Custom IKE ID for IPsec
      • Security filters
      • Cloudflare One integration

        • Overview
        • Secure WAN traffic
        • Cloudflare Gateway
        • Cloudflare Tunnel
        • WARP
      • Network Interconnect (CNI)
      • Load Balancing
      • Analytics

        • Overview
        • Network visibility
        • Network analytics
        • NetFlow statistics
        • Traceroutes
        • Packet captures
        • Querying Cloudflare WAN IPsec/GRE tunnel bandwidth analytics with GraphQL
        • Querying Cloudflare WAN IPsec/GRE tunnel health check results with GraphQL
      • Public to private via Cloudflare WAN Beta
      • Troubleshooting

        • Troubleshoot IPsec tunnels
        • Troubleshoot tunnel health
        • Troubleshoot connectivity
        • Troubleshoot routing and BGP
      • Reference

        • Anti-replay protection
        • Bandwidth measurement
        • Device compatibility
        • GRE and IPsec tunnels
        • MTU and MSS
        • Traffic steering
        • Tunnel health checks
        • How Cloudflare calculates tunnel health alerts
      • Legal

        • Third party licenses
    • Granular permissions for Tunnels and Mesh nodes
  • Routes

    • Add routes
    • Reserved IP addresses
    • Configure initial resolved IPs
  • Resolvers and proxies

    • DNS

      • Locations

        • Add locations
        • DNS resolver IPs and hostnames
      • DNS over TLS (DoT)
      • DNS over HTTPS (DoH)
    • Proxy endpoints

      • Overview
      • PAC file best practices
      • Configure a PAC file on your device
  • Virtual networks
• Access controls

  • Overview
  • Applications

    • Overview
    • Choose an application type
    • Add web applications

      • Overview
      • SaaS applications

        • Overview
        • Generic OIDC application
        • Generic SAML application
        • Adobe Acrobat Sign
        • Area 1
        • Asana
        • Atlassian Cloud
        • AWS
        • Braintree
        • Coupa
        • Digicert
        • DocuSign
        • Dropbox
        • GitHub Enterprise Cloud
        • Google Cloud
        • Google Workspace
        • Grafana
        • Grafana Cloud
        • Greenhouse Recruiting
        • Hubspot
        • Ironclad
        • Jamf Pro
        • Miro
        • PagerDuty
        • Pingboard
        • Salesforce (OIDC)
        • Salesforce (SAML)
        • ServiceNow (OIDC)
        • ServiceNow (SAML)
        • Slack
        • Smartsheet
        • SparkPost
        • Tableau Cloud
        • Workday
        • Zendesk
        • Zoom
      • Self-hosted public application
      • Managed OAuthBeta
      • Authorization cookie

        • Overview
        • Validate JWTs
        • Application token
        • CORS
    • Linked App Token
    • Non-HTTP applications

      • Overview
      • Add an infrastructure application
      • Add a self-hosted private application
      • Browser-rendered terminal
      • Client-side cloudflared

        • Overview
        • Enable automatic cloudflared authentication
        • Arbitrary TCP
      • Private network applications (legacy)
      • Short-lived certificates (legacy)
    • Add bookmarks
  • Policies

    • Overview
    • Common policies
    • Manage Access policies
    • Rule groups
    • Require purpose justification
    • External Evaluation rules
    • Isolate self-hosted application
    • Application paths
    • Enforce MFA
    • Temporary authentication
  • AI controls

    • MCP server portals
    • Secure MCP servers
    • MCP access to self-hosted apps
  • Service credentials

    • Mutual TLS
    • Service tokens
  • Access settings

    • App Launcher
    • Session management
    • Require Access protection
    • Independent MFA
  • Authenticate coding agents
  • Event subscriptions
  • Troubleshoot Access
• Traffic policies

  • Overview
  • Get started

    • DNS filtering
    • Network filtering
    • HTTP filtering
  • Packet filtering

    • Overview
    • Add policies
    • Create Rate Limiting policiesBeta
    • Enable Managed Rulesets
    • Form expressions
    • Protocol validation rules
    • Ruleset logic
    • Traffic types
    • Best practices

      • Overview
      • Minimal ruleset
      • Extended ruleset
      • Magic Transit egress
  • DNS policies

    • Overview
    • Common policies
    • Test DNS filtering
    • Timed DNS policies
    • Maximum DNS TTL
  • Network policies

    • Overview
    • Common policies
    • Protocol detection
    • SSH proxy and command logs (legacy)
  • HTTP policies

    • Overview
    • Common policies
    • TLS decryption
    • HTTP/3 inspection
    • Application Granular Controls
    • AV scanning
    • Package registry security
    • File sandboxing
    • Modify HTTP request headers in Gateway
  • Egress policies

    • Overview
    • Dedicated egress IPs
    • Egress through Cloudflare Tunnel
    • Host selectors
  • Enable IDS
  • Resolver policiesNew
  • Identity-based policies
  • Global policies
  • Applications and app types
  • Domain categories
  • Order of enforcement
  • Proxy
  • Gateway policy expressions
  • Tiered policies

    • Overview
    • Cloudflare OrganizationsBeta
    • Tenant API
  • Troubleshoot Gateway
  • Troubleshooting
• Cloud and SaaS findings

  • Overview
  • Manage findings
  • Scan for sensitive data
  • Troubleshoot CASB
• Email security

  • Overview
  • Retro Scan
  • Setup

    • Before you begin
    • Post-delivery deployment

      • API deployment

        • Overview
        • Set up with Microsoft 365
      • BCC/Journaling

        • Overview
        • BCC setup

          • Gmail BCC setup

            • Overview
            • Enable Gmail BCC integration
            • Connect your domains
            • Add BCC rules
            • Enable auto-moves
          • Microsoft Exchange BCC setup
        • Journaling setup

          • Microsoft 365 journaling setup
          • Manually add domains
    • Pre-delivery deployment

      • Prerequisites

        • Microsoft 365 as MX Record

          • Overview
          • Use cases

            • 1 - Junk email and Email security Admin Quarantine
            • 2 - Junk email and user managed quarantine
            • 3 - Junk email and administrative quarantine
            • 4 - User managed quarantine and administrative quarantine
            • 5 - Junk email folder and administrative quarantine
        • Google Workspace as MX Record
        • Cisco - Email security as MX Record
        • Cisco - Cisco as MX Record
      • MX/Inline deployment
      • Set up MX/Inline deployment
      • Egress IPs
      • Partner domain TLS
    • Manage domains
  • Monitoring

    • Overview
    • Download a report
  • Submissions

    • Overview
    • Team submissions
    • User submissions
    • Invalid submissions
  • Investigation

    • Search email
  • Settings

    • Domain management

      • Information about your domain
    • Detection settings

      • Allow policies
      • Blocked senders
      • Blocked content
      • Trusted domains
      • Impersonation registry
      • Additional detections
      • Configure link actions
      • Configure text add-ons
      • Detection settings best practices
    • Auto-move events
    • Phish submissions

      • Overview
      • PhishNet Microsoft 365
      • PhishNet for Google Workspace
      • Submission addresses
  • Directories

    • Overview
    • Manage integrated directories

      • Manage groups in your directory
      • Manage users in your directory
    • Manage Email security directories
  • PhishGuard
  • Outbound Data Loss Prevention (DLP)
  • Reference

    • How Email security detects phish
    • Dispositions and attributes
    • Regional processing
  • Troubleshoot Email security
  • Email security API API
• Data loss prevention

  • Overview
  • DLP profiles

    • Configure DLP profiles
    • Predefined profiles
    • Integration profiles
    • Profile settings
  • Data classification

    • Overview
    • Configure labels and templates
    • Build a data class
  • Detection entries

    • Detection entries
    • Configure detection entries
    • Predefined detection entries
  • DLP settings
  • Scan HTTP traffic

    • Create DLP policies
    • Common policies
    • Logging options
  • Scan SaaS apps
  • Scan AI Gateway traffic
  • Troubleshoot DLP
• Remote browser isolation

  • Overview
  • Set up Browser Isolation

    • Get started
    • Clientless Web Isolation
    • Non-identity on-ramps
  • Isolation policies
  • Extensions
  • Accessibility
  • Browser Isolation with firewall
  • Known limitations
  • Troubleshoot Browser Isolation
  • Canvas Remoting
• Reusable components

  • Lists
  • Tags
  • Use IP lists
  • Custom pages

    • Block page
    • App Launcher customization
    • Access login page
    • Access custom block pages
  • Posture checks

    • Overview
    • Cloudflare One Client checks

      • Overview
      • Antivirus
      • Application check
      • Carbon Black
      • Client certificate
      • Device serial numbers
      • Device UUID
      • Disk encryption
      • Domain joined
      • File check
      • Firewall
      • OS version
      • Require Gateway
      • Require WARP
      • SentinelOne
      • Tanium (legacy)
    • Service-to-service checks
    • Access integrations
  • Packet filtering (Cloudflare Network Firewall) fields
• Integrations

  • Cloud and SaaS integrations

    • Overview
    • Manage findings
    • Webhooks
    • Anthropic
    • Atlassian Confluence
    • Atlassian Jira
    • Amazon Web Services (AWS) S3
    • Bitbucket Cloud
    • Box
    • Dropbox
    • Google Cloud Platform (GCP) Cloud Storage
    • GitHub
    • Google Workspace

      • Overview
      • Gmail
      • Google Admin
      • Google Calendar
      • Google Drive
      • Gmail (FedRAMP)
      • Google Admin (FedRAMP)
      • Google Calendar (FedRAMP)
      • Google Drive (FedRAMP)
      • Gemini for Google Workspace
    • Microsoft 365

      • Overview
      • Admin Center
      • OneDrive
      • Outlook
      • SharePoint
      • Microsoft 365 Copilot
      • Admin Center (FedRAMP)
      • OneDrive (FedRAMP)
      • Outlook (FedRAMP)
      • SharePoint (FedRAMP)
      • Microsoft 365 Copilot (FedRAMP)
    • OpenAI
    • Salesforce (FedRAMP)
    • Salesforce
    • ServiceNow (FedRAMP)
    • ServiceNow
    • Slack
    • Troubleshooting

      • CASB
      • Troubleshoot integrations
      • Troubleshoot compute accounts
  • Identity providers

    • Overview
    • Cloudflare as identity provider
    • One-time PIN login
    • Generic OIDC
    • Generic SAML 2.0
    • IdP federation
    • Active Directory (SAML)
    • Amazon Cognito
    • AWS IAM (SAML)
    • Centrify
    • Centrify (SAML)
    • Citrix ADC (SAML)
    • Facebook
    • GitHub
    • Google
    • Google Workspace
    • JumpCloud (SAML)
    • Keycloak (SAML)
    • LinkedIn
    • Microsoft Entra ID
    • Okta
    • Okta (SAML)
    • OneLogin
    • OneLogin (SAML)
    • PingFederate
    • PingOne
    • PingOne (SAML)
    • Signed AuthN requests (SAML)
    • Yandex
  • Service providers

    • Overview
    • Custom integration
    • CrowdStrike
    • Kolide
    • Microsoft Endpoint Manager
    • SentinelOne
    • Tanium
    • Uptycs
    • Workspace ONE
• Roles and permissions
• Tutorials
• Changelog

  • Overview
  • Access
  • Browser Isolation
  • CASB
  • Cloudflare Network Firewall
  • Cloudflare One Client
  • Cloudflare Tunnel
  • Data Loss Prevention
  • Digital Experience Monitoring
  • Email security
  • Gateway
  • Risk score
• Reference architecture
• Account limits
• FAQ
• API and Terraform
• Troubleshooting

  • Overview
  • Access
  • Gateway
  • Tunnel
  • Cloudflare One Client
  • CASB
  • DLP
  • Browser Isolation
  • DEX
  • Email Security
  • Cloudflare WAN

    • Overview
    • IPsec
    • Tunnel health
    • Connectivity
    • Routing and BGP
  • Contact Cloudflare Support
• Glossary
• Agent resources

  • Agent setup
  • Cloudflare Skills
  • Code Mode MCP Server
  • Domain-specific MCP Servers MCP
  • Cloudflare One llms.txt
  • Cloudflare One llms-full.txt
  • Cloudflare Docs llms.txt
  • Cloudflare Docs llms-full.txt

1. Home
2. /Cloudflare One
3. /Troubleshooting
4. /Cloudflare WAN

Cloudflare WAN

Last updated Apr 17, 2026|Copy as Markdown|View as Markdown|Agent setup

Explore resources to help you resolve issues with Cloudflare WAN (formerly Magic WAN) connectivity, routing, and tunnel health.

• IPsec
• Tunnel health
• Connectivity
• Routing and BGP

PreviousEmail SecurityNextIPsec

Was this helpful?

YesNo

Edit pageReport issue

On this page

• Overview

Edit pageReport issue

Getting started

PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search

Company

AboutCareersInvestorsPressPress kitGlobal network

Public interest

Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG

Compliance

Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse

Resources

App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog

Developers

DocumentationLearning centerCommunity

Solutions

SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform

Start BuildingLog In

2026 Cloudflare, Inc.

Privacy policy| Report security issues| Terms of use| Trademark

|

[privacy options]Your privacy choices

[]Docs