Cloudflare WAN

BGP over IPsec and GRE tunnels generally available

BGP peering over IPsec and GRE tunnels is generally available for Cloudflare WAN and Magic Transit. You can use it for production workloads.

Managed Rulesets supported in Unified Routing

Cloudflare Advanced Network Firewall Managed Rulesets are now supported for accounts using Unified Routing mode.

Unified Routing generally available

Unified Routing is generally available for Cloudflare WAN and Magic Transit.

Define custom applications for breakout and prioritized traffic from the Cloudflare One Appliance dashboard

You can now define custom applications for breakout and prioritized traffic on the Cloudflare One Appliance directly from the dashboard, without calling the API.

Configure DHCP options from the dashboard on Cloudflare One Appliance

You can now configure custom DHCP options directly from the dashboard when the Cloudflare One Appliance is acting as the DHCP server for a LAN.

Create multiple Cloudflare Tunnel and Cloudflare Mesh routes at once

You can now create multiple Cloudflare Tunnel and Cloudflare Mesh routes from the Routes page in a single action, instead of submitting one route at a time.

Download the Cloudflare One Virtual Appliance for your hypervisor from the dashboard

When you register a Cloudflare One Virtual Appliance, you can now select your hypervisor and download the appliance directly from the dashboard — no need to look up asset URLs.

Threat Intel Lists supported in Unified Routing

Cloudflare Advanced Network Firewall Threat Intel Lists are now supported for accounts using Unified Routing mode. This feature requires a Cloudflare Advanced Network Firewall subscription.

Restart, reboot, or shut down a Cloudflare One Appliance from the dashboard

You can now restart, reboot, or shut down a Cloudflare One Appliance directly from the dashboard or via API.

IPsec downgrade protection (beta)

Cloudflare IPsec now supports the IKE_SA_INIT_FULL_TRANSCRIPT_AUTH IKEv2 extension to protect against downgrade attacks on IPsec tunnels.

IP lists, IDS, and SIP rules supported in Unified Routing

Cloudflare Advanced Network Firewall IP lists, IDS, and SIP rules are now supported for accounts using Unified Routing mode. These features require a Cloudflare Advanced Network Firewall subscription.

Self-serve registration of Cloudflare One Virtual Appliance in the dashboard

You can now register a Cloudflare One Virtual Appliance and generate its license key directly from the dashboard, without contacting your account team.

Manage all your routes from one page in the dashboard

The Routes page in the Cloudflare dashboard now shows the routes across all of your connectors — Cloudflare Mesh and Cloudflare Tunnel routes alongside Cloudflare WAN and Magic Transit static routes — in a single table, instead of a separate routes view per product.

Cisco IOS XE

The Cisco IOS XE third-party integration guide for Cloudflare WAN has been updated to include:

Network Analytics support for Unified Routing

Network Analytics is now fully supported for accounts using Unified Routing mode. Traffic that traverses Unified Routing onramps and offramps is now visible in Network Analytics with the same dimensions and filters as traffic on the standard data plane.

New accounts assigned a single IPv4 anycast address

New Magic Transit and Cloudflare WAN accounts are now assigned a single IPv4 anycast address by default.

NAT-T support for IKE on UDP port 500

Cloudflare IPsec now supports the standard NAT traversal (NAT-T) flow, where IKE begins on UDP port 500 and switches to UDP port 4500 after NAT is detected.

Custom DHCP options on Cloudflare One Appliance

When the Cloudflare One Appliance is acting as the DHCP server for a LAN, you can now configure custom DHCP options on the leases it issues. This unlocks workflows such as PXE / iPXE boot, VoIP phone provisioning, and vendor-specific client configuration.

Source-based breakout and prioritization on Cloudflare One Appliance

Breakout and traffic prioritization rules on the Cloudflare One Appliance can now match by source in addition to destination application. You can pin breakout or priority behavior to:

Self-serve provisioning of Cloudflare One Virtual Appliance via API

You can now create, rotate, and delete Cloudflare One Virtual Appliance instances and their license keys directly via the API and Terraform.