Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- BGP over IPsec/GRE tunnels is generally available and requires Unified Routing. BGP over CNI with Dataplane v2 remains a closed beta unavailable to new customers.
- CF Account ASN applies to every BGP session in the account and must differ from the customer-device ASN on each tunnel.
- The customer CPE must initiate the BGP session. Hold time must be at least 30 seconds; Cloudflare recommends at least 90.
- A session can advertise up to 5,000 prefixes. The limit is enforced before import filtering, so rejected routes still count.
Check account access and the on-ramp first
On October 5, 2026, Cloudflare announced general availability of BGP over IPsec/GRE tunnels for Cloudflare WAN and Magic Transit, including production workloads. BGP lets routers exchange information about reachable networks dynamically, reducing manual static-route updates as a network changes.
The announcement and configuration guides reviewed on November 6, 2026 still require Unified Routing. The announcement says accounts using Unified Routing need no separate enablement for tunnel BGP; this does not establish product access for every Cloudflare account. BGP over CNI with Dataplane v2 remains a closed beta and is not available to new customers.
These sources do not specify a universal price, required subscription tier, or country-by-country availability. Check your account access and contract before planning a change. General availability and no separate enablement do not establish that the feature is free.
Plan the account ASN and site ASNs
An ASN identifies a routing system. CF Account ASN defaults to 13335 and can be changed to a private two-byte ASN between 64512 and 65534. It applies to all IPsec/GRE and CNI BGP sessions in the account. Each tunnel’s customer-device ASN must differ from the Cloudflare-side ASN, so check existing sessions before changing the account value.
Cloudflare WAN passes along the customer-announced AS_PATH, the list of ASNs a route has traversed. If multiple sites use the same ASN, standard loop prevention can reject their routes. The documented choices are distinct site ASNs or an explicit edge-device configuration that accepts paths containing its own ASN. Do not disable loop prevention as an unexamined troubleshooting step.
Public ASNs used for Magic Transit are verified during onboarding. The ASN used in a tunnel BGP session and the ASN used for anycast prefix announcements at the Cloudflare Internet edge have separate scopes; do not treat them as the same setting.
Configure tunnel peering in three steps
First, open WAN configuration on the product’s Routes page and check CF Account ASN. Select Update only if you need to change it. An account ASN that is already correct does not need to be set again.
Second, open Connectors, find the target under IPsec/GRE tunnels, and choose Configure BGP from its three-dot menu. Enter Customer device ASN. Additional advertised prefixes and an MD5 key are optional; leave the prefix list empty if no extra advertisements are needed, review the settings, and save.
Third, configure the customer router you are authorized to manage to peer with the tunnel’s IPv4 interface address. This customer premises equipment, or CPE, must initiate the session; Cloudflare does not initiate it. Follow the corresponding Cloudflare WAN or Magic Transit guide linked below for your product.
Check addresses and timers if the session will not establish
Use the tunnel’s IPv4 interface address as the BGP peer. The customer side does not have to use the other address in the same /31 or /30 interface subnet. For an Azure VPN gateway, avoid a link-local tunnel interface address: Cloudflare documents that Azure will not initiate BGP to such a peer and recommends an RFC 1918 address instead.
Hold time must be at least 30 seconds, with at least 90 seconds recommended by Cloudflare. Cloudflare advertises 240 seconds, so a customer setting above 240 results in a negotiated value of 240 seconds. Keep connect retry low; the documentation gives five or ten seconds as examples. These are session parameters, not a business recovery-time guarantee.
MD5 is optional and accepts at most 80 characters. Cloudflare explicitly describes it as protection against accidental misconfiguration, not a security mechanism against malicious attacks; the MD5 key is not treated as a secret. With MD5 enabled, Telnet cannot test BGP connectivity because it does not support TCP MD5 authentication.
Count the 5,000-route limit before filtering
A CPE can advertise up to 5,000 prefixes per BGP session. Cloudflare enforces the 5,000-route RIB-in limit before import filtering. RIB-in holds route information received from the peer, so routes rejected by an import filter still consume that capacity.
A filter profile is an account-level object with a unique name, one match action, and up to 1,000 CIDR targets. An allow action accepts matching routes and rejects everything else; deny rejects matches and accepts everything else. Each tunnel supports one import and one export filter.
Import filters control the routes Cloudflare accepts. Export filters control selected routes advertised to the peer. Prefixes in a tunnel’s extra_prefixes field bypass export filters and need a separate check; a filter assignment alone does not establish that every advertisement is restricted.
Verify route behavior separately from session status
An authorized network administrator should record the prefixes expected to be advertised, accepted, and rejected, then compare those expectations with the customer device and Cloudflare routing tables. An established session alone does not establish that the required prefixes were accepted or that business traffic follows the intended path.
For a hypothetical example, two Cloudflare WAN sites use the same ASN. Their tunnels and BGP sessions establish, but one site rejects an AS_PATH containing its own ASN. Check site ASN assignments and loop-prevention policy at that point. This is an illustrative troubleshooting case, not a result measured for this article.
Sources
Frequently Asked Questions
Should I delete all static routes after enabling BGP?
The announcement does not require removal of all static routes. Review learned routes alongside existing static configuration using the product’s route priorities, prefix scope, and your change plan. General availability alone is not a reason to delete existing routes in bulk.
How many seconds does failover take?
The announcement and two configuration guides do not establish a universal failover SLA for this guide. Hold time and retry values are BGP session parameters; they are not direct guarantees of application recovery time or availability.