Cloudflare Docs
Magic WAN
Cloudflare Docs
Magic WAN
GitHub icon
Edit this page on GitHub
Set theme to dark (⇧+D)
  1. Products
  2. Magic WAN
  3. ...
  4. ...
  5. Third-party integration
  6. Amazon AWS Transit Gateway

Amazon AWS Transit Gateway

This tutorial provides information and examples of how to configure IPsec VPN between Cloudflare Magic WAN with an AWS Transit Gateway.

​​ Prerequisites

You need to have an AWS transit gateway created in your AWS account. This is needed to route traffic between your AWS virtual private cloud (VPC) and Cloudflare Magic WAN. Refer to the AWS documentation to learn more about creating a transit gateway.

Additionally, you also need to configure the necessary route table entries for the virtual machine (VM) in your AWS virtual private cloud, as well the route table entries for the transit gateway. Otherwise, connectivity between your VM and another VM routed via Magic WAN will not work. Refer to the AWS documentation to learn more about routing tables.

​​ AWS

​​ Create AWS transit gateway VPN attachment

  1. Go to Transit gateways > Transit gateway attachments, and select Create transit gateway attachment.
  2. Select the Transit gateway ID that you created previously from the dropdown.
  3. For Attachment type, select VPN.
  4. Under VPN attachment, select the following settings (you can leave settings not mentioned here with their default values):
    1. Customer Gateway: Select New.
    2. IP Address: Enter your Cloudflare Anycast IP address.
    3. Routing options: Select Static.
  5. Select Create transit gateway attachment.

​​ Configure the VPN connection

  1. Select the VPN connection you created > Actions > Modify VPN tunnel options.

  2. From the VPN tunnel outside IP address drop-down menu, choose one of tunnels.

  3. Take note of the IP address you chose, as this corresponds to the customer endpoint IP that you will need to configure on the Cloudflare side of the IPsec tunnel.

  4. The number of options for the VPN connection will expand. Take note of the Pre-shared key. You will need it to create the IPsec tunnel on Cloudflare’s side.

  5. In Inside IPv4 CIDR, AWS enforces that only a /30 block within the 169.254.0.0/16 range can be used. To accommodate this, Cloudflare supports a subset of this IP block. Namely, Cloudflare supports 169.254.244.0/22 to be assigned as the IPsec tunnel’s (internal) interface IPs. For this example, we will use 169.254.244.0/30 as the CIDR block for the IPsec tunnel: 169.254.244.1 for the AWS side of the tunnel, and 169.254.244.2 for the Cloudflare side of the tunnel.

  6. Configure the following settings for the IPsec tunnel. Note that the Startup action needs to be set to Start, which means the AWS side will initiate IPsec negotiation. Settings not mentioned here can be left at their default settings:

    • Phase 1 encryption algorithms: AES256-GCM-16
    • Phase 2 encryption algorithms: AES256-GCM-16
    • Phase 1 integrity algorithms: SHA2-256
    • Phase 2 integrity algorithms: SHA2-256
    • Phase 1 DH group numbers: 14
    • Phase 2 DH group numbers: 14
    • IKE Version: ikev2
    • Startup action: Start

  7. Select Save changes.

  8. Repeat the steps above to configure the second VPN connection. Use the second outside IP address, and make the appropriate changes to IP addresses as well when configuring Cloudflare’s side of the tunnel.

​​ Magic WAN

After configuring the AWS transit gateway VPN connection and the tunnel as mentioned above, go to the Cloudflare dashboard and create the corresponding IPsec tunnel and static routes on the Magic WAN side.

​​ IPsec tunnels

  1. Refer to Add tunnels to learn how to add an IPsec tunnel. When creating your IPsec tunnel, make sure you define the following settings:
    • Tunnel name: tunnel01
    • Interface address: The /30CIDR block enforced by AWS (first usable IP is for the AWS side). For example, 169.254.244.2.
    • Customer endpoint: The IP address from AWS’s VPN tunnel outside IP address. For example, 35.xx.xx.xx.
    • Cloudflare endpoint: Enter the first of your two Anycast IPs.
    • Pre-shared key: Choose Use my own pre-shared key, and enter the PSK you created for the AWS VPN tunnel.
    • Health check type: Choose Request
    • Health check direction: Choose Bidirectional
    • Replay protection: Select Enabled.
  2. Select Save.
  3. Repeat the above steps for tunnel02. Chose the same prefix, but select the second IPsec tunnel for Tunnel/Next hop.

​​ Static routes

The static route in Magic WAN should point to the appropriate virtual machine (VM) subnet you created inside your AWS virtual private cloud. For example, if your VM has a subnet of 192.168.192.0/26, you should use it as the prefix for your static route.

To create a static route:

  1. Refer to Create a static route to learn how to create one.
  2. In Prefix, enter the subnet for your VM. For example, 192.xx.xx.xx/24.
  3. For the Tunnel/Next hop, choose the IPsec tunnel you created in the previous step.
  4. Repeat the steps above for the second IPsec tunnel you created.