diff --git a/products/byoip/src/content/about/index.md b/products/byoip/src/content/about/index.md deleted file mode 100644 index fd521ee43542a9e..000000000000000 --- a/products/byoip/src/content/about/index.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Getting Started -weight: 1 ---- - -## Bringing Your Own IPs to Cloudflare - -BYOIP is compatible with Magic Transit, Spectrum, and CDN services. - -In order to bring your own IPs (BYOIP) with Cloudflare you’ll need to go through an onboarding process. Work with your account team to understand everything we will need to ensure a smooth transition. - -At a high level in order for a prefix to be onboarded to Cloudflare there will be a service specific configuration required, as well as some requirements that are common to all BYOIP customers, regardless of service type. This documentation will cover the requirements common to all products that are compatible with BYOIP (i.e. Magic Transit, CDN, and Spectrum). - -There are two major prerequisites before Cloudflare can begin the work of onboarding your IP space. - -First, all customers must ensure their [Internet Route Registry (IRR)](/byoip/irr) records are up to date with the correct prefix/ASN information. - -Secondly, Cloudflare must receive a [Letter of Authorization](/byoip/loa) to announce your prefixes, which we will share with our transit partners as evidence we are allowed to announce the route. - -Optionally, if you use the RPKI protocol to sign your routes, Cloudflare can support you there as well. Just let your account team know if you're interested in using RPKI! - -Please see the subsequent sections to learn more. - -Once onboarded, BGP announcements for customer prefixes can be controlled with the [Dynamic Advertisement API](/byoip/api). This API has other useful features and can also be used via the Cloudflare dashboard. diff --git a/products/byoip/src/content/api/index.md b/products/byoip/src/content/api/index.md deleted file mode 100644 index 901fbc289f3a72e..000000000000000 --- a/products/byoip/src/content/api/index.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -title: Dynamic Advertisement -weight: 3 ---- - -Toggling on/off a BGP advertisement by the Cloudflare edge is a simple API call, or UI toggle. You can authorize a call with your email and api key, or create a [service token](https://support.cloudflare.com/hc/en-us/articles/200167836-Managing-API-Tokens-and-Keys) for this purpose. You may also toggle/on advertisement in the UI, but will be asked to confirm the action. - -**You may toggle the advertisement status of a prefix once every 15 minutes, and it may take up to ten minutes for an advertisement/withdrawal to take effect.** - -Additionally, you can add free text descriptions to your prefixes. - - -A successful response from the API means our service registered the request, the actual withdrawal/announcement may take up to ten minutes to take affect. - -Finally, the API/UI support adding 'delegations' to your prefixes. Delegations allow other Cloudflare accounts interact with your prefix. The effect of a 'delegation' is service specific, so please see the ##delegations## section to learn more. - -To toggle advertisement status from the UI simple click into the IP Prefixes product - located on the account home page, and click 'edit' on an invdividual prefix. - - - - -From the dropdown 'Status' - either select 'Withdrawn' or 'Advertised', then click save. You will be asked to confirm you choice. - -API users can find all the calls documented here: [API docs](https://api.cloudflare.com/#ip-address-management-dynamic-advertisement-properties) along with examples. - diff --git a/products/byoip/src/content/dynamic-advertisement/best-practices.md b/products/byoip/src/content/dynamic-advertisement/best-practices.md new file mode 100644 index 000000000000000..9818fd2300e41b3 --- /dev/null +++ b/products/byoip/src/content/dynamic-advertisement/best-practices.md @@ -0,0 +1,53 @@ +--- +order: 2 +--- + +# Best practices + +-------- + +## Verify User Roles & Obtain Prefix IDs + +To ensure smooth operation in general and simplify the advertisement process during an attack scenario, complete the following tasks: + +* **Assign appropriate user roles.** Ensure that users assigned to manage the status of IP prefix advertisement have the Administrator or Super Administrator role in your Cloudflare account. For instructions, see [_Setting up Multi-user accounts on Cloudflare_](https://support.cloudflare.com/hc/en-us/articles/205065067-Setting-up-Multi-User-accounts-on-Cloudflare#12345682). + +* **Get a list of the Prefix IDs you want to manage.** Maintaining a list of Cloudflare IDs for each prefix simplifies management via the Cloudflare API, since most dynamic advertisement operations require them. + + To obtain Prefix IDs, go your Cloudflare account home page and review [_Get Prefix IDs_](/api/configure-prefixes#get-prefix-ids), or use the [List Prefixes](https://api.cloudflare.com/#ip-address-management-prefixes-list-prefixes) operation in the Cloudflare API. Refer to these Prefix IDs when managing prefix advertisement. + +-------- + +## Enable prefix advertisement + + + +To avoid latency and the possibility of dropped routes, enable prefix advertisement from Cloudflare **before** you withdraw the advertisement from your data center, as outlined in these steps: + +1. To enable prefix advertisement, [use the IP Prefixes page](/api/configure-prefixes#use-the-ip-prefixes-page-to-configure-dynamic-advertisement) in your Cloudflare account home or use the [Update Prefix Dynamic Advertisement Status](https://api.cloudflare.com/#ip-address-management-dynamic-advertisement-get-advertisement-status) operation in the Cloudflare API. This operation requires your Account ID, Prefix IDs, and API key. (For instructions, see [_Get Prefix IDs_](/api/configure-prefixes#get-prefix-ids).) + + Enablement takes 2–7 minutes. + +2. Verify the advertisement using looking glass of your choice—[Hurricane Electric Internet Services](https://lg.he.net/), for example. Use the Cloudflare ASN (13335) to track the advertisement route. + +3. Remove the prefix advertisement that originates from your data center. + +-------- + +## Disable prefix advertisement + +To disable (withdraw) prefix advertisement, reverse the steps you used to enable it: + +1. Add the prefix advertisement to your data center. + +2. [Optional] Verify the advertisement using a looking glass of your choice—[Hurricane Electric Internet Services](https://lg.he.net/), for example. + +3. To disable prefix advertisement at Cloudflare’s edge, see the [IP Prefixes page](/api/configure-prefixes#use-the-ip-prefixes-page-to-configure-dynamic-advertisement) in your Cloudflare account home or use the [Update Prefix Dynamic Advertisement Status](https://api.cloudflare.com/#ip-address-management-dynamic-advertisement-get-advertisement-status) operation in the Cloudflare API. This operation requires your Account ID, Prefix IDs, and API key. (For instructions, see [_Get Prefix IDs_](/api/configure-prefixes#get-prefix-ids) + +Disablement takes approximately 15 minutes. diff --git a/products/byoip/src/content/dynamic-advertisement/configure-dynamic-advertisement.md b/products/byoip/src/content/dynamic-advertisement/configure-dynamic-advertisement.md new file mode 100644 index 000000000000000..2581d0b8764fb2e --- /dev/null +++ b/products/byoip/src/content/dynamic-advertisement/configure-dynamic-advertisement.md @@ -0,0 +1,65 @@ +--- +order: 3 +--- + +# Configure dynamic advertisement + + + +-------- + +## Use the IP Prefixes page to configure dynamic advertisement + +To configure IP prefix assignment from your Cloudflare account home, use the **Status** drop-down list in the **IP Prefixes** dialog, as outlined in these steps: + +1. Log in to your Cloudflare accounts **Home** page and click **IP Prefixes**. + +  + + The **IP Prefixes** page displays. + +2. To edit a prefix, click the **Edit** link associated with the entry. + +  + + The **Edit IP Prefixes** dialog displays. + +  + +1. To configure prefix advertisement, select the _Advertised_ or _Withdrawn_ option from the **Status** drop-down list. + +  + +4. Click **Save** to commit your changes. + +Once you have committed your changes, it takes 2–7 minutes to enable advertisement and approximately 15 minutes to disable (withdraw) advertisement. + +-------- + +## Use the Cloudflare API to configure dynamic advertisement + +To configure prefix advertisement with the Cloudflare API, use the [IP Address Management and Dynamic Advertisement](https://api.cloudflare.com/#ip-address-management-dynamic-advertisement-properties) API. + +Most dynamic advertisement operations require that you supply the Cloudflare ID for any prefix you want to access with the Cloudflare API. The following section outlines how to obtain Prefix IDs. + +-------- + +## Get Prefix IDs + +You can obtain Prefix IDs from the **IP Prefixes** page in your Cloudflare account home or via the [List Prefixes](https://api.cloudflare.com/#ip-address-management-prefixes-list-prefixes) operation in the Cloudflare API. + +To obtain Prefix IDs from the **IP Prefixes** page, follow these steps: + +1. Click the expander widget associated with the entry for which you want to obtain the Prefix ID. + +  + + The prefix details display. + +2. To obtain the Prefix ID, refer to the **API Tag** value. To add the value to your clipboard, click **Copy**. + +  diff --git a/products/byoip/src/content/dynamic-advertisement/index.md b/products/byoip/src/content/dynamic-advertisement/index.md new file mode 100644 index 000000000000000..64f9648a413ac4c --- /dev/null +++ b/products/byoip/src/content/dynamic-advertisement/index.md @@ -0,0 +1,19 @@ +--- +order: 2 +--- + +# Dynamic Advertisement + +To configure BGP advertisement at the Cloudflare edge, [use the Cloudflare API](/api/configure-prefixes#use-the-cloudflare-api-to-configure-dynamic-advertisement) or [use the IP Prefixes page](/api/configure-prefixes#use-the-ip-prefixes-page-to-configure-dynamic-advertisement) in your Cloudflare account home. + +When using the API, you can authorize a call with your email and API key, or create a [service token](https://support.cloudflare.com/hc/en-us/articles/200167836-Managing-API-Tokens-and-Keys) for this purpose. + +A successful API response indicates the service registered the request. It typically takes 2–7 minutes to enable advertising and approximately 15 minutes to disable it. + +Both the API and Cloudflare UI support prefix delegations, which allow other Cloudflare accounts to interact with your prefix. The effect of a delegation is service specific. For details, see [Prefix Delegations](/delegations). + + \ No newline at end of file diff --git a/products/byoip/src/content/getting-started/index.md b/products/byoip/src/content/getting-started/index.md new file mode 100644 index 000000000000000..accecfa5c050b80 --- /dev/null +++ b/products/byoip/src/content/getting-started/index.md @@ -0,0 +1,27 @@ +--- +order: 1 +--- + +# Getting Started + +-------- + +## Bringing Your Own IPs to Cloudflare + +BYOIP is compatible with Magic Transit, Spectrum, and CDN services. + +To bring your own IPs (BYOIP) with Cloudflare, you must go through an onboarding process. Work with your account team to understand everything you need to ensure a smooth transition. + +At a high level, Cloudflare requires a service-specific configuration for your prefixes, as well as some requirements that are common to all BYOIP customers, regardless of service type. This documentation covers the requirements common to all products that are compatible with BYOIP (i.e. Magic Transit, CDN, and Spectrum). + +There are two major prerequisites before Cloudflare can begin the work of onboarding your IP space. + +First, all customers must ensure their [Internet Routing Registry (IRR)](/irr) records are up to date with the correct prefix/ASN information. + +Secondly, Cloudflare must receive a [Letter of Authorization](/loa) to announce your prefixes, which we will share with our transit partners as evidence that we are allowed to announce the route. + +Optionally, if you use the RPKI protocol to sign your routes, Cloudflare can support you there as well. Just let your account team know if you’re interested in using RPKI! + +Please see the subsequent sections to learn more. + +Once onboarded, BGP announcements for customer prefixes can be controlled with the [Dynamic Advertisement API](/api). This API has other useful features and can also be used via the Cloudflare dashboard. diff --git a/products/byoip/src/content/index.md b/products/byoip/src/content/index.md index 00d83664d448aca..eed03e5623a0168 100644 --- a/products/byoip/src/content/index.md +++ b/products/byoip/src/content/index.md @@ -1,7 +1,10 @@ --- +title: Welcome order: 0 --- -# Welcome +# Cloudflare BYOIP documentation -TODO... +With BYOIP, Cloudflare announces your IPs in all our locations. Use your IPs with Magic Transit, Spectrum, or CDN services. + +
Get started
\ No newline at end of file diff --git a/products/byoip/src/content/irr-records/best-practices-for-irr-entry-updates.md b/products/byoip/src/content/irr-records/best-practices-for-irr-entry-updates.md new file mode 100644 index 000000000000000..7fdeaba9a94b30d --- /dev/null +++ b/products/byoip/src/content/irr-records/best-practices-for-irr-entry-updates.md @@ -0,0 +1,59 @@ +--- +order: 6 +--- + +# Best practices for IRR entry updates + +To add or update an IRR entry, use one of the routing registries listed in the [Internet Routing Registry](http://www.irr.net/index.html). + +Suggested registries are AFRINIC, APNIC, ARIN, NTT, RADB, and RIPE. + +-------- + +## Best practices + +When updating IRR entries, use these best practices: + +* If you own your own subnet, use the RIPE and APNIC routing registries. These registries allow you to verify subnet ownership. +* If you lease your subnet, follow these guidelines: + * When you do not need ownership verification, use the AFRINIC or NTT routing registry. + * When you submit a route object via email, use the ARIN registry. Note that address blocks owned by others do not appear in the ARIN interface. + +### IRR Entry instructions + +Each routing registry has its own set of IRR entry instructions. This table provides links to those instructions: + +| Route registry | +URL | +
|---|---|
| AFRINIC | +https://afrinic.net/internet-routing-registry#guide | +
| APNIC | +https://www.apnic.net/manage-ip/apnic-services/routing-registry/ | +
| ARIN | +https://www.arin.net/resources/manage/irr/quickstart/ | +
| NTT | +https://www.gin.ntt.net/support-center/policies-procedures/routing-registry/ | +
| RADB | +https://www.radb.net/faq | +
| RIPE | +https://www.ripe.net/manage-ips-and-asns/db/support/managing-route-objects-in-the-irr | +
| Data to verify | +Tool | +Method | +Output | +
|---|---|---|---|
| Subnet prefix IP for the ASN | +IRR Explorer | +Search for the subnet prefix IP, for example, 162.211.156.0/24. | +List of ASN numbers, source (route registry), and any associated errors. | +
| ASN for the subnet prefix | +IRR Explorer | +Search for the ASN, for example AS209242. | +List of prefixes, source, and any associated errors. | +
| Your origin ASN and routing data | +WHOIS lookup | +
+ In a terminal, use this
The host |
+ IRR route, origin, and source information. | +