Configure tunnel endpoints

5. In Tunnel name, give your tunnel a descriptive name. This name must be unique, must not contain spaces or special characters, and must be 15 or fewer characters. Hover the mouse over i in the dashboard for more information.
6. Give your tunnel a description in Description. You do not have character restrictions here.
7. In Interface address, enter the internal IP address for your tunnel along with the interface’s prefix length (either 31 or 30).
8. In Customer GRE endpoint, enter your router’s public IP address.
9. In Cloudflare GRE endpoint, enter the Anycast address you received from your account team.
10. Leave the default values for TTL and MTU.
11. Choose the Health check frequency for your tunnel. Available options are Low, Medium and High.
12. The Health check type defaults to Reply and to creating an ICMP reply. If your firewall drops this type of packet for assuming it is a type of attack, change this option to Request which will create an ICMP request. Refer to Probe construction for more information.
13. Health check target is the customer end of the tunnel. Leave the default option as is, unless you need to change the target address for some reason.
14. (Optional) We recommend you test your tunnel before officially adding it. To test the tunnel, select Test tunnels.
15. To add multiple tunnels, select Add GRE tunnel for each new tunnel.
16. After adding your tunnel information, select Add tunnels to save your changes.

5. In Tunnel name, give your tunnel a descriptive name. This name must be unique, must not contain spaces or special characters, and must be 15 or fewer characters. Hover the mouse over i in the dashboard for more information.
6. Give your tunnel a description in Description. You do not have character restrictions here.
7. In Interface address, enter the internal IP address for your tunnel along with the interface’s prefix length (either 31 or 30).
8. In Customer endpoint, enter your router’s public IP address.
9. In Cloudflare endpoint, enter the Anycast address you received from your account team.
10. Choose the Health check frequency for your tunnel. Available options are Low, Medium and High.
11. The Health check type defaults to Reply and to creating an ICMP reply. If your firewall drops this type of packet for assuming it is a type of attack, change this option to Request which will create an ICMP request. Refer to Probe construction for more information.
12. Health check target is the customer end of the tunnel. Leave the default option as is, unless you need to change the target address for some reason.

13. If you do not have a pre-shared key yet:
    1. Select Add pre-shared key later.
    2. (Optional) We recommend you test your tunnel configuration before officially adding it. To test the tunnel, select Test tunnels.
    3. Select Add tunnels.
    4. The Cloudflare dashboard will load the list of tunnels you have configured. The IPsec tunnel you have just created will be listed with a warning in the form of a triangle to let you know it is not yet functional. Select Edit.
    5. Choose Generate a new pre-shared key. Save the key to a safe place, and select Done.
14. If you already have a pre-shared key:
    1. Select Use my own pre-shared key.
    2. Paste your key in Your pre-shared key.
    3. (Optional) We recommend you test your tunnel before officially adding it. To test the tunnel, select Test tunnels.
    4. Select Add tunnels.

Create a POST request using the API Open API docs link to create a GRE tunnel. You will need your API Key.

Example:

curl --request https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/gre_tunnels \
--header 'Content-Type: application/json' \
--header 'X-Auth-Email: <EMAIL>' \
--header 'X-Auth-Key: <API_KEY>' \
--data '{
  "gre_tunnels": [
    {
      "name": "<TUNNEL_NAME>",
      "description": "<TUNNEL_DESCRIPTION>",
      "interface_address": "<INTERFACE_ADDRESS>",
      "cloudflare_gre_endpoint": "<CLOUDFLARE_ENDPOINT>",
      "customer_gre_endpoint": "<CUSTOMER_ENDPOINT>"
    }
  ]
}'

Create a POST request using the API Open API docs link to create an IPsec tunnel. You will need your API Key.

Example:

curl --request https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/ipsec_tunnels \
--header 'Content-Type: application/json' \
--header 'X-Auth-Email: <EMAIL>' \
--header 'X-Auth-Key: <API_KEY>' \
--data '{
  "ipsec_tunnels": [
    {
      "name": "<TUNNEL_NAME>", 
      "description": "<TUNNEL_DESCRIPTION>", 
      "interface_address": "<INTERFACE_ADDRESS>", 
      "cloudflare_endpoint": "<CLOUDFLARE_ENDPOINT>",
      "customer_endpoint": "<CUSTOMER_ENDPOINT>"
    }
  ]
}'

This will generate a response like the following:

{
  "result": {
    "ipsec_tunnels": [
      {
        "id": "<YOUR_TUNNEL_ID>",
        "interface_address": "<INTERFACE_ADDRESS>",
        "created_on": "2023-04-21T10:42:22.138586Z",
        "modified_on": "2023-04-21T10:42:22.138586Z",
        "name": "<TUNNEL_NAME>",
        "cloudflare_endpoint": "<CLOUDFLARE_ENDPOINT>",
        "customer_endpoint": "<CUSTOMER_ENDPOINT>",
        "remote_identities": {
          "hex_id": "<HEX_ID>",
          "fqdn_id": "<FQDN_ID>.ipsec.cloudflare.com",
          "user_id": "ipsec@<USER_ID>.ipsec.cloudflare.com"
        },
        "description": " test",
        "health_check": {
          "enabled": true,
          "target": "<TARGET>",
          "type": "reply",
          "rate": "mid"
        }
      }
    ]
  },
  "success": true,
  "errors": [],
  "messages": []
}

2. Create a POST request to generate a PSK. Use the tunnel id you received from the previous command (exemplified by <YOUR_TUNNEL_ID> above):

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/ipsec_tunnels/{your_tunnel_id}/psk_generate \
--header 'X-Auth-Email: <EMAIL>' 
--header 'X-Auth-Key: <API_KEY>'

You will receive a response like the following:

{
  "result": {
    "ipsec_id": "IPSEC_ID",
    "ipsec_tunnel_id": "IPSEC_TUNNEL",
    "psk": "YOUR_PSK_KEY",
    "psk_metadata": {
      "last_generated_on": "2023-04-21T10:48:15.953887008Z"
    }
  },
  "success": true,
  "errors": [],
  "messages": []
}

3. Use the above psk value to configure the IPsec tunnel on your equipment. You do not need to take further action to use the PSK on Cloudflare’s side, as this value is automatically set.