Configure tunnel endpoints

5. In Tunnel name, give your tunnel a descriptive name. This name must be unique, must not contain spaces or special characters, and must be 15 or fewer characters. Hover the mouse over i in the dashboard for more information.
6. Give your tunnel a description in Description. You do not have character restrictions here.
7. In Interface address, enter the internal IP address for your tunnel along with the interface’s prefix length (either 31 or 30).
8. In Customer GRE endpoint, enter your router’s public IP address.
9. In Cloudflare GRE endpoint, enter the Anycast address you received from your account team.
10. Leave the default values for TTL and MTU.
11. (Optional) We recommend you test your tunnel before officially adding it. To test the tunnel, select Test tunnels.
12. To add multiple tunnels, select Add GRE tunnel for each new tunnel.
13. After adding your tunnel information, select Add tunnels to save your changes.

5. In Tunnel name, give your tunnel a descriptive name. This name must be unique, must not contain spaces or special characters, and must be 15 or fewer characters. Hover the mouse over i in the dashboard for more information.
6. Give your tunnel a description in Description. You do not have character restrictions here.
7. In Interface address, enter the internal IP address for your tunnel along with the interface’s prefix length (either 31 or 30).
8. In Customer endpoint, enter your router’s public IP address.
9. In Cloudflare endpoint, enter the Anycast address you received from your account team.

10. If you do not have a pre-shared key yet:
    1. Select Add pre-shared key later.
    2. (Optional) We recommend you test your tunnel configuration before officially adding it. To test the tunnel, select Test tunnels.
    3. Select Add tunnels.
    4. Your tunnel will be listed with a warning in the form of a triangle to let you know it is not yet functional. Select Edit.
    5. Choose Generate a new pre-shared key > Done.
11. If you already have a pre-shared key:
    1. Select Use my own pre-shared key.
    2. Paste your key in Your pre-shared key.
    3. (Optional) We recommend you test your tunnel before officially adding it. To test the tunnel, select Test tunnels.
    4. Select Add tunnels.

Create a POST request using the API to create a GRE tunnel. You will need your API Key.

Example:

curl --request POST \
  --url https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/gre_tunnels \
  --header 'Content-Type: application/json' \
  --header 'X-Auth-Email: <EMAIL>' \
  --header 'X-Auth-Key: <API_KEY>' \
  --data '{
    "gre_tunnels": [
      {
        "name": "<TUNNEL_NAME>",
        "description": "<TUNNEL_DESCRIPTION>",
        "interface_address": "<INTERFACE_ADDRESS>",
        "cloudflare_gre_endpoint": "<CLOUDFLARE_ENDPOINT>",
        "customer_gre_endpoint": "<CUSTOMER_ENDPOINT>"
      }
    ]
  }'

Create a POST request using the API to create an IPsec tunnel. You will need your API Key.

Example:

curl --request POST \
  --url https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/ipsec_tunnels \
  --header 'Content-Type: application/json' \
  --header 'X-Auth-Email: <EMAIL>' \
  --header 'X-Auth-Key: <API_KEY>' \
  --data '{
    "ipsec_tunnels": [
      {
        "name": "<TUNNEL_NAME>", 
        "description": "<TUNNEL_DESCRIPTION>", 
        "interface_address": "<INTERFACE_ADDRESS>", 
        "cloudflare_endpoint": "<CLOUDFLARE_ENDPOINT>",
        "customer_endpoint": "<CUSTOMER_ENDPOINT>"
      }
    ]
  }'

This will generate a response like the following:

{
  "result": {
    "ipsec_tunnels": [
      {
        "id": "<YOUR_TUNNEL_ID>",
        "interface_address": "<INTERFACE_ADDRESS>",
        "created_on": "2023-04-21T10:42:22.138586Z",
        "modified_on": "2023-04-21T10:42:22.138586Z",
        "name": "<TUNNEL_NAME>",
        "cloudflare_endpoint": "<CLOUDFLARE_ENDPOINT>",
        "customer_endpoint": "<CUSTOMER_ENDPOINT>",
        "remote_identities": {
          "hex_id": "<HEX_ID>",
          "fqdn_id": "<FQDN_ID>.ipsec.cloudflare.com",
          "user_id": "ipsec@<USER_ID>.ipsec.cloudflare.com"
        },
        "description": " test",
        "health_check": {
          "enabled": true,
          "target": "<TARGET>",
          "type": "reply",
          "rate": "mid"
        }
      }
    ]
  },
  "success": true,
  "errors": [],
  "messages": []
}

2. Create a POST request to generate a PSK. Use the tunnel id you received from the previous command (exemplified by <YOUR_TUNNEL_ID> above):

curl --request POST \
  --url https://api.cloudflare.com/client/v4/accounts/<ACCOUNT_ID>/magic/ipsec_tunnels/<YOUR_TUNNEL_ID>/psk_generate \
  --header 'X-Auth-Email: <EMAIL>' 
  --header 'X-Auth-Key: <API_KEY>'

You will receive a response like the following:

{
  "result": {
    "ipsec_id": "IPSEC_ID",
    "ipsec_tunnel_id": "IPSEC_TUNNEL",
    "psk": "YOUR_PSK_KEY",
    "psk_metadata": {
      "last_generated_on": "2023-04-21T10:48:15.953887008Z"
    }
  },
  "success": true,
  "errors": [],
  "messages": []
}

3. Use the above psk value to configure the IPsec tunnel on your equipment. You do not need to take further action to use the PSK on Cloudflare’s side, as this value is automatically set.