What is the challenge?
Why does branch-to-branch and branch-to-cloud connectivity still require a hardware appliance and a private circuit?
Most enterprise WANs are a tangle of MPLS circuits, SD-WAN appliances per branch, IPsec tunnels between data centers, and cloud-specific connections (Direct Connect, ExpressRoute, Interconnect) for each cloud provider. Adding a new branch takes weeks. Adding cloud connectivity means another vendor. Hardware refresh cycles run hundreds of thousands of dollars. And the whole thing was designed when 'the network' meant a few corporate buildings — not 200 remote employees on home wifi.
Architecture
How it fits together
Diagram coming soon
Architecture diagram for this solution will be added here.
Cloudflare's Solution
How Cloudflare solves it
- One global network as your WAN. Cloudflare's 330+ city network *becomes* your private WAN. Connect every branch, data center, cloud VPC, and remote user — they're all on the same overlay, talking through Cloudflare.
- Connect anything with a tunnel. Branches connect via IPsec or GRE from any router/firewall you already own. Cloud VPCs connect via Cloud Connector, BGP, or native cloud integrations. Remote users connect via WARP. Devices that don't speak modern tunnels can use the Magic WAN Connector appliance.
- Built-in security. Every packet crosses Cloudflare and is subject to Magic Firewall, Gateway, and Cloudflare One policies. No separate security overlay — your WAN and your SSE are the same network.
- Optimized routing across the backbone. Traffic between branches takes Cloudflare's optimized backbone routes — often faster than MPLS while costing dramatically less. Argo-style intelligence on top of native anycast.
- No hardware lock-in. Use the routers and firewalls you already have. Cloudflare WAN doesn't need a proprietary appliance at every branch. No five-year hardware refresh cycles, no per-site licensing.
FAQ
Common questions
How is this different from a traditional SD-WAN?
Traditional SD-WAN replaces MPLS with internet links overlaid with vendor appliances at every site. Cloudflare WAN replaces both: the overlay is Cloudflare's network, the appliance is software (or a connector for legacy sites). And it's natively integrated with Cloudflare Zero Trust, so the same platform handles WAN and SSE.
Can I run Cloudflare WAN alongside my existing SD-WAN during migration?
Yes, that's the common pattern. Run both for a quarter or two, migrate sites one at a time, decommission your old SD-WAN once everything's stable. No big-bang cutover required.
What about MPLS?
Many customers replace MPLS entirely with Cloudflare WAN + commodity internet. A few keep MPLS for specific legacy links (e.g. low-latency financial routes) and use Cloudflare for everything else. Both are supported.
How does this connect to AWS / Azure / GCP?
Native integrations with each cloud's transit gateway, plus traditional IPsec from a VPC gateway. The result: your cloud VPCs are first-class participants on your WAN, addressable with the same policies as branch offices.
Let's Test!
Try it live
Demo coming soon
An interactive demo for Cloudflare WAN (Magic WAN) is being built. In the meantime, check the "Dive Deeper" section below for the official docs and product blogs.
Dive Deeper