Use BYOIP with CDN and Spectrum

With service bindings, CDN¹ customers using BYOIP can take the same prefix they have onboarded to Cloudflare and use it to selectively route traffic on a per-IP address basis to Spectrum², or vice versa. This means:

• You can upgrade individual IPs within a CDN prefix to a Spectrum IP. For example, if you have a CDN prefix 203.0.113.0/24, you can upgrade 203.0.113.1 to Spectrum.

• You can upgrade individual IPs within a Spectrum prefix to a CDN IP. For example, if you have a Spectrum prefix 203.0.113.0/24, you can upgrade 203.0.113.1 to CDN.

This guide will use the first example and consider a prefix that was onboarded to the CDN, with a few IPs upgraded to Spectrum.

Cloudflare strongly recommends implementing service bindings through an aggregated CIDR block, as it is more efficient than adding discrete bindings for non-contiguous CIDR blocks.

Once a service binding is created (or deleted), it will take four to six hours to propagate across Cloudflare's global network. Services for the IP addresses in scope will likely be disrupted during this window.

1. Log in to your Cloudflare account and get your account ID and authentication key or token. If using an API token, the permissions should include Account - IP Prefixes - Edit.
2. Make a GET request to the List Services endpoint and take note of the id associated with the Spectrum service.
3. Use the List Prefixes endpoint and take note of the id associated with the prefix (cidr) you will configure.

4. To confirm you currently have a CDN service binding and that it spans across your entire prefix, make a GET request to the List Service Bindings endpoint. Replace the {prefix_id} in the URI path by the actual prefix ID you got from the previous step.

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/addressing/prefixes/$PREFIX_ID/bindings" \
	--request GET \
	--header "X-Auth-Email: $CLOUDFLARE_EMAIL" \
	--header "X-Auth-Key: $CLOUDFLARE_API_KEY"

1. Make a POST request to the Create service binding endpoint, indicating the IP address you want to bind to Spectrum. Specify the corresponding network mask as needed.

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/addressing/prefixes/$PREFIX_ID/bindings" \
	--request POST \
	--header "X-Auth-Email: $CLOUDFLARE_EMAIL" \
	--header "X-Auth-Key: $CLOUDFLARE_API_KEY" \
	--json '{
		"cidr": "203.0.113.100/32",
		"service_id": "<SERVICE_ID>"
	}'

{
  "errors": [],
  "messages": [],
  "success": true,
  "result": {
    "cidr": "203.0.113.100/32",
    "id": "<SERVICE_BINDING_ID>",
    "provisioning": {
      "state": "provisioning"
      },
    "service_id": "<SERVICE_ID>",
    "service_name": "<SERVICE_NAME>"
  }
}

You can periodically check the service binding status using the List Service Bindings endpoint.

After the propagation time (four to six hours), the List Service Bindings endpoint should return all service bindings that are part of the prefix - in this case, CDN and Spectrum.

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/addressing/prefixes/$PREFIX_ID/bindings" \
	--request GET \
	--header "X-Auth-Email: $CLOUDFLARE_EMAIL" \
	--header "X-Auth-Key: $CLOUDFLARE_API_KEY"

If you already use BYOIP with CDN, you might be able to skip this step. However, if you are using this guide to upgrade a few IPs from a Spectrum prefix to the CDN, consider the following sections on address maps and DNS records.

Use address maps to specify which IPs should be used by Cloudflare in DNS responses when a record is proxied.

You can choose between two different scopes:

• Account-level: uses the address map for all proxied DNS records across all of the zones within an account.
• Zone-level: uses the address map for all proxied DNS records within a zone.

While the DNS record proxy status and address map will determine how Cloudflare's authoritative DNS responds to requests for your hostnames, the IP addresses specified in A/AAAA records will determine how Cloudflare reaches the configured origin.

Configuring Spectrum to use your own IP address is only possible via the Cloudflare API.

The origin_direct field takes the origin IP address, while edge_ips allows you to define which IP address from your BYOIP prefix Cloudflare should use to process requests for your Spectrum application.

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/spectrum/apps" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '[
		{
				"protocol": "tcp/22",
				"dns": {
						"type": "CNAME",
						"name": "ssh.example.com"
				},
				"origin_direct": [
						"tcp://192.0.2.1:22"
				],
				"proxy_protocol": "off",
				"ip_firewall": true,
				"tls": "full",
				"edge_ips": {
						"type": "static",
						"ips": [
								"203.0.113.18"
						]
				},
				"traffic_type": "direct"
		}
	]'

Leverage other features according to your needs. For example:

• Cache
• WAF custom rules
• Security analytics