Configure Virtual Appliance

Virtual Appliance is a virtual device alternative to the hardware based Cloudflare One Appliance. These two versions of Cloudflare One Appliance are identical otherwise.

Currently, you can set up Virtual Appliance on VMWare ESXi and Proxmox Virtual Environment. Support for Proxmox is in beta.

In this page you will find instructions on how to configure Cloudflare One Appliance. This guide provides a step-by-step guide for Cloudflare One Appliance initial setup. You can either return here after setting up your Cloudflare One Appliance, or refer to the Maintenance section where you will find instructions on how to update your settings.

Before you can install Virtual Appliance, you need an Enterprise account with Cloudflare WAN. Additionally, you need to have a VMware or Proxmox host with sufficient compute, memory, and storage to run the virtual machine with Virtual Appliance. This includes:

• Intel x86 CPU architecture
• ESXi hypervisor 7.0U1 or higher
• 4 virtual CPUs per virtual appliance (We recommend deployment with a 1:1 virtual CPU to physical core allocation to avoid CPU over contention which will cause packet loss.)
• 8 GB of RAM per virtual appliance
• 8 GB of disk per virtual appliance
• One vSwitch port group or VLAN with access to the Internet (for example, through a WAN)
• One or more vSwitch port group or VLAN that will be the internal LAN

For details on installing ESXi and configuring a virtual machine, refer to VMware's documentation.

For details on installing Virtual environment and configuring a virtual machine, refer to Proxmox documentation.

There are a couple of decisions you need to make when installing your Virtual Appliance. Review the following topics for more information.

You can install up to two instances of Virtual Appliance for redundancy at each of your sites. If one of your devices fails, traffic will fail over to the other, ensuring that you never lose connectivity to that site.

In this type of high availability (HA) configuration, you will choose a reliable LAN interface as the HA link which will be used to monitor the health of the peer connector. HA links can be dedicated links or can be shared with other LAN traffic.

You must decide the type of configuration you want for your site from the beginning: no redundancy or with redundancy. You cannot add redundancy after finishing the configuration of your dashboard settings. If, at a later stage, you decide to enable redundancy, you will need to delete your Virtual Appliance device in the Cloudflare dashboard, and start again.

Virtual Appliance uses a DHCP connection at first boot to download your settings and go through the activation process. However, if you need to use a static IP in your Virtual Appliance, and this is a fresh install:

1. Connect the machine with your Virtual Appliance VM to a DHCP port with access to the Internet.
2. Follow the setup flow and activate your Virtual Appliance device.
3. Refer to WAN with a static IP address.

Select the appropriate tab to configure Virtual Appliance on VMWare ESXi or Proxmox Virtual Environment.

tar -xvf mconn-2024-1-3.ova

You need to create a profile for your appliance before connecting it to the Internet.

To create a profile:

1. Log in to Cloudflare One, and go to Networks.
2. Go to Connectors > Appliances > Create a profile.

3. In Name, enter a descriptive name for your Virtual Appliance. Optionally, you can also add a description for it.
4. You need to decide if you want to turn on high availability for the Virtual Appliance. For details, refer to About high availability configurations.
5. Select Create and continue.
6. Select Add Appliance. This will display a list of devices associated with your account. For a Virtual Appliance to show up you need to:
   
   • VMWare: Have already obtained your OVA package and license keys if you are installing on VMWare.
   • Proxmox: Have already obtained your Virtual Appliance Script and license keys if you are installing on Proxmox.
   For more information, refer to Configure a virtual machine and select the appropriate tab.
7. If you have more than one Virtual Appliance, choose the one that corresponds to the on-ramp you are creating. Virtual Appliance devices are identified by a serial number, also known as a service tag. Use this information to choose the right Virtual Appliance.
   Select Add Appliance when you are ready to proceed.
8. Virtual Appliance will be added to your account with an Interrupt window defined. The interrupt window is the time period when the Virtual Appliance software can update, which may result in interruption to existing connections. You can change this later. Refer to Interrupt window for more details on how to define when the Virtual Appliance can update its systems.
9. Select Continue to proceed to creating your WAN and LAN networks.

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/sites/{site_id}/wans \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
	"name": "<YOUR_WAN_NAME>",
	"physport": 1,
	"priority": 0,
	"vlan_tag": 0
}'

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/sites/{site_id}/lans \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
	"name": "<YOUR_LAN_NAME>",
	"physport": 2,
	"static_addressing": {
		"address": "172.16.14.0/24"
	},
	"vlan_tag": 0
}'

After setting up your LANs, you can configure your Virtual Appliance to enable communication between them without traffic leaving your premises. For details, refer to Network segmentation.

Virtual Appliance supports different types of DHCP configurations. Virtual Appliance can:

• Connect to a DHCP server or use a static IP address instead of connecting to a DHCP server.
• Act as a DHCP server.
• Use DHCP relay to connect to a DHCP server outside the location your Virtual Appliance is in.
• Reserve IP addresses for specific devices on your network.

After finishing your Virtual Appliance configuration, you need to add it to a site.

Sites represent the local network of a data center, office, or other physical location, and combine all on-ramps available there. Sites also allow you to check, at a glance, the state of your on-ramps and set up health alert settings so that Cloudflare notifies you when there are issues with the site's on-ramps.

Refer to Set up a site for more information.

Virtual Appliance is deactivated after you install it, and will only establish a connection to the Cloudflare network when it is activated. Cloudflare recommends leaving it deactivated until you finish setting it up in the dashboard.

When the Virtual Appliance is first activated, one of the ports must be connected to the Internet through a device that supports DHCP. This is required so that the Virtual Appliance can reach the Cloudflare global network and download the required configurations that you set up.

When you are ready to connect your Virtual Appliance to the Cloudflare network:

1. Log in to Cloudflare One, and go to Networks.
2. Go to Connectors > Appliances.
3. Find the Virtual Appliance you want to activate, select the three dots next to it > Edit. Make sure you verify the serial number to choose the right Virtual Appliance you want to activate.
4. In the new window, the Status dropdown will show as Deactivated. Select it to change the status to Activated.
5. The Interrupt window is the time period when the Virtual Appliance software can update, which may result in interruption to existing connections. Choose a time period to minimize disruption to your sites. For details on defining when the Virtual Appliance can update its systems, refer to Interrupt window.
6. Select Update.

Your Virtual Appliance's default password is the last seven characters of your license key, all uppercase, plus an ! (exclamation mark).

For example, if your license key is mconn-abcdefghijklmnopqrstuvwxyz, your default password will be TUVWXYZ!.

After activating your device, you can use it in a network configuration with the WAN interface set to a static IP address - that is, an Internet configuration that is not automatically set by DHCP. To use your Virtual Appliance on a network configuration with a static IP, follow these steps:

1. Connect the machine where you installed the VM with Virtual Appliance to a DHCP port with access to the Internet.
2. Create a new profile in the dashboard.
3. Create a DHCP WAN.
4. Activate and boot your Virtual Appliance.
5. Wait 60 seconds.
6. Make changes to the WAN settings in the dashboard to a static IP set up.
7. Wait 60 seconds again.
8. Modify your Port Groups as needed to change the source from which the WAN port obtains its IP address.
9. Reboot your virtual machine.

You need to install two Virtual Appliances before you can set up a site in high availability. When you set up a site in high availability, the WANs and LANs in your Virtual Appliance have the same configuration but are replicated on two nodes. In case of failure of one of the devices, the other device becomes the active node, taking over the configuration of the LAN gateway IP and allowing traffic to continue without disruption.

Because Virtual Appliances in high availability configurations share a single site, you need to set up:

• Static address: The IP for the primary node in your site.
• Secondary static address: The IP for the secondary node in your site.
• Virtual static address: The IP that the LAN south of the Virtual Appliance device will forward traffic to, which is the LAN's gateway IP.

Make sure all IPs are part of the same subnet.

For detailed information about the expected behavior of high availability configurations, refer to the High availability configurations reference page.

You cannot enable high availability for an existing site. To add high availability to an existing site in the Cloudflare dashboard, you need to delete the site and start again.

To set up a high availability configuration:

1. Follow the steps in Create a new profile up until step 4.

2. After naming your site, select Turn on high availability.
3. Select Create and continue.
4. Select Add Appliance.
5. From the list, choose your first Virtual Appliance > Add Appliance.
6. Back on the previous screen, select Add secondary appliance.
7. From the list, choose your second Virtual Appliance > Add Appliance.
8. Select Continue to create a WAN. If you are configuring a static IP, configure the IP for the primary node as the static address, and the IP for the secondary node as the secondary static address.
9. To create a LAN, follow the steps in Create a LAN up until step 4.
10. In Static address, enter the IP for the primary node in your site. For example, 192.168.10.1/24.
11. In Secondary static address, enter the IP for the secondary node in your site. For example, 192.168.10.2/24.
12. In Virtual static address, enter the IP that the LAN south of the Virtual Appliance device will forward traffic to. For example, 192.168.10.3/24.
13. Select Save.
14. From the High availability probing link drop-down menu, select the port that should be used to monitor the node's health. Cloudflare recommends you choose a reliable interface as the HA probing link. The primary and secondary node's probing link should be connected over a switch, and cannot be a direct connection.
15. Follow the instructions in Activate appliance to finish setting up your Appliances.

Virtual Appliance automatically creates IPsec tunnels and static routes for you. You cannot configure these manually.

To check the IPsec tunnels and static routes created by your Virtual Appliance:

1. Log in to Cloudflare One, and go to Connectors.
2. In Cloudflare WAN you can inspect the IPsec tunnels created by your Virtual Appliance.
3. In Routes you can inspect the static routes created by your Virtual Appliance.

• Network options
• Maintenance
• Reference information
• Troubleshooting