Magic WAN is an Enterprise-only product.Contact Cloudflare ↗ to acquire Magic WAN. If you plan on using Magic WAN Connector to automatically onboard your locations to Cloudflare, you will need to purchase Magic WAN first.

Magic WAN supports an automatic setup and a manual setup. The automatic setup through Magic WAN Connector is the preferred method.

Setting up Magic WAN automatically is done through Magic WAN Connector, and is the preferred method. You can choose between the hardware version and the virtual version of Magic WAN Connector. The virtual version can be installed on your own machines.

If you plan on using Magic WAN Connector, you can skip the prerequisites below, and refer toConfigure with Magic WAN Connector for more information on how to continue.

Setting up Magic WAN manually is done through a combination of third-party devices in your premises and the Cloudflare dashboard. To be successful, you need to:

1. Read thePrerequisites below.
2. Follow the steps inManual configuration.

Magic WAN relies onGRE andIPsec tunnels to transmitpackets ↗ from Cloudflare's global network to your origin network. To ensure compatibility with Magic WAN, the routers at your tunnel endpoints must:

• Allow configuration of at least one tunnel per Internet service provider (ISP).
• Supportmaximum segment size (MSS) clamping.
• Support the configuration parameters for IPsec mentioned inIPsec tunnels.

Before enabling Magic WAN, you must make sure that you set up the maximum segment size on your network. Cloudflare Magic WAN uses tunnels to deliverpackets ↗ from our global network to your data centers. Cloudflare encapsulates these packets adding new headers. You must account for the space consumed by these headers when configuring the maximum transmission unit (MTU) and maximum segment size (MSS) values for your network.

The MSS value depends on how your network is set up.

• On your Edge router: Apply the clamp to the GRE tunnel internal interface (meaning where the egress traffic will traverse). The MSS clamp should be 1,436 bytes. This may be done automatically once the tunnel is configured, but it depends on your devices.

For IPsec tunnels, the value you need to specify depends on how your network is set up. The MSS clamping value will be lower than for GRE tunnels, however, since the physical interface will see IPsec-encrypted packets, not TCP packets, and MSS clamping will not apply to those.

• On your Edge router: Apply this on your IPsec tunnel internal interface (meaning where the egress traffic will traverse). This may be done automatically once the tunnel is configured but it depends on your devices. TCP MSS clamp should be 1,360 bytes maximum.

Refer toMaximum transmission unit and maximum segment size for more details.

Instructions to adjust MSS by applying MSS clamps vary depending on the vendor of your router.

The following table lists several commonly used router vendors with links to MSS clamping instructions: