Anycast IPsec: A New On-Ramp to Cloudflare One
Cloudflare One customers now have a new option for connecting their traffic to Cloudflare's network: IPsec. The protocol's near-universal vendor support makes it a natural choice for network-layer connectivity, especially for organizations looking to move traffic that currently runs over private circuits like MPLS onto the public Internet.
The Problem with Private Circuits
Many legacy applications were built under the assumption that MPLS or other private connectivity provided inherent security. In practice, that means unencrypted traffic flowing between branch offices, data centers, and cloud properties. To migrate this traffic to the Internet, a blanket layer of encryption is required. IPsec tunnels have traditionally been the mechanism to provide that protection.
Why Traditional IPsec Falls Short
IPsec has been around since 1995, and its implementations generally follow one of two architectural patterns. In a hub-and-spoke model, each location establishes a tunnel back to a central hub where routing and security policies are applied. This is simple to manage — each node only needs a single tunnel — but can introduce significant latency. Traffic between two geographically distant spokes might need to make a round trip through a hub on another continent to reach its destination.
The mesh model addresses the performance problem by connecting every node to every other node with a dedicated tunnel. This allows for more direct paths, but the number of tunnels quickly becomes unmanageable as locations are added. Neither model scales well for a global network.
Building a Better Model on Anycast
Cloudflare's approach avoids these tradeoffs. By delivering IPsec on its global Anycast network, a customer establishes a single IPsec tunnel to Cloudflare and gets connectivity to all 250+ locations. Conceptually, it resembles a hub-and-spoke architecture, but the "hub" is effectively everywhere — eliminating performance penalties while keeping management simple.
Under the Hood: How IPsec Works
IPsec operates through two components: a userspace Internet Key Exchange (IKE) daemon and a kernel-space IPsec stack. IKE handles the complex work of key negotiation and configuration, creating Security Associations (SAs) that contain all the parameters needed for an encrypted tunnel. Once an SA is established, the IPsec stack uses it to intercept and encrypt/decrypt the appropriate packets.
Most IPsec implementations treat these two components as tightly coupled. Open-source IKE daemons like strongSwan, Libreswan, and Openswan bundle the IKE protocol logic with dataplane configuration. That works fine for point-to-point tunnels, where a single host manages both the SA negotiation and the encryption, but it breaks down for an Anycast model where traffic to a single tunnel could arrive at any edge server.
Distributing Security Associations Across the Edge
The challenge is that when a customer's IKE daemon connects to one Cloudflare edge server, the resulting SA needs to be available on every edge server that might receive encrypted traffic for that tunnel. At Cloudflare scale, that requires more than just running an IKE daemon on each server.
Cloudflare solved this by leveraging and generalizing the technology behind Cloudflare Tunnels. In that system, a customer's cloudflared process connects to a few nearby edge servers, and information about those connections is rapidly propagated to all other edge servers. The same fundamental problem applies to IPsec SAs, so Cloudflare upgraded that distribution technology and repurposed it. Now, within seconds of an SA being created, it is distributed to every edge server where it configures the kernel-space IPsec stack.
One Tunnel, Full Access to Cloudflare One
This Anycast IPsec implementation functions as an on-ramp to the entire Cloudflare One suite. A single IPsec tunnel provides connectivity to a customer's virtual network across Cloudflare's global edge, with security policies applied consistently regardless of traffic origin. The integration extends to Magic Transit, Magic Firewall, and Zero Trust, ensuring that encrypted and unencrypted traffic alike can be routed, inspected, and protected through the same framework.
IPsec support on Cloudflare One is currently in early access. Interested customers can reach out to their account team for details.
