Cloudflare makes BGP over GRE and IPsec generally available

What changed

On 5 October 2026, Cloudflare announced general availability of BGP peering over GRE and IPsec tunnels for Magic Transit and Cloudflare WAN. The announcement permits production use and makes the feature available to all Unified Routing accounts without separate enablement.

The sessions exchange routes between customer devices and the Cloudflare virtual network routing table. This lets routing changes be exchanged dynamically rather than maintained solely as static routes.

The release follows Unified Routing's September general-availability announcement. It is a separate milestone for BGP over these tunnel types. BGP over Cloudflare Network Interconnect, or CNI, remains in closed beta.

Why it matters for BYOIP teams

For an organisation using Magic Transit with its own prefixes, the release is a reason to revisit designs that depended on production support for dynamic tunnel routing.

Keep the two routing relationships distinct. This feature concerns peering with Cloudflare's virtual network routing table. It does not announce new rules for proving control of a BYOIP prefix or a new public peering arrangement with Cloudflare's Internet network.

What to check

• Confirm that the account uses Unified Routing before planning the configuration.
• List the routes the customer device should advertise and receive, then validate that list during a pilot.
• Review how learned routes interact with existing static routes. Cloudflare documents that a static route takes precedence when its prefix and priority match a BGP route.
• Exercise tunnel failure, session recovery and withdrawal scenarios before production cutover.
• Review firewall-feature availability separately. Managed rulesets on Unified Routing are still listed as beta.

For existing accounts, assess the routing-mode migration as well as the BGP configuration. Cloudflare's traffic-steering documentation describes the upgrade process and its operational considerations.