Cloudflare makes Unified Routing generally available for Magic Transit and WAN

What changed

On 18 September 2026, Cloudflare announced that Unified Routing is generally available for Cloudflare WAN and Magic Transit. Cloudflare describes the mode as a tighter integration between Cloudflare One and the connectivity onramps that Cloudflare WAN supports, with features including Automatic Return Routing, BGP and custom client subnets. The changelog recommends Unified Routing for all new accounts.

The GA follows a series of firewall-feature additions for accounts in Unified Routing mode during 2026: country rules in April; IP lists, IDS and SIP rules in July; and Threat Intel Lists on 19 August, which require a Cloudflare Advanced Network Firewall subscription. Managed rulesets followed on 25 September.

Update - 6 October 2026

Cloudflare announced on 5 October that BGP over GRE and IPsec tunnels is generally available for production use on Unified Routing accounts. See our separate BGP release story for the scope of that change.

Current traffic-steering documentation also describes how existing accounts can request an upgrade through their account team. It calls for feature and performance checks and warns of a possible remote-access outage of up to three minutes for Cloudflare One Client users during the upgrade.

BGP over CNI remains in closed beta. Managed firewall rulesets on Unified Routing remain listed as beta; the BGP release does not change their status.

Why it matters for BYOIP teams

Magic Transit is one of the main ways organisations have Cloudflare announce their own prefixes. The routing mode on the account decides how traffic is steered and returned, and which network firewall features apply to traffic for those prefixes. A GA label changes the default for new deployments, so teams planning a new Magic Transit onboarding will likely start in this mode.

What to check

• Whether the account already uses Unified Routing. Existing accounts should review Cloudflare's upgrade guidance, compare required features and agree a change window with their account team.
• The feature-availability list in the traffic steering documentation, against the firewall features you rely on today.
• Subscription entitlements for Advanced Network Firewall features such as Threat Intel Lists.
• Return-path behaviour for your BYOIP prefixes in a test environment before changing production.