After configuring VLAN 10 and
bringing up interface Ethernet0, the next step is to make Ethernet0 an untagged
member of VLAN 10.
Figure 5-11 gives a conceptual view of the Redis database updates
resulting from the SONiC command:
sudo config vlan member add 10
Ethernet0 --untagged
The command defines our intent: Ethernet0 should participate in VLAN
10 as an untagged (access) port. For an untagged VLAN member, frames received
from the host arrive without an 802.1Q tag and are associated with VLAN 10
based on the port's VLAN membership. In the opposite direction, frames
transmitted from VLAN 10 toward Ethernet0 are sent without an 802.1Q tag.
The command updates several related entries in CONFIG_DB. The
PORT|Ethernet0 entry contains the port's access VLAN configuration:
PORT|Ethernet0
access_vlan = 10
The VLAN|Vlan10 entry represents the VLAN itself and contains a
members@ field that records Ethernet0 as a member:
VLAN|Vlan10
members@ = Ethernet0
vlanid = 10
The @ character in members@ is part of the SONiC CONFIG_DB schema
convention. The members@ value is a configuration representation of the
relationship between the VLAN and its members.
The Continue reading
Most companies designed their resource permissions with a human user in mind. A senior engineer may be able to deploy to production, query a sensitive database, or revoke another user's access. Those privileges come with risk, but that risk has traditionally been bounded by two assumptions: the engineer will use human judgment, and the engineer can only act at human speed.
An engineer who sees an unexpected result will usually stop and reconsider their actions. Any human being can only click, type, and review so much in a single day. The introduction of AI agents changes both thresholds. Their decisions are nondeterministic, and they can take the same action (or invoke the same tool) indefinitely, without getting tired or stopping for lunch. A plausible — but incorrect — decision can become thousands of incorrect actions before a human notices.
Today, we're announcing new Cloudflare One capabilities to identify inspected MCP traffic, show which users and servers are generating it, and control direct connections on managed network paths. Combined with MCP Server Portals, these controls help administrators see whether agents are using an approved path, or somehow bypassing it.
Model Context Protocol (MCP) servers give agents a common way to Continue reading
AI has enabled employees across every team to build applications faster than ever before.
But that speed is also what's keeping every CISO up at night: any employee can build an application, deploy it to the public Internet, and accidentally expose internal work or company data.
Today, we're launching new tools to make it easy to keep your applications hosted on Workers private. You can now apply Cloudflare Access directly to a Worker or to every Worker in your account, so that your applications are behind your company login by default, without relying on each developer to set that up themselves.
You can now:
Strong opinions loosely held? This is probably not as good of an idea as it seems. Instead of producing confidence, it might produce overconfidence. Michael Natkin joins Tom and Russ to discuss the problems with this mantra.
download
At a time when looking down at our devices is a ritual in daily life, a natural phenomenon that demands our attention communally upward is a welcome event. On Wednesday, August 12, a total solar eclipse swept from the North Atlantic across Europe, moving over Iceland and northern Spain and Portugal, with a deep partial eclipse over the rest of Western Europe, all near local sunset. This was the first total solar eclipse to cross mainland Europe in twenty years, and it drew millions outdoors to witness the moon pass between Earth and the sun.
As we saw during the 2026 World Cup and the last total eclipse in 2024, online behavior is noticeably affected when an event at this scale takes place. In this blog post, we’ll use data from Cloudflare Radar to examine how Internet traffic shifted alongside the moon and the sun.
In the figure above, we measured HTTP request volume in five-minute buckets across the affected countries on eclipse day, and compared it to a normal-day baseline. Each row is a country (except for Alaska) and each column is a five-minute slice of August 12, Continue reading
Added a new one to the Network Tools page: an IPsec VPN Configuration Generator for Cisco IOS/IOS-XE, ASA, FortiGate, Palo Alto, Juniper SRX, strongSwan/VyOS, UniFi, and pfSense/OPNsense.
The reason I built this instead of just pointing at vendor docs is the case that actually breaks real deployments: pairing a policy-based peer with a route-based one. A route-based side (VTI/tunnel interface) defaults to a catch-all 0.0.0.0/0 ↔ 0.0.0.0/0 selector, since routing decides what enters the tunnel. A policy-based peer negotiates specific proxy-IDs per subnet pair, pulled straight from its ACL. Put those two together unmodified and phase 2 negotiation just fails — no useful error, just a tunnel that won’t come up.
Since we launched Certificate Transparency Monitoring in public beta in 2019, we've been emailing subscribers whenever a new TLS certificate appears in a public Certificate Transparency (CT) log for one of their domains. Today, it's turned on for more than 650,000 customer domains. It's an early warning that someone, somewhere, has issued a certificate for a hostname in your zone, giving you a chance to spot a mis-issued certificate early.
It's a useful signal, but it had a noise problem, and we felt it ourselves. Cloudflare issues a large volume of certificates on your behalf: Universal SSL renewals, certificates from Advanced Certificate Manager, and backup certificates. All of them are logged to public CT logs by design, because a certificate that isn't logged won't be trusted by major browsers like Google Chrome and Apple's Safari. So the same transparency that lets you monitor for mis-issuance also surfaces every certificate we issue for you.
And issuance isn't a one-time event. Certificates are short-lived and renew automatically: a single Universal SSL certificate can renew as often as every 60 days, up to about six times a year. That cadence is set to increase, with the CA/Browser Forum having voted to cut Continue reading
MTU problems are some of the most annoying things to troubleshoot in networking, because they’re usually silent. Small packets sail through fine, everything looks healthy, and then someone complains that a specific app is slow or hanging — and it turns out one link in the path, three hops in, has an MTU 8 bytes smaller than everyone assumed. GRE, IPsec, PPPoE, a VPN overlay, a jumbo-frame config that only got applied to half the path, a VLAN tag quietly adding 4 bytes nobody accounted for, or just two vendors defining and displaying “MTU” differently (L2 vs. L3, tagged vs. untagged) — any of these can quietly clip your effective MTU, and standard ping/traceroute won’t tell you where.
Tony Mattke put together a long list of recommendations that might help you get more out of your LLM tokens.
Definitely worth reading instead of yelling at the stupid AI.
netlab is using the Python Box library to make the code easier to read1. When I started the project, I hated the way you fetch values from Python dictionaries with stuff like node['ospf']['area']; Python Box lets you write node.ospf.area. Even better2, you can tell Python Box to create intermediate dictionaries as needed. node.ospf.area = 1 will automatically create the node.ospf dictionary.
But wait, there’s more (yes, we’re getting to the topic of today’s blog post): Box lets you use the same dotted notation in YAML files.
Welcome to the 25th edition of Cloudflare's DDoS Threat Report. This is the first half-year edition in the series: rather than publishing separate reports for the first and second quarters of 2026, we have combined our coverage of Q1 and Q2 into a single volume covering January through June 2026. The analysis is produced by Cloudforce One, Cloudflare’s Threat Intelligence organization, providing a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network.
After creating VLAN 10, the next step is to enable interface Ethernet0. The baseline configuration for Ethernet0 already exists in the PORT table of CONFIG_DB. This configuration is populated during the SONiC switch startup process using the platform configuration and configuration files, including config_db.json. When the switch boots, the configuration from config_db.json is loaded into CONFIG_DB, which is implemented as a Redis database.
The SONiC command config interface startup Ethernet0
does not create the complete PORT|Ethernet0 entry to the CONFIG_DB. Instead, it
changes the administrative state of the existing port configuration. In this
example, the admin_status field of PORT|Ethernet0 is changed to up (1).
After admin_status is changed, Redis generates a notification for applications subscribed to the PORT table in CONFIG_DB (2). The Redis notification indicates that the configuration entry has changed. It identifies the affected key and the operation that occurred rather than containing the complete PORT|Ethernet0 configuration. portmgrd, running in the SWSS container, is one of the SONiC components involved in processing port configuration. portmgrd uses the notification to identify the changed key and retrieves the current field/value data from CONFIG_DB. It then processes the configuration and prepares Continue reading