The same mitigation that absorbs the flood is cutting off trusted branch probes.
The rule must preserve attack coverage while restoring the private-service checks branch operators rely on.
Who you’d be doing this for
“Our branches look down from the outside, and the operations lead is asking whether we should turn protection off.”
Martina Dumitru · Network Security Administrator
Operates branch connectivity for a distributed organization using Magic Transit.
What is at stake
Trusted branch probes fail whenever the active flood rule is enabled. You have to restore reachability without reopening the attack path.
Why it isn’t already fixed
Every obvious fix costs something else. That’s the part you’d have to decide.
- attack coverage vs branch reachability
- fast mitigation changes vs precise rule boundaries
- aggregate telemetry vs affected-path evidence
- customer urgency vs safe rollback criteria
Why Cloudflare
Magic Transit customers depend on protected prefixes staying reachable while Layer 3 attacks are absorbed.
Written with these in mind
Not your kind of problem? 90 more at Cloudflare, or browse every organization.
This is the setup. The work is inside.
Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.