Skip to content

Configure initial resolved IPs

Last updated View as MarkdownAgent setup

Initial resolved IPs (also called token IPs) are ephemeral addresses that Gateway assigns to DNS queries so it can associate hostname-based traffic with the correct policy or tunnel at the network layer, where hostname information is not usually available. Refer to Gateway initial resolved IPs for a list of features that depend on this range.

By default, initial resolved IPs are assigned from:

  • IPv4: 172.64.128.0/20
  • IPv6: 2606:4700:0cf1:4000::/64

This is the default range. You can configure a custom initial resolved IP range for IPv4 if it conflicts with your existing network.

The IPv6 range is not configurable.

Prerequisites

  • You have the Cloudflare One Networks Write permission (for API access), or dashboard access to Zero Trust > Team & Resources > Devices > Device profiles.
  • Your new range does not conflict with existing routes or other reserved Cloudflare One subnets in your account.

Check your current range

  1. In the Cloudflare dashboard ↗, go to Zero Trust > Team & Resources > Devices > Device profiles.
  2. Select the Initial resolved IP filter.
  3. View your account's current IPv4 range in the IP subnet range field.

Send a GET request to the Get Initial Resolved IP Subnet endpoint for the address family you want to check:

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/zerotrust/subnets/initial_resolved_ip/$ADDRESS_FAMILY" \
	--request GET \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

Update your range

  1. In the Cloudflare dashboard ↗, go to Zero Trust > Team & Resources > Devices > Device profiles.
  2. Select the Initial resolved IP filter.
  3. Select Configure.
  4. Enter your new IPv4 range in IP subnet CIDR.
  5. Select Save.

Send a PUT request to the Update Initial Resolved IP Subnet endpoint with your desired network range:

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/zerotrust/subnets/initial_resolved_ip/$ADDRESS_FAMILY" \
	--request PUT \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"comment": "example comment",
		"name": "IPv4 Gateway initial resolved IPs",
		"network": "172.64.128.0/20"
	}'

The new CIDR must not conflict with existing private routes or other reserved subnets in your account. If it does, the request fails and the response describes the conflicting route or subnet.

After you change your range, update your Split Tunnel configuration so that traffic to the new range routes through the Cloudflare One Client, and remove the old range if it is no longer used by any other reserved IP purpose.

Initial resolved IPs have a TTL of approximately 10 minutes. DNS queries resolved before you change your range continue to use the previous range until that TTL expires. After that, new DNS queries receive an initial resolved IP from the new range.

Was this helpful?