Skip to content

Commit

Permalink
Apply suggestions from code review
Browse files Browse the repository at this point in the history
Co-authored-by: Claire W <78226508+crwaters16@users.noreply.github.com>
  • Loading branch information
securitypedant and crwaters16 authored Dec 13, 2024
1 parent 29d0b3c commit fbdc279
Showing 1 changed file with 5 additions and 5 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -12,20 +12,20 @@ updated: 2024-12-13

## Introduction

A private APN enables devices, like connected vehicles, connected containers, healthcare devices or drones, to be connected while roaming across different countries. The device connects with a SIM or eSIM card to a dedicated network and as the device moves to a new country, it automatically selects the appropriate private APN for the local provider.
A private [Access Point Name](https://en.wikipedia.org/wiki/Access_Point_Name) (APN) enables devices, like connected vehicles, connected containers, healthcare devices or drones, to be connected while roaming across different countries. The device connects with a SIM or eSIM card to a dedicated network, and as the device moves to a new country, it automatically selects the appropriate private APN for the local provider.

APN traffic, typically managed by a third party provider such as a telecommunications company, is routed through specific regional Internet breakouts to get access to the Internet. This architecture can create challenges in regards to the localization of that traffic. For example, a device roaming in France, might have traffic exit to the Internet from a UK based Internet breakout. Therefore web sites and other Internet services will treat the device as if it is in the UK, and deliver content in the wrong language or apply regional restrictions.
APN traffic, typically managed by a third party provider such as a telecommunications company, is routed through specific regional Internet breakouts to get access to the Internet. This architecture can create challenges in regards to the localization of that traffic. For example, a device roaming in France might have traffic exit to the Internet from a UK-based Internet breakout. Therefore web sites and other Internet services will treat the device as if it is in the UK and deliver content in the wrong language or apply regional restrictions.

In this document, we'll discuss how Cloudflare can be used to solve this problem and we will use the example of a service provider using private mobile networks [Access Point Names](https://en.wikipedia.org/wiki/Access_Point_Name) (APN) to connect devices roaming across multiple countries through regional Internet breakouts. This use case is relevant to global enterprises with regional offices, transportation fleets with connected vehicles, or any organization needing to maintain consistent, secure, and region-specific connectivity for roaming devices.
In this document, we'll discuss how Cloudflare can be used to solve this problem and will use the example of a service provider using private mobile networks (APNs) to connect devices roaming across multiple countries through regional Internet breakouts. This use case is relevant to global enterprises with regional offices, transportation fleets with connected vehicles, or any organization needing to maintain consistent, secure, and region-specific connectivity for roaming devices.

![Figure 1: Showing how Internet breakouts can present an egress IP that doesn't match the country the device is in.](~/assets/images/reference-architecture/optimizing-roaming-experience-with-geolocated-ips/figure1.svg "Figure 1: Showing how Internet breakouts can present an egress IP that doesn't match the country the device is in.")

# Correctly locate and secure devices by connecting them to the Cloudflare global network

Cloudflare addresses these challenges by routing device traffic from the Internet breakout to our global network, where traffic is processed at a Cloudflare data center close to the Internet breakout. This allows for two benefits.
Cloudflare addresses these challenges by routing device traffic from the Internet breakout to our global network, where traffic is processed at a Cloudflare data center close to the Internet breakout. This allows for two benefits:

1. Cloudflare can analyse the traffic, determine the original country of origin, and then ensure that traffic egresses onto the Internet from an IP address that is geolocated to the same country of origin.
2. Cloudflare can filter traffic based on [secure web gateway](/cloudflare-one/policies/gateway/) policies, allowing you to protect devices from access risky Internet hosts. It also allows you to lock down access for devices to specific Internet hosts, such as only allow devices to make requests to APIs that support their function.
2. Cloudflare can filter traffic based on [secure web gateway](/cloudflare-one/policies/gateway/) policies, allowing you to protect devices from accessing risky Internet hosts. It also allows you to lock down access for devices to specific Internet hosts, such as only allow devices to make requests to APIs that support their function.

The architecture diagram below provides a visual representation of this solution, showing how traffic from various countries — routed via different mobile network APN — is directed through Internet breakouts. Cloudflare optimizes and secures the Internet connection by leveraging [geolocated public IPs](/cloudflare-one/policies/gateway/egress-policies/dedicated-egress-ips/), ensuring that the traffic is secure and regionally localized to the device location.

Expand Down

0 comments on commit fbdc279

Please sign in to comment.