Cloudflare WAF and DDoS. Supported locally

It started as a CDN. Today it covers application security, Zero Trust access, network services and edge compute on one platform, and often replaces three or four separate security and delivery contracts.

The WAF is staged in detection mode first and tuned against your real traffic before enforcement. FirstNet documents a rollback path with your application team, and cutover stays reversible until enforcement.

Cloudflare operates points of presence in Johannesburg and Cape Town, so South African traffic is cached and inspected locally. Specific data residency or POPIA commitments are reviewed against Cloudflare's published data localisation options.

Yes. Many customers run Zscaler for outbound users and Cloudflare for inbound apps. Where you have an existing WAF, we plan a phased migration rather than a rip-and-replace.

No. Cloudflare is a security platform, not a 24/7 security operations centre. For managed detection and response, FirstNet offers Sophos MDR with FirstNet Incident Response.

FirstNet engineers in South Africa. You log every request with one Rapid Response desk, in your time zone, and FirstNet tunes the WAF, reviews attack events and triages false positives. Where the platform itself needs attention, FirstNet escalates into Cloudflare as a member of the Cloudflare Partner Network.

You get local engineering in South African business hours, policy hardening, ongoing tuning, SIEM integration and partner-tier escalation into Cloudflare, joined up with FirstNet SD-WAN, DIA, Colocation, Private Cloud and IP Transit on one contract.

Magic Transit provides always-on DDoS protection for an entire IP range. Cloudflare advertises your IP prefixes from its global network using BGP, filters malicious traffic at the edge and sends clean traffic back to you. It suits organisations with their own ASN or IP space that need DDoS protection beyond what their upstream carrier provides, including customers on FirstNet IP Transit. FirstNet designs the BGP topology and validates failover with your network team.

Cloudflare Bot Management uses machine-learning bot scoring, JavaScript challenges and mobile signals to stop automated abuse such as credential stuffing, scraping, inventory hoarding and fake sign-ups. API Shield protects APIs with schema validation, mutual TLS, JWT validation, sequence analytics and abuse detection, covering risks a traditional web application firewall can miss. Both run on the same platform as Cloudflare's WAF and DDoS protection, and FirstNet tunes the policies as part of the managed service.

Cloudflare publishes its operational status, and FirstNet designs your deployment around your risk tolerance. Depending on the service, that can include documented DNS fallback procedures, BGP failover for Magic Transit, and alternate paths for business-critical applications. Failover is validated with your network team during onboarding. FirstNet does not quote uptime figures outside your contracted terms, so resilience requirements are agreed during design.

You need control of DNS for the domains being protected, plus proof of domain ownership. For Zero Trust, FirstNet needs your identity provider details (SAML or OIDC endpoint, attribute mapping and MFA set-up) and a catalogue of the applications in scope with their owners. For Magic Transit, FirstNet needs your public IP ranges and ASN. You also name a technical contact for service requests and agree change windows and acceptance criteria before cutover.