Manage eCDN Trusted IP Addresses in Web Application Firewall (WAF) Custom Rules After Migration

Starting in B2C Commerce 26.6, Salesforce migrates your existing Trusted IP Address configurations from legacy Cloudflare access rules to WAF Custom Rules and Managed IP Lists. After the migration, manage these rules through Business Manager for more granular control over trusted traffic. Security rules also support definition at the account level, applying across all zones in the realm without per-zone configuration. Reference Managed IP Lists by both zone-level and account-level rules.

Where: This change applies to B2C Commerce.

When: The migration begins with B2C Commerce 26.6 and rolls out across all customer accounts over approximately 6 weeks.

Who: Users with the eCDN Admin or eCDN Viewer role have access to view these rules. Users with the eCDN Admin role on a Production instance have access to create or edit rules.

How: After the automatic migration, go to eCDN Settings in Business Manager and select Configure Zone | Security Rules. Use the Realm Security Rules tab to manage lists and custom firewall rules. Account-level changes apply to the Production instance and automatically apply to all zones in the realm.

Note While the legacy model fully bypassed all security checks including DDoS L7 protection, WAF Custom Rules bypass Custom Rules, WAFv2, and Rate Limiting but tune DDoS L7 sensitivity down rather than fully bypassing it. High-volume partner integrations that previously relied on a full DDoS bypass may experience DDoS-related challenges after migration.

Note Trusted IP Skip behavior is enforced at zone scope. A Cloudflare account-level Skip rule doesn't bypass zone-level rules. If you add a new zone to your realm after the migration, make sure that the Skip rule exists at the new zone level for the Managed IP List to take effect against zone-level rules on that zone.