This article shows you how to configure Cloudflare Load Balancing to gradually route traffic to the Cequence Unified API Protection (UAP) platform. You'll use weighted pools to control what percentage of requests go to Cequence versus your existing servers, allowing you to safely test and scale your API protection coverage.

Cloudflare provides content delivery, performance optimization, and general protections such as DDoS mitigation, but these features don't provide dedicated API protection. Cequence UAP adds API discovery, machine learning-based detection of fraud and abuse, and mitigation of OWASP API Security Top 10 risks, without requiring changes to your application code.

What you'll accomplish

By the end of this article, you'll have a Cloudflare Load Balancer configured to do the following.

• Route a controlled percentage of traffic to Cequence UAP (starting with 5%)
• Send the remaining traffic directly to your origin servers (95%)
• Automatically fail over to your origin servers if Cequence becomes unavailable
• Optionally route specific API endpoints (like /login) to Cequence while leaving others unchanged

Why use this approach

Gradual traffic shifting through load balancing is the recommended strategy for onboarding to Cequence UAP for the following reasons.

• Enables incremental traffic shifts (start with 5% to Cequence, 95% to origin)
• Provides clear separation between protected and unprotected traffic
• Allows you to adjust percentages over time or fail back if needed
• Lets you validate performance under low load before scaling to full coverage

How traffic flows

The following steps describe what happens when a request arrives at Cloudflare.

1. Cloudflare receives the request through your DNS.
2. The load balancer randomly assigns the request to either Cequence UAP (5%) or your origin servers (95%).
3. If routed through Cequence, UAP analyzes the request for threats and forwards clean traffic to your origin.
4. If Cequence becomes unavailable, all traffic automatically routes to your origin servers.

Prerequisites

Before you begin, verify that you have the following prerequisites.

Cloudflare requirements. Verify that you have the following.

• Your domain managed in Cloudflare DNS
• An active Cloudflare Load Balancing subscription that supports:
  • One load balancer
  • At least two pools (one for Cequence, one for your origin)
  • At least two endpoints (Cequence's hostname plus your origin server)

Cequence requirements. Verify that you have the following.

• Your Cequence UAP tenant hostname (provided by Cequence)
• Access to your Cequence dashboard to verify traffic

Core concepts

Understanding these components will help you configure and manage your setup.

Pools: Logical groups of servers. You'll create two pools: one containing Cequence UAP and one containing your origin servers.

Endpoints: Individual servers within each pool. Your Cequence pool will have one endpoint (the Cequence hostname), while your origin pool may have one or more servers.

Health monitors: Automated checks that verify if endpoints are responding properly. Each pool needs its own monitor with appropriate health check settings.

Traffic steering: The method Cloudflare uses to decide which pool gets each request. Options include Random, Failover, and Geo steering. This article uses Random (weighted) steering, which assigns traffic to pools according to assigned weights.

Endpoint steering: The method Cloudflare uses to distribute traffic among the individual endpoints within a single pool, once traffic steering has already assigned a request to that pool. Because the Cequence UAP pool in this setup contains only one endpoint, endpoint steering has no effect there.

Pool weights: Numbers that determine what percentage of traffic goes to each pool. For example, weight 0.05 for Cequence equals 5% of traffic.

Fallback pool: The pool that receives traffic if every other pool becomes unhealthy. Setting your origin pool as the fallback pool means Cloudflare automatically shifts all traffic there if the Cequence UAP pool fails its health checks.

Configuration steps

The following steps set up Cloudflare Load Balancing end to end, from health monitors through validation.

Step 1: Creating health monitors

Health monitors ensure Cloudflare only routes traffic to available endpoints.

1. Navigate to Load Balancing > Monitors.
2. Select Create Monitor.

For Cequence UAP. Configure the monitor with the following settings.

• Name: Cequence-Monitor.
• Type: HTTPS.
• Path: /.stealth-check.
• Port: 443.
• Don't verify SSL/TLS certificates: Checked. Health checks can use an alternate hostname that doesn't match the Cequence Defender certificate, which causes validation failures unless certificate verification is disabled.

Select Save.

For your origin servers. When you don't already have a monitor for your origin, create one with settings appropriate for your infrastructure (typically HTTPS with a path like /health or /status).

Step 2: Creating pools

Pools group your endpoints and define how traffic distributes within each group.

Create the Cequence UAP pool. Configure the pool as follows.

1. Navigate to Load Balancing > Pools.
2. Select Create Pool.
3. Configure the pool with the following settings.
   • Pool Name: cequence-uap.
   • Pool Description: Cequence API Protection.
   • Endpoint Steering: Random.
   • Endpoint name: defender-entrypoint.
   • Endpoint address: Your Cequence tenant hostname, for example partnerdemo2.1.cequence.cloud.
   • Endpoint port: Leave blank. The incoming request's port is used by default.
   • Endpoint weight: 1.
   • Health Threshold: 1. With only one endpoint, it must be healthy for the pool to be healthy.
   • Monitor: Select the Cequence monitor you created.
   • Health Check Regions: Choose regions near your users.

Select Save.

Create the origin pool. When you don't already have a pool for your origin servers, create one following similar steps but using your origin server details and appropriate health check settings.

Step 3: Creating the load balancer

Set up the load balancer that applies your pools and traffic steering rules to live requests.

1. Select the correct Cloudflare account and domain.
2. Navigate to Load Balancing and select Create Load Balancer.
3. Choose Public Load Balancer. This distributes traffic that originates from the public internet.
4. Select your website, then select Next.
5. Configure the following basic settings.
   • Hostname: Your API's public hostname, for example api.yourdomain.com.
   • Cloudflare proxy: Enabled (orange cloud on). Disabling this option results in DNS-only load balancing, and Cloudflare doesn't apply traffic steering or security features.
   • Description: API Load Balancer with Cequence UAP.
   • Session Affinity: Disabled (recommended). Cequence UAP is stateless and doesn't require session stickiness. If your application needs session stickiness, manage it at the origin API gateway or load balancer so a user's session stays bound to the same origin server even when requests pass through Cequence.
   • Adaptive Routing: Enabled (for automatic failover).

Select Save.

Step 4: Configuring pools and traffic steering

With the load balancer created, attach your pools and define how traffic splits between them.

Add pools. Add both pools to the load balancer.

1. Select both pools from the dropdown.
   • Cequence UAP pool
   • Origin pool
2. Set Fallback pool to your origin pool.
3. Select Next.

Configure traffic steering. Set up weighted random steering as follows.

1. Select Random steering.
2. Set pool weights.
   • Cequence UAP pool: 0.05 (5% of traffic)
   • Origin pool: 0.95 (95% of traffic)
3. Select Next.

Custom rules (optional). Skip this section for now. This article covers path-based routing in a later section.

Review and deploy. Review and deploy your configuration as follows.

1. Review your configuration.
2. Select Save and Deploy to make it live.

Step 5: Verifying the setup

Confirm that the load balancer is active and routing traffic as expected.

1. Check Cloudflare dashboard: Your load balancer should show a green checkmark indicating it's active.
2. Monitor Cequence traffic: In your Cequence dashboard, go to Discovery > Live Activity. You should see approximately 5% of your total traffic appearing here.
3. Test functionality: Make several requests to your API and verify they work normally.

Optional: Path-based routing

Path-based routing lets you send specific API endpoints to Cequence while leaving others untouched. You can use it together with weighted steering or on its own, and it's useful when you want to protect only certain routes initially.

Custom rules override weighted steering. When a request matches a custom rule, that rule takes precedence over your percentage-based split. A rule can also route non-matching requests to a pool, for example sending every path except a login endpoint to your origin pool.

Example: Routing login endpoints to Cequence. The following example routes a single login endpoint to Cequence while all other paths continue to follow weighted steering.

1. Edit your load balancer configuration.
2. In the Custom Rules section, select Create Rule.
3. Configure the rule with the following settings.
   • Rule name: Login endpoints to Cequence
   • Condition: URI Path equals /v2/auth/login
   • Action: Override pools
   • Pool: Select your Cequence UAP pool
4. Save the rule.
5. Select Save and Deploy to redeploy the load balancer.

Saving a custom rule and saving the load balancer configuration are separate actions. Save both, or the rule won't take effect.

With this rule, 100% of /v2/auth/login requests go to Cequence, while other paths follow your weighted steering (5% to Cequence, 95% to origin).

Scaling your deployment

Once you've validated that everything works correctly with 5% traffic, scale up gradually.

Gradually increase traffic. Gradually increase traffic in the following stages.

1. Edit your load balancer configuration.
2. Adjust pool weights in increments, for example 5% → 20% → 50% → 100%.
3. Monitor performance, error rates, and Cequence Live Activity at each step.
4. Ensure your origin servers can handle the redistributed load.

Monitor key metrics. Monitor the following key metrics.

• Traffic volume in Cequence Live Activity
• Response times and error rates
• Origin server performance
• Cloudflare health check status

Rollback options. You have the following rollback options.

• Set Cequence pool weight to 0 for immediate traffic shift to origin
• Disable the Cequence pool entirely
• Health monitors automatically route traffic to origin if Cequence becomes unavailable

Troubleshooting

No traffic appears in Cequence. Check the following.

• Verify your pool weights add up correctly
• Check that the Cequence pool shows as healthy in Cloudflare
• Verify your Cequence hostname is correct

High error rates. Check the following.

• Check Cequence health monitor status
• Verify your origin servers can handle current load
• Review any custom rules that might be affecting traffic

Performance issues. Check the following.

• Monitor response times in both Cloudflare and Cequence dashboards
• Consider adjusting health check regions
• Temporarily reduce Cequence traffic percentage while investigating

This configuration provides a solid foundation for gradually onboarding your API traffic to Cequence UAP while maintaining the flexibility to adjust, monitor, and roll back as needed.