Exclude a prefix or a prefix subset

To exclude a prefix or a prefix subset from Advanced TCP Protection:

1. Log in to the Cloudflare dashboard Open external link and select your account.
2. Go to Account Home > Application Security > DDoS > Advanced TCP Protection.
3. Add the prefix you previously onboarded to Magic Transit to Advanced TCP Protection.
4. Add the prefix (or subset) you wish to exclude as a new, separate prefix in Advanced TCP Protection.
5. For the prefix you added in the previous step, select Exclude Subset in the Enrolled Prefixes list.