GA acceleration design for wide area networks - Cloud Network Well-architected Design Guidelines

Overview

Introduction

This well-architected design presents a network-layer acceleration solution for wide area network (WAN) scenarios, such as cross-region and cross-border client-to-server connections. The solution reduces latency, improves user experience, and resolves issues such as slow content loading, load failures, and stuttering in gaming, cross-border office work, cross-border e-commerce, and app globalization scenarios.

Scenario description

Network acceleration can significantly improve user experience and enterprise productivity, but a poorly designed solution may degrade performance instead. Choosing the right acceleration approach for your business scenario is crucial. Acceleration solutions fall into several categories:

Content layer: Uses CDN and DCDN technologies to speed up access through content delivery and edge caching.
Server-side layer: Improves server-side performance through program optimization and data compensation.
Client-side layer: Uses MultiPath-like solutions for optimal last-mile routing by switching and scheduling across Wi-Fi, 4G, and 5G paths.
Intermediate link layer: Accelerates traffic by shortening the link path or improving link transmission quality between the client and server.
1. To shorten the link length, the best method is to deploy the business system as close to the client as possible. Alternatively, you can use CDN technology for content delivery to cache frequently used static content at various edge zones for nearest access.
2. To improve link transmission quality, you can use network technologies to schedule access to transmission links with lower latency and higher stability. This allows client requests to reach the server more efficiently. This topic focuses on the solution design for this scenario.

This solution is built around Global Accelerator (GA). You can also integrate Anti-DDoS, WAF, CDN, and DNS as needed.

GA provides nearest access for users, intelligent routing over accelerated paths, and stable server connections. GA supports both Layer 4 (TCP/UDP) and Layer 7 (HTTP/HTTPS) services and can accelerate your network regardless of whether your origin server is deployed on Alibaba Cloud.

FAQ

How does GA acceleration work?: When users access services over the Internet, many uncertainties exist. GA directs user access requests to the Alibaba Cloud private network. This improves the reliability of the intermediate link, enhances access stability, and reduces access latency.
Do I need to modify the server?: No, you do not. No modifications are required for the server-side program. When you configure a GA endpoint group, you can simply enter the public IP address or public domain name of the origin server. If the origin server is deployed on Alibaba Cloud, you can directly select the corresponding cloud resource.
How does nearest access work?: GA automatically allocates a local Border Gateway Protocol (BGP) IP address for each acceleration region. A canonical name (CNAME) is automatically generated for each GA instance. You can quickly switch traffic by modifying the A record or CNAME record in your DNS settings.
How does intelligent scheduling work?: GA has an internal scheduling system. You only need to configure the service protocol and port. GA then automatically schedules the optimal path to transmit traffic to the endpoint group. GA provides two scheduling methods, intelligent routing and custom routing, to meet different business needs.

For more information, see What is Global Accelerator?.

Design principles

The primary goal of a network acceleration solution is to improve access speed without introducing new issues. This design focuses on stability, security, performance, and observability to ensure simple and efficient implementation.

Key design points

Stability

GA includes built-in stability features. You primarily need to address stability when combining GA with other products.

The GA product itself provides end-to-end high reliability:

After you create an acceleration region, only two public IP addresses are displayed in the console. However, the underlying infrastructure is a cluster, and these public IP addresses are also BGP IP addresses.
The acceleration region and the endpoint group are connected through the Alibaba Cloud private network. Multiple paths are available, and GA automatically selects the optimal path.
The endpoint group also uses a cluster architecture to ensure forwarding reliability.

Points to consider for the solution design:

Recommended methods for switching between accelerated and non-accelerated links:
- If the client accesses the server-side through a domain name, you can modify the DNS record. Use a CNAME record because it takes effect quickly and provides failover capabilities if an acceleration region fails. If you use an A record, the DNS itself must support intelligent resolution by region to achieve nearest access for clients. You must also consider issues such as the DNS time-to-live (TTL) and browser caching.
- If the client accesses the server-side through a public IP address and the client has an app, you can update the pre-configured origin public IP address through a version update or patch. If the client does not have an app, you can directly replace it with the public IP address allocated by the GA acceleration region.
Recommendations for deploying the origin service itself:
- If the origin server is deployed on Alibaba Cloud, use a cluster deployment. You can select the appropriate SLB product based on the service protocol to build the cluster system and deploy backend servers in multiple zones. For critical services, you can consider a multi-cluster deployment across different regions, scheduled using the traffic weighting feature of GA.
- If the origin server is not on Alibaba Cloud, you should also use a cluster deployment for the business system. In addition, you must consider two aspects. First, check if the origin server has restrictions on the source IP address of access requests. If it does, retrieve the public IP address of the endpoint group from the GA console and add it to the whitelist. Second, when you configure the GA endpoint group, enable health checks to monitor the availability of the origin server in real time and avoid invalid forwarding.

Security

The security design depends on your origin server type and service requirements. For websites, pair GA with at least WAF. For games, pair GA with at least Anti-DDoS. Combine products based on your traffic forwarding paths and protection requirements. The following are common deployment models:

Client -> Anti-DDoS -> GA -> WAF -> Server

This model is suitable for businesses such as cross-border office work and e-commerce that are vulnerable to DDoS attacks and web attacks. Traffic first passes through Anti-DDoS protection, is then accelerated, cleaned by WAF, and finally sent to the origin server.
Client -> GA -> WAF -> Server

This model is suitable for web services such as cross-border e-commerce and official websites that are vulnerable to web attacks and have geographically dispersed users. Traffic is first accelerated, then cleaned by WAF, and finally delivered to the origin server.
Client -> WAF -> GA -> Server

This model is suitable for web services such as cross-border e-commerce and official websites that are vulnerable to web attacks and have geographically concentrated users. Traffic is first cleaned, then accelerated, and finally delivered to the origin server.
Client → DDoS → GA → Server

This model is suitable for businesses such as games and apps that are vulnerable to DDoS attacks. Traffic is first protected by Anti-DDoS, then accelerated, and finally delivered to the origin server.

Performance and elasticity

To maximize the acceleration effect, consider the following aspects during the design phase:

Acceleration region selection: Select a region based on the actual distribution of your users. Prioritize the nearest region first, then the largest. The nearest principle is easy to understand. The largest principle refers to selecting a node in a large city with a well-developed network. For example, if users are equidistant from the Philippines and Singapore, you should prioritize Singapore because it is an Internet hub with more abundant basic network resources than the Philippines.
Bandwidth level design: Design for a bandwidth utilization of 70% to ensure smooth traffic forwarding and provide some capacity for handling traffic bursts.
GA product specifications and billing method selection:
- For services with high elasticity requirements and large fluctuations in bandwidth, you can use the pay-as-you-go billing method. This billing method includes pay-per-CU for the GA instance and pay-by-data-transfer for bandwidth. With pay-per-CU, the processing performance of all acceleration region clusters automatically scales with business fluctuations. With pay-by-data-transfer, the public network traffic that enters the acceleration region, the cross-region private network traffic between the acceleration region and the endpoint group, and the public network traffic that leaves the endpoint group are all automatically billed by data transfer. You only need to set the bandwidth peak for the acceleration region based on the business peak and ensure that a sufficient buffer is reserved to meet the maximum elasticity requirements.
- For services with relatively stable traffic and small fluctuations in bandwidth, you can select the subscription billing method. You can select the appropriate instance type and bandwidth plan based on the business concurrency and bandwidth requirements.

Observability

Observability helps you measure acceleration performance, monitor access data, and troubleshoot O&M issues. GA and its associated products provide monitoring capabilities in the console, including bandwidth curves, access logs, and operation logs. For automated O&M, use Cloud Monitor to configure alerts. For example, if you use pay-by-bandwidth billing, you can set a bandwidth utilization threshold so the system notifies O&M engineers to upgrade bandwidth before traffic spikes cause disruption.

Automated O&M: You can use Cloud Monitor to configure alert management. You can monitor metrics for the acceleration region and endpoint group, such as inbound/outbound bandwidth changes, inbound/outbound packet loss rate, inbound/outbound packet rate, and inbound/outbound bandwidth utilization. You can configure thresholds to trigger alerts.
Troubleshooting: You can use the operation log of GA to check for misoperations. You can use the access log to analyze user access failures. You can use Cloud Monitor to observe the channel latency metric (latency between the acceleration region and the endpoint group) to assess whether forwarding performance meets expectations.

Scenarios

Gaming scenario

Gaming demands the highest level of real-time interaction. Game servers are often deployed by partition or region, yet players expect smooth operation and instant skill output. MOBA and shooting games have the strictest latency requirements. For large-scale deployments such as a single server covering a large region, the network layer must compensate for the added latency.

GA can accelerate both platform servers and battle servers at Layer 4 (TCP/UDP) and Layer 7 (HTTP/HTTPS), regardless of whether the origin server is on Alibaba Cloud. Combine Anti-DDoS, WAF, CDN, and DNS as needed for a complete solution.

The pay-as-you-go billing method works well for gaming. The GA instance is billed per CU and cross-region bandwidth is billed by data transfer, so you do not need to pre-allocate bandwidth for each acceleration region. This fits the bursty traffic pattern typical of gaming scenarios.

For categories such as card games, e-sports, and 5v5 battles that involve a deployment model with many IP addresses on the same port, you can use the custom route solution of GA to easily meet acceleration needs and improve the player's gaming experience.
Cross-border office work

When enterprises expand overseas or when foreign companies operate in China, using office systems such as email, OA, and ERP across borders is challenging. Employees need fast system responses to stay productive. Because business data is involved, public network transmission may not meet security requirements. While VPNs provide connectivity, slow connections and upload delays over long distances can seriously affect office efficiency.

You can select the nearest acceleration region based on the geographical distribution of employees. The amount of office traffic is relatively fixed with small peaks and valleys. You can use the pay-by-bandwidth billing method for better cost-effectiveness.

You can combine it with security products such as WAF to improve efficiency while ensuring data security.
Cross-border e-commerce

Global consumers increasingly compare prices across borders, and niche e-commerce businesses attract customers worldwide. However, when customers are far from the website servers or transactions cross borders, the public network cannot guarantee a reliable access experience. Poor connectivity can cause not only slow page loads but also errors such as incorrect orders or failed payments.

You can open acceleration regions in the corresponding areas based on user distribution. You can also select the appropriate billing method based on the website's traffic waveform. For small peaks and valleys, use the pay-by-bandwidth method. For large peaks and valleys, use the pay-by-data-transfer method.

Because e-commerce websites have both static content, such as images and text descriptions, and dynamic content, such as videos and inventory updates, you can consider combining it with CDN. Static content is cached locally through CDN, and dynamic content is sent back to the origin server through GA's accelerated routes.
App globalization

Mobile apps are essential to daily life. When users travel or work abroad, they still rely on the same apps, but cross-border network conditions often degrade the experience.

Based on your app login heat map, deploy GA acceleration regions in high-traffic areas. When a user connects to the app server, GA returns the nearest accelerated IP address, routing traffic through an optimized path that significantly improves the user experience.

Terraform reference

Accelerate a wide area network with GA

Item	Description
Terraform Module official website	terraform-alicloud-ga-acceleration-for-wide-area-networks
GitHub URL	terraform-alicloud-ga-acceleration-for-wide-area-networks
Example Address	Example URL

Code flow:

Create a GA instance and EIP instances.
Configure the GA instance to accelerate the EIPs and configure different bandwidth peaks for the different acceleration regions.

The following instances must be created:

1 GA instance
2 EIP instances

Accelerate a game platform server with GA

Item	Description
Terraform Module official website	ga-acceleration-for-game-platform-server
GitHub URL	ga-acceleration-for-game-platform-server
Address Example	Example URL

Code flow:

Create a GA instance. Create a VPC and vSwitches, and then create an ALB instance in the VPC. Attach ECS instances to the backend server group of the ALB instance.
Configure the GA instance to accelerate the ALB instance.

The following instances must be created:

1 GA instance
1 VPC-connected instance
2 vSwitches
1 ALB instance
2 ECS instances