Cloud Network Well-architected Design Guidelines:Intelligent network O&M design

Configure alert rules

Subscribe to alert notifications

Alert notifications are classified into Critical, Warning, Notification (Info), and Resolved based on the alert severity.

Configure a notification method for each alert level. For Critical alerts that directly impact your business, use telephone calls as the primary notification method and respond immediately. For low-impact alerts, review and manage them daily during a specific time window.

For more information about alert templates, see Manage notification templates.

Manage alerts

Configure inspections for different types of risks

1. Stability risks

   In HA architecture design, improper primary/secondary configuration can cause switchover failures. Improper resource deployment may also expand the blast radius, affecting more servers and reducing overall stability.

   Run inspections to optimize resource deployment and verify switchover configurations, improving disaster recovery and eliminating potential risks.

2. Security risks

   Coarse-grained ACLs may fail to block unauthorized access. Security groups may expose unnecessary ports, violating the principle of least privilege (PoLP) and increasing attack risk.

   Run inspections to verify that ACLs and security groups allow only authorized access to necessary destinations.

3. Performance risks

   Network latency may be increased by performance bottlenecks or bypasses. Packet loss may occur if network traffic frequently exceeds the maximum bandwidth.

   Use inspections to monitor latency and scale out resources as needed, ensuring QoS as data transfer volumes grow.

4. Resource waste

   Low resource unitization results in resource waste. If you select an improper billing method, spending on resources may unexpectedly increase, which reduces the cost-benefit ratio.

   Run inspections to optimize resource deployment and increase utilization. Select a billing method based on cost-benefit analysis to control your budget.

For more information, see Network inspection.

Run inspections

Run inspections weekly to monitor your network status and identify potential issues that reduce resource utilization. Continuous monitoring helps maintain a stable network architecture, reduce costs, and ensure service continuity.

To view weekly inspection reports, in the NIS console, click Network Inspection, click View historical reports in the Newest Inspection Report column, and then click Re-start.

1. Assess the overall network status based on the pass rate: O&M engineers can quickly determine overall network performance and identify potential issues based on the trend of inspection scores.

2. Handle risks by risk level: Inspection items are sorted by priority from highest to lowest risk. Follow the suggestions in the inspection reports to fix high-risk issues first and then optimize your network environment.

Handle potential risks

Examples:

1. Control costs

   • EIPs: Run inspections to detect and release idle EIPs to prevent resource waste.

   • CEN: Allocate inter-region bandwidth resources based on actual traffic volumes to prevent resource waste.

2. Improve stability

   • Over-limit risks: Bandwidth exhaustions or insufficient resources specifications.

   • Single points of failure (SPOFs) in a zone: If you deploy an ALB instance, an NLB instance, or a transit router in a single zone, instability issues may arise.

   • SPOFs on connections: If you use only one Express Connect circuit, one GA acceleration one, or one VPN tunnel, connectivity issues may arise.

   • Service unavailability: Service errors may occur.

Use observation tools

1. Generate topologies — Virtualize the entire network

   Network topologies visualize the connections and relationships between network resources. They help you understand your Alibaba Cloud network architecture, verify configurations, troubleshoot issues, and centralize O&M.

   Topology	Displayed information
   VPC	Resources, including ECS instances, vSwitches, and routers Routes, including network elements inside and outside VPCs and route tables
   CEN	Transit routers worldwide, VPCs connected to transit routers, and transit routers connected to each other
   SLB	SLB zones, virtual IP addresses (VIPs), EIPs, and security groups

2. Traffic analysis — Sort network traffic from multiple dimensions

   The traffic analysis feature monitors real-time and historical network traffic, generating visualized time series charts in the NIS console. Use the traffic data and collected metrics for troubleshooting.

   • Internet traffic analysis: Analyze traffic by resource type associated with public IP addresses, including CLB, ECS, Internet NAT gateways, EIPs, and EIPs in Internet Shared Bandwidth instances.

   • Hybrid cloud traffic analysis: Analyze inbound and outbound traffic through VBRs connected to transit routers in hybrid clouds.

   • Inter-region traffic analysis: Analyze inbound and outbound traffic through transit routers across regions. Data is displayed as 1-tuple, 2-tuple, and 5-tuple.

   • Intra-region traffic analysis: Analyze inbound and outbound traffic through transit routers connected to VPCs within the same region.

   • Internet NAT gateway traffic analysis: Analyze Internet NAT gateway traffic and view visualized time series charts on the Overview page in the NIS console.

3. Internet quality — Impacts caused by Internet quality degradation

   • Detect Internet quality degradation based on the round-trip time (RTT) and retransmission rate.

   • Detect Internet quality degradation events, including the time range, ISP, area, and traffic volume.

   • Detect the public IP addresses affected by Internet quality degradation.

On-demand observation

1. Network topology

   In the NIS console, select a network instance in the Network Topology module and click Generate Topology. Topology drilldowns provide information from different network layers, helping you analyze resource allocation and manage network O&M.

   1. VPC topologies: Display resource and route topologies within VPCs. View basic information about network instances, analyze them, and check reachability.

   2. CEN topologies: Display intra-region and inter-region connections between transit routers on a CEN instance. View global cloud resource connections and network instance details.

   3. SLB topologies: Display connections between listeners and backend server groups of an SLB instance. Analyze network instances to verify that traffic is routed as expected.

2. Traffic analysis

   Use NIS traffic analysis to monitor real-time and historical network traffic. Analyze traffic by source IP, source and destination IPs, or the full 5-tuple (source IP, source port, destination IP, destination port, protocol). Sort network traffic to identify top N instances.

   Enable the following features separately before use: Internet traffic analysis, hybrid cloud traffic analysis, inter-region traffic analysis, and intra-region traffic analysis.

   • Enable Internet traffic analysis for specific regions or public IP addresses. Selecting a region enables this feature for all public IP addresses in that region.

   • Enable hybrid cloud traffic analysis for specific VBR connections on transit routers.

   • Enable inter-region traffic analysis for specific inter-region connections on transit routers.

   • Enable intra-region traffic analysis for specific VPC connections on transit routers.

3. Insight provider

   Use insight providers to get real-time Internet quality assessments, detect quality degradation, and receive impact analysis for Internet quality events.

   When you create an insight provider, configure monitored objects. Ten minutes after creation, the insight provider starts collecting resource traffic and pushing metrics. Click the insight provider name to view quality scores, degradation events, and affected public IP addresses. This information helps you make timely Internet adjustments to prevent business loss.

Analysis and optimization

1. Optimization based on network topology observation

   1. A network topology shows the entire architecture, providing architecture summaries, path analysis, and resource allocation status.

   2. Network topologies help you identify potential issues through the following checks:

      • Redundancy check: ensures redundancy mechanisms exist to prevent SPOFs.

      • Configuration check: verifies configurations follow best practices and helps correct improper settings.

      • Security check: identifies potential risks, such as unnecessarily exposed ports and services.

   3. Manage low-utilization or idle resources:

      • Resource recycling: Release IP addresses and ports that are no longer used.

      • Configuration optimization: Optimize resource allocation and disable unused services.

2. Traffic and business optimization based on traffic analysis

   1. Internet optimization

      Internet traffic analysis identifies the geographic distribution of users. Deploy services in popular areas to reduce latency and improve user experience.

      Internet traffic analysis continuously monitors Internet status using key metrics such as bandwidth utilization, source/destination IPs, ports, protocols, and RTT. This data helps you identify peak hours and plan capacity to maintain high availability during high workloads.

   2. Internal network optimization

      To optimize internal network traffic, detect the top N sources generating the highest traffic volume and perform drilldown analysis to identify and fix anomalies. This helps you prioritize key business traffic and reduce degradation from non-critical traffic. Inspect the TCP retransmission rate regularly to assess packet loss that may compromise business continuity. Make adjustments based on observation results to improve network quality.

3. Internet issue identification based on insight providers

   Insight providers collect client location and ISP data, use intelligent baseline algorithms to detect performance or availability degradation, and provide event details for troubleshooting (including traffic analysis and Internet probes). View RTT and traffic data on the Internet traffic source map to monitor Internet status in real time and make timely adjustments.