Cloud Network Well-architected Design Guidelines:Intelligent network O&M design

Configure alert rules

Subscribe to alert notifications

Alert notifications are classified into Critical, Warning, Notification (Info), and Resolved based on the alert severity.

We recommend that you configure a proper notification method for each level of alerts. For Critical alerts that can cause direct and continuous impacts on your business, we recommend that you specify telephone call as the primary notification method and immediately respond to such alerts. For ignorable alerts that do not cause adverse impacts on your business, we recommend that you view and manage the alerts during a specific time windows on a daily basis. This way, you can fix the issues while focusing on business-critical agendas.

For more information about alert templates, see Manage notification templates.

Manage alerts

Configure inspections for different types of risks

1. Stability risks

   In the design of a high availability (HA) architecture, if primary/secondary servers are improperly configured, switchover may fail. This may compromise system continuity and stability. In addition, improper resource deployment policies may spread the failure impact, which is also known as an expanded explosion radius. In such cases, more servers or components are affected. As a result, the overall service stability may be significantly reduced.

   To prevent such risks, you can run inspections to optimize resource deployment policies and ensure that switchover can be implemented as configured. This helps you improve system disaster recovery and take measures to eliminate potential risks.

2. Security risks

   Access control lists (ACLs) may fail to block unauthorized access due to coarse-grained filtering. Security groups may grant permissions to unnecessary ports and services. As a result, the risk of attacks is increased due to violations against the principle of least privilege (PoLP).

   You can run inspections to thoroughly check ACLs and security groups to ensure that only authorized access is allowed to necessary destinations. This improves overall network security.

3. Performance risks

   Network latency may be increased by performance bottlenecks or bypasses. Packet loss may occur if network traffic frequently exceeds the maximum bandwidth.

   We recommend that you use inspections to monitor your network latency and scale out resources based on inspection results. This helps you ensure quality of service (QoS) even if the amount of data transfers increases.

4. Resource waste

   Low resource unitization results in resource waste. If you select an improper billing method, spending on resources may unexpectedly increase, which reduces the cost-benefit ratio.

   You can run inspections to optimize resource deployment policies and increase resource utilization. You can select a proper billing method based on detailed cost-benefit analysis to control your budget and increase the cost-benefit ratio.

For more information, see Network inspection.

Run inspections

We recommend that you run inspections on a regular basis, such as every week, to monitor your network status and identify and analyze potential issues that can reduce resource utilization. Continuous monitoring and assessment help you maintain a stable network architecture, reduce costs, and ensure service continuity.

To view weekly network inspection reports, log on to the NIS console, click Network Inspection in the left-side navigation pane, click View historical reports in the Newest Inspection Report column, and then click Re-start in the upper-right corner.

1. Assess the overall network status based on the pass rate: The health assessment of the network is made based on the pass rate of inspections. O&M engineers can quickly determine the overall network performance and identify potential issues based on the trend of report scores.

2. Handle risks by risk level: The inspection items are sorted on descending order of priority from the highest risk to the lowest risk. You can take different measures for different levels of risks based on the professional suggestions provided by the inspection reports. This process not only helps you efficiently handle high-risk issues that may compromise system stability, but also provides clear suggestions on how to optimize your network environment.

Handle potential risks

Examples:

1. Control costs

   • EIPs: Run inspections to detect and release idle EIPs to prevent resource waste.

   • CEN: Allocate inter-region bandwidth resources based on actual traffic volumes to prevent resource waste.

2. Improve stability

   • Over-limit risks: Bandwidth exhaustions or insufficient resources specifications.

   • Single points of failure (SPOFs) in a zone: If you deploy an ALB instance, an NLB instance, or a transit router in a single zone, instability issues may arise.

   • SPOFs on connections: If you use only one Express Connect circuit, one GA acceleration one, or one VPN tunnel, connectivity issues may arise.

   • Service unavailability: Service errors may occur.

Use observation tools

1. Generate topologies — Virtualize the entire network

   Network topologies display the connections and relationships between network resources in visualized charts. Network topologies help you quickly learn about the architecture of networks on Alibaba Cloud, verify network configurations, troubleshoot network issues, and perform centralized O&M on cloud network resources.

   Topology	Displayed information
   VPC	Resources, including ECS instances, vSwitches, and routers Routes, including network elements inside and outside VPCs and route tables
   CEN	Transit routers worldwide, VPCs connected to transit routers, and transit routers connected to each other
   SLB	SLB zones, virtual IP addresses (VIPs), EIPs, and security groups

2. Traffic analysis — Sort network traffic from multiple dimensions

   The traffic analysis feature can be used to monitor real-time network traffic, analyze historical network traffic, and generate visualized time series charts in the NIS console based on analysis results. You can troubleshoot issues based on the traffic data and collected metrics.

   • Internet traffic analysis: You can use this feature to analyze the traffic in each region based on different types of resources that are associated with public IP addresses, including the traffic of the public IP addresses that are associated with CLB instances, the traffic of the public IP addresses that are associated with ECS instances, the traffic of the public IP addresses that are associated with Internet NAT gateways, the traffic of EIPs, and the traffic of the EIPs added to the same Internet Shared Bandwidth instance.

   • Hybrid cloud traffic analysis: You can use this capability to analyze the inbound traffic and outbound traffic that flow through VBRs that are connected to transit routers in hybrid clouds.

   • Inter-region traffic analysis: You can use this capability to analyze the inbound traffic and outbound traffic that flow through transit routers across regions. The traffic data is displayed in the form of 1-tuple, 2-tuples, and 5-tuples.

   • Intra-region traffic analysis: You can use this capability to analyze the inbound traffic and outbound traffic that flow through transit routers that are connected to VPCs within the same region.

   • Internet NAT gateway traffic analysis: You can use this capability to analyze the traffic of Internet NAT gateways and generate visualized time series charts on the Overview page in the NIS console.

3. Internet quality — Impacts caused by Internet quality degradation

   • Detect Internet quality degradation based on the round-trip time (RTT) and retransmission rate.

   • Detect Internet quality degradation events, including the time range, ISP, area, and traffic volume.

   • Detect the public IP addresses affected by Internet quality degradation.

On-demand observation

1. Network topology

   In the NIS console, find the Network Topology module, select a network instance, and then click Generate Topology. This module also supports topology drilldowns that can obtain information from different network layers. This feature analyzes and virtualizes the resource allocation status of the network to facilitate network management and O&M.

   1. VPC topologies: VPC topologies are categorized into resource topologies and route topologies. A VPC topology displays the topology of routes and correlations between resource entities deployed in VPCs. In the VPC topology, you can view the basic information about related network instances, analyze these instances, and analyze reachability.

   2. CEN topologies: A CEN topology displays the intra-region and inter-region connections between the transit routers that are deployed on a CEN instance based on real-time configurations. In the CEN topology, you can view the connections between global cloud resources established by transit routers and view the basic information about related network instances. This helps you learn about and manage the cloud network in an intuitive way.

   3. SLB topologies: An SLB topology displays the connections between listeners and backend server groups of an SLB instance. You can view the basic information about the network instances in an SLB topology and analyze these instances to check whether traffic is routed as expected.

2. Traffic analysis

   You can use the traffic analysis feature of NIS to monitor real-time network traffic and analyze historical network traffic. The traffic analysis feature helps you analyze traffic based on the source IP address, based on the source and destination IP addresses, and based on the source IP address, source port, destination IP address, destination port, and protocol. You can use this feature to sort network traffic, such as the top N instances.

   You need to separately enable the following features before you can use them: Internet traffic analysis, hybrid cloud traffic analysis, inter-region traffic analysis, and intra-region traffic analysis.

   • You can enable the Internet traffic analysis feature for specific regions or public IP addresses. If you select a region, this feature is enabled for all public IP addresses in the region.

   • You can enable the hybrid cloud traffic analysis feature for the specific VBR connections on transit routers.

   • You can enable the inter-region traffic analysis feature for the specific inter-region connections on transit routers.

   • You can enable the intra-region traffic analysis feature for the specific VPC connections on transit routers.

3. Insight provider

   You can use insight providers to obtain real-time information about Internet quality assessment, learn about Internet quality degradation in a timely manner, and receive Internet quality events and event impact analysis.

   When you create an insight provider, you must configure monitored objects for the insight provider. Ten minutes after the insight provider is created, the insight provider starts to collect resource traffic and push specific metrics. You can click the insight provider name to view the network quality assessment scores, Internet quality degradation events, and public IP addresses that are affected by Internet quality degradation events. Such information reflects the Internet quality and helps you make information business decisions and adjustments.

Analysis and optimization

1. Optimization based on network topology observation

   1. A network topology shows the entire network architecture, which helps you obtain the architecture summary, path analysis, and resource allocation status.

   2. Network topologies help you efficiently identify potential issues by using the following checks:

      • Redundancy check: ensures that you have a redundancy mechanism to prevent SPOFs.

      • Configuration check: checks whether your configurations follow the best practices and helps you correct improper settings.

      • Security check: checks for potential security risks, such as ports and services that do not need to be exposed.

   3. We recommend that you take the following measures to manage low-utilization or idle resources:

      • Resource recycling: Release IP addresses and ports that are no longer used.

      • Configuration optimization: Optimization resource allocation and disable services that are no longer used.

2. Traffic and business optimization based on traffic analysis

   1. Internet optimization

      Internet traffic analysis accurately identifies the geographic distribution of users. You can deploy services in popular areas to reduce network latency and improve user experience.

      Internet traffic analysis continuously monitors Internet status based on key metrics, such as the bandwidth utilization, source IP addresses, destination IP addresses, source ports, destination ports, protocols, and RTT. Such information not only helps you identify the peak hours of your business, but also provides proofs for capacity planning and traffic management. You can maintain high availability and stability for your business even during peak hours with high workloads.

   2. Internal network optimization

      To optimize traffic in your internal network, we recommend that you detect the top N sources that generate the highest volume of traffic and perform drilldown analysis to identify and fix anomalies. This measure helps you prioritize key businesses and reduce performance degradation caused by non-critical businesses. Another measure is to inspect the TCP retransmission rate on a regular basis to assess the packet loss rate, which may compromise business continuity. You can make business adjustments based on the preceding observation results and improve network quality and reliability.

3. Internet issue identification based on insight providers

   Insight providers provide information about client locations and ISP networks, use an intelligent baseline algorithm to check whether performance downgrade or availability downgrade events occur, and provide event details to help you perform troubleshooting, including traffic analysis and Internet probes. You can also view the RTT and traffic information and monitor Internet status in real time by using the Internet traffic source map. Such information helps you make Internet adjustments in a timely manner to prevent business loss.