network · deep · draft
Anycast & global traffic steering
Compare published steering mechanisms: BGP anycast (Cloudflare), AWS Global Accelerator anycast product path, Azure Front Door traffic acceleration, Fastly routing-to-edge docs, and Netflix BGP-informed Open Connect steering — not one universal “global load balancer.”
In one sentence. “Steer users to the best edge” is underspecified. DNS steering, anycast, managed anycast accelerators, and control-plane URL selection with BGP inputs are different mechanisms with different failure domains.
Why it exists
Phase 8 comparison page. Cloudflare publishes anycast multi-city service IPs (`/architectures/cloudflare/`). AWS documents Global Accelerator’s anycast routing to regional endpoints. Azure Front Door documents traffic acceleration / edge entry. Fastly documents how traffic is routed to its network. Netflix Open Connect steers via control-plane URLs informed by BGP prefixes — explicitly not “classic DNS anycast CDN” language (`/architectures/netflix/`, `/architectures/edge-cdn-request-path/`). Cross-link `/architectures/amazon-aws/` and `/architectures/microsoft/` for product surfaces.
Visual walkthrough
Identical anycast prefixes are announced from multiple cities. The client lands on a nearby PoP via BGP.
Global Accelerator documents anycast entry that maps to regional endpoints with product health checks.
Anycast: client packets hit a BGP-chosen PoP using the same service IP. Failover is withdraw/convergence — not URL reissue.
Control vs data plane
Control plane
Anycast: identical prefixes announced from many sites; BGP decides entry PoP; withdraw fails traffic over. Global Accelerator / Front Door: AWS/Azure control planes map anycast or edge entry to backends per product docs. Netflix: Steering service ranks OCAs using health + BGP-learned prefixes + availability. DNS-only steering (when used) depends on resolver geography and TTLs — do not invent a company DNS graph without sources.
Data plane
Packets (anycast/GA) or HTTP fetches (OCA URLs / CDN PoPs) follow the chosen entry. Failure modes differ: anycast withdraw vs DNS TTL stickiness vs stale Steering manifests vs product health-check drain.
Request / packet path
North–south
Client → steered entry (anycast IP, accelerator, Front Door, Fastly PoP, or OCA URL) → service/bytes. Walkthroughs contrast mechanism, not invent a merged topology.
East–west
Inter-site recovery is mechanism-specific: BGP convergence for anycast; product failover for GA/Front Door; Netflix embedded vs peering preference. Unpublished private WAN TE remains unknown.
Scaling & math
No universal “best steering” latency formula across vendors. Living marketing footprints age. OMP/SD-WAN pathing is a different domain (`/architectures/sd-wan-overlay/`).
When it breaks
- Clients shift to a farther anycast site after withdraw.
Cause. BGP withdraw of anycast prefixes.
Mitigation. Expect BGP-driven failover; monitor announcement health per city/PoP role.
- Global Accelerator traffic misses a regional endpoint.
Cause. Endpoint unhealthy or removed from the accelerator configuration.
Mitigation. Use product health checks / endpoint groups per AWS docs — not invented TE schedules.
- Users hit a suboptimal Front Door entry or origin path.
Cause. Edge entry / origin config or regional issue on the product path.
Mitigation. Debug Front Door traffic acceleration and origin health per Microsoft docs; Front Door PoP counts conflict across living docs → known unknowns on the Microsoft lens.
- OCA URLs poor despite healthy appliances.
Cause. Steering inputs (health, BGP prefixes, titles) stale.
Mitigation. Treat Steering as control-plane dependency; see Netflix lens.
- Clients stick to a bad answer longer than anycast would.
Cause. DNS-based steering with long TTLs (general mechanism contrast — not a company claim).
Mitigation. Understand TTL blast radius when DNS is the steering plane; prefer citing product DNS docs when asserting a vendor’s design.
Misconceptions
- “Open Connect is a global anycast CDN like classic DNS anycast CDNs.” — Partner docs emphasize BGP-informed steering + URL selection.
- “Global Accelerator, Front Door, and Cloudflare anycast are identical mechanisms.” — Compare product docs; do not merge.
- “Any steering problem is solved by lowering DNS TTL alone.” — Anycast and control-plane URL steering have different failure domains.
Reference expression
Primary: Cloudflare anycast primer + architecture; AWS Global Accelerator how-it-works; Azure Front Door overview + traffic acceleration; Fastly routing-traffic; Netflix Open Connect overview + network config. review: draft. When to choose anycast teaching: same service IP, BGP-driven PoP entry. When to choose BGP-informed CDN steering: embedded caches with ISP prefix control. When not: collapse all into one unlabeled GSLB box.
Standards & sources
- cloudflare-anycast-primer-2011 · Anycast multi-city service IPsPrimary source, retrieved 2026-09-20. A Brief Primer on AnycastA Brief Primer on Anycast — Anycast multi-city service IPs
- cloudflare-architecture-bpf-2019 · Anycast edge + in-PoP pathPrimary source, retrieved 2026-09-20. Cloudflare architecture and how BPF eats the worldCloudflare architecture and how BPF eats the world — Anycast edge + in-PoP path
- aws-global-accelerator-how-it-works · AWS GA anycast product pathPrimary source, retrieved 2026-09-20. How AWS Global Accelerator worksHow AWS Global Accelerator works — AWS GA anycast product path
- azure-front-door-overview · Azure Front Door edge entryPrimary source, retrieved 2026-09-20. Azure Front Door overviewAzure Front Door overview — Azure Front Door edge entry
- azure-front-door-traffic-acceleration · Front Door traffic accelerationPrimary source, retrieved 2026-09-20. Traffic acceleration — Azure Front DoorTraffic acceleration — Azure Front Door — Front Door traffic acceleration
- fastly-routing-traffic · Routing traffic to FastlyPrimary source, retrieved 2026-09-20. Routing traffic to FastlyRouting traffic to Fastly — Routing traffic to Fastly
- netflix-open-connect-overview · Steering vs OCA bytesPrimary source, retrieved 2026-09-20. Netflix Open Connect OverviewNetflix Open Connect Overview — Steering vs OCA bytes
- netflix-open-connect-network-config · BGP prefix inputs to steeringPrimary source, retrieved 2026-09-20. Network configuration (Open Connect BGP/ASN)Network configuration (Open Connect BGP/ASN) — BGP prefix inputs to steering
Known unknowns
- Exact DNS TTL policies for most companies are unpublished.
- Azure Front Door PoP/count figures conflict across living docs — see Microsoft lens known unknowns.
- Private WAN TE between anycast sites is generally unpublished.
Check yourself
Cloudflare’s published city entry for service IPs relies primarily on…
- Only Netflix Steering manifests
- BGP anycast of the same service IPs from many cities
- Only Azure Private Link
- Only Catalyst SD-WAN OMP
Answer: BGP anycast of the same service IPs from many cities. Anycast primer.
AWS Global Accelerator how-it-works documents…
- Anycast routing to regional endpoints as a product path
- Cisco SGT microseg
- Starlink ISL TE
- EVPN Type-2 only
Answer: Anycast routing to regional endpoints as a product path. GA product documentation.
Netflix embedded OCA steering is primarily…
- Identical to Cloudflare Unimog
- Control-plane URL selection informed by BGP-announced prefixes
- Only CloudFront behaviors
- Only Front Door WAF
Answer: Control-plane URL selection informed by BGP-announced prefixes. Open Connect network configuration + overview.
When is DNS TTL stickiness a distinct failure mode vs anycast withdraw?
- Never — they are identical
- When steering depends on DNS answers that caches hold, unlike BGP-driven anycast entry shift
- Only inside a single rack
- Only for VPN 0
Answer: When steering depends on DNS answers that caches hold, unlike BGP-driven anycast entry shift. Mechanism contrast for teaching.
Azure Front Door traffic acceleration docs are best used to teach…
- Invented Microsoft DC Clos
- Product edge entry / acceleration — with PoP count conflicts left as known unknowns
- OMP TLOC colors
- TrustSec SGACL syntax only
Answer: Product edge entry / acceleration — with PoP count conflicts left as known unknowns. Product surface + honesty about living docs.
When should you pick BGP-informed CDN steering as the teaching lens?
- When explaining embedded ISP caches with prefix control (Open Connect class)
- When explaining only Unimog XDP
- When explaining collapsed core FHRP
- When explaining Spanner TrueTime
Answer: When explaining embedded ISP caches with prefix control (Open Connect class). When-to-choose among steering mechanisms.
Collapsing GA, Front Door, Cloudflare anycast, and Open Connect into one GSLB box is…
- Recommended pedagogy
- Dishonest — mechanisms and failure domains differ across primaries
- Required by SPEC
- How Fastly Faild works
Answer: Dishonest — mechanisms and failure domains differ across primaries. Comparison gate: no invented universal GSLB.
Fastly routing-traffic documentation helps contrast…
- How clients are directed to Fastly’s network vs pure anycast narratives
- Cisco Validator bring-up only
- Jupiter Clos stages
- S3 erasure coding
Answer: How clients are directed to Fastly’s network vs pure anycast narratives. Routing-to-Fastly primary.