company · deep · draft
Microsoft / Azure (edge & host SDN)
Microsoft’s public networking story centers on Azure Front Door (anycast edge + private WAN), host SDN (VFP / AccelNet), Internet peering (AS8075 policy), and Cascara edge TE research — plus Service Fabric as a historical microservices platform paper. Living Front Door PoP counts disagree; treat them as known unknowns.
In one sentence. Teaching Azure’s published edge and host-SDN designs without inventing DC Clos inventories or freezing conflicting living-doc PoP counts as fact.
Why it exists
Azure Front Door terminates HTTP(S) near users via Anycast PoPs connected over Microsoft’s private WAN (Learn overview + traffic-acceleration docs; 2022 Standard/Premium blog). Host SDN (VFP NSDI 2017; AccelNet NSDI 2018) implements most Azure virtual networking in the host / SmartNIC path. Cascara (NSDI 2021) studies cloud-edge TE under bandwidth pricing. Cross-links: `/architectures/apis-edge/` (edge termination), `/architectures/spine-leaf-clos/` (Clos teaching — not Azure fabric disclosure).
Visual walkthrough
DNS/HTTP traffic uses Anycast so the client reaches a nearby Front Door PoP. Primary and fallback VIP rings handle preference and overflow as documented.
Almost all Azure virtual networking features are implemented in host virtual switches via VFP layered match-action tables (NSDI 2017).
Service Fabric provides a distributed platform for building microservices on shared machine pools, with design lineage since the early 2000s and production use described since ~2007 in the paper.
Control vs data plane
Control plane
Front Door steers via Anycast VIP rings (outer preferred, inner overflow/failover) and health-aware origin selection after edge processing (traffic-acceleration). Cascara is research TE at cloud PoPs — not a public B4-equivalent WAN controller dump. Service Fabric (EuroSys 2018) describes a historical dense microservices platform underpinning named Azure services as of the paper — treat as era-labeled, not a 2026 scheduler inventory.
Data plane
Client → Front Door PoP (Anycast) → Microsoft private WAN → healthy origins (including Private Link origins on Premium per product docs). Inside the Azure host: VFP layered match-action tables; AccelNet offloads VFP to FPGA SmartNICs for near-native performance. Do not invent regional Clos port counts.
Request / packet path
North–south
Internet client hits Front Door Anycast; split TCP at the edge; then private-WAN forwarding toward origins. Internet peering at Microsoft edge is governed by the published AS8075 / AS-SET policy (peers must filter AS12076 ExpressRoute). ExpressRoute is a separate private-connectivity product.
East–west
Tenant east–west is mediated by host SDN policy (VFP/AccelNet papers). Full Azure datacenter fabric generations and oversubscription remain unpublished → known unknowns. Cascara addresses inter-domain bandwidth cost at the edge, not intra-DC Clos math.
Scaling & math
Living Front Door docs disagree on edge footprint (“more than 118 edge locations across 100 metro areas” vs “over 150 edge locations” on traffic acceleration) — do not pick a single number as authoritative. Cascara and AccelNet paper figures are era-labeled research/product claims, not live rack inventories.
When it breaks
- Users reach a Front Door PoP but origins fail after edge processing.
Cause. Origin health probes fail or Private Link / backend path degraded.
Mitigation. Treat origin health and Premium Private Link paths as hard dependencies per Front Door docs; separate edge SLO from origin SLO.
- Traffic shifts to farther PoPs or inner VIP ring under PoP stress.
Cause. Outer Anycast VIP ring withdraw/failover themes as published.
Mitigation. Expect primary/fallback VIP rings; do not invent unpublished TE objectives.
- Tenant VNET isolation or ACL behavior unexpected on a VM path.
Cause. Host virtual-switch (VFP) policy misconfiguration or incomplete offload.
Mitigation. Debug as host SDN / SmartNIC path per VFP and AccelNet papers — not as invented ToR Clos.
- VM networking falls back toward software VFP performance under offload issues.
Cause. SmartNIC / AccelNet offload path unavailable for VFP tables.
Mitigation. AccelNet paper: FPGA SmartNIC offload for near-native rates; treat offload health as a host data-plane concern.
- Unexpected ExpressRoute (AS12076) routes appear via Internet peering.
Cause. Peer failed to filter AS12076 as required by Microsoft peering policy.
Mitigation. Peers must filter AS12076; Internet peering ≠ ExpressRoute product path.
Misconceptions
- “Front Door Learn pages agree on a single PoP count.” — Living docs conflict (118+ vs 150+); record the conflict in Known unknowns.
- “Service Fabric 2018 figures are today’s live Azure scheduler map.” — Era-label the paper; current SF vs AKS split is unknown.
- “VFP/AccelNet papers disclose Azure regional Clos port counts.” — They document host SDN / SmartNIC policy, not building floorplans.
Reference expression
Primary: Front Door overview + traffic acceleration + 2022 blog; Internet peering policy; VFP NSDI 2017; AccelNet NSDI 2018; Cascara NSDI 2021; Service Fabric EuroSys 2018 (historical). review: draft. Thin honesty on PoP counts and DC fabric beats invented topology.
Standards & sources
- azure-front-door-overview · Front Door edge + private WAN themesPrimary source, retrieved 2026-09-20. Azure Front Door overviewAzure Front Door overview — Front Door edge + private WAN themes
- azure-front-door-traffic-acceleration · Anycast / split TCP / VIP ringsPrimary source, retrieved 2026-09-20. Traffic acceleration — Azure Front DoorTraffic acceleration — Azure Front Door — Anycast / split TCP / VIP rings
- azure-front-door-blog-2022 · Standard/Premium Front Door GA narrativePrimary source, retrieved 2026-09-20. Introducing the new Azure Front DoorIntroducing the new Azure Front Door — Standard/Premium Front Door GA narrative
- microsoft-internet-peering-policy · AS8075 / AS12076 filter policyPrimary source, retrieved 2026-09-20. Microsoft Internet peering policyMicrosoft Internet peering policy — AS8075 / AS12076 filter policy
- msft-vfp-nsdi-2017 · VFP host SDN virtual switchPrimary source, retrieved 2026-09-20. VFP: A Virtual Switch Platform for Host SDN in the Public CloudVFP: A Virtual Switch Platform for Host SDN in the Public Cloud — VFP host SDN virtual switch
- msft-accelnet-nsdi-2018 · AccelNet SmartNIC offloadPrimary source, retrieved 2026-09-20. Azure Accelerated Networking: SmartNICs in the Public CloudAzure Accelerated Networking: SmartNICs in the Public Cloud — AccelNet SmartNIC offload
- microsoft-cascara-nsdi-2021 · Cloud-edge TE researchPrimary source, retrieved 2026-09-20. Cost-effective Cloud Edge Traffic Engineering with CascaraCost-effective Cloud Edge Traffic Engineering with Cascara — Cloud-edge TE research
- msft-service-fabric-2018 · Service Fabric historical platform paperPrimary source, retrieved 2026-09-20. Service Fabric: A Distributed Platform for Building Microservices in the CloudService Fabric: A Distributed Platform for Building Microservices in the Cloud — Service Fabric historical platform paper
Known unknowns
- Authoritative single Front Door PoP / edge-location count — living Learn docs conflict (118+ vs 150+ language).
- Full Azure datacenter fabric topology (spine-leaf generations, oversubscription) beyond host SDN papers.
- Detailed Microsoft WAN TE comparable to Google B4 (objectives, utilization, site inventory).
- Whether every named Service Fabric consumer from the 2018 paper still runs on SF vs AKS or other substrates.
- Physical interconnect capacity and peering graphs per metro beyond policy + secondary operator data.
- How Bing / M365 / LinkedIn traffic share Front Door vs private stacks beyond high-level blog claims.
Check yourself
Azure Front Door as published primarily uses…
- Only DNS steering with no Anycast
- Anycast edge PoPs plus Microsoft private WAN toward origins
- Invented Azure Clos port counts
- Open Connect OCAs
Answer: Anycast edge PoPs plus Microsoft private WAN toward origins. Learn docs: Anycast PoPs connected via Microsoft private WAN.
VFP (NSDI 2017) primarily documents…
- Bing private WAN TE
- Host virtual-switch layered match-action for Azure SDN
- Starlink laser mesh
- Cloudflare Unimog
Answer: Host virtual-switch layered match-action for Azure SDN. VFP is the Azure host SDN virtual switch paper.
AccelNet (NSDI 2018) offloads VFP to…
- Customer laptops only
- FPGA SmartNICs for near-native VM networking performance
- Netflix OCAs
- PeeringDB ASNs
Answer: FPGA SmartNICs for near-native VM networking performance. AccelNet: SmartNIC offload of host SDN tables.
Microsoft Internet peering policy asks peers to filter…
- AS13335 only
- AS12076 (ExpressRoute) routes
- All IPv6
- Nothing — open by default
Answer: AS12076 (ExpressRoute) routes. Published peering policy: filter AS12076.
How should Front Door PoP counts be treated?
- Pick 118 or 150 and freeze forever
- As living-doc drift / known unknowns when docs conflict
- Invent a third unpublished number
- Ignore Learn docs entirely
Answer: As living-doc drift / known unknowns when docs conflict. Phase 7 ship rule: reconcile conflicts into knownUnknowns.
Service Fabric EuroSys 2018 should be presented as…
- Live 2026 scheduler inventory for all Azure
- Historical platform paper with era-labeled claims
- Proof of Azure Clos radix
- Cloudflare anycast primer
Answer: Historical platform paper with era-labeled claims. Backlog: SF paper is historical; current split is unknown.
Cascara (NSDI 2021) studies…
- Starlink ISL routing
- Cloud-edge traffic engineering under bandwidth cost / latency bounds
- Airbnb SmartStack
- S3 erasure coding recipes
Answer: Cloud-edge traffic engineering under bandwidth cost / latency bounds. Cascara is Microsoft cloud-edge TE research.
What belongs in Known unknowns for this lens?
- That Front Door uses Anycast (already published)
- Authoritative single PoP count, full Azure Clos generations, B4-like WAN TE dump
- AS8075 existence in the peering policy
- That VFP is a host virtual switch
Answer: Authoritative single PoP count, full Azure Clos generations, B4-like WAN TE dump. Thick edge/host SDN; thin inventable DC/WAN inventory.