Two problems, often confused
Company traffic and public traffic look similar on a diagram and behave nothing alike.
- Company traffic: predictable volume, a known set of users, site-to-site or user-to-site, and often sensitive. It benefits from a dedicated private path.
- Public traffic: unpredictable volume, unknown users, largely cacheable, and delivered over the open internet. It benefits from being terminated close to the user.
Buying a dedicated circuit to speed up a public website is expensive and mostly wasted, because it cannot help users you have never met. Conversely, an edge network cannot give your engineers a private tunnel into a mainland data centre, since that is a different product entirely.
The options for company traffic
| Option | How it works | Strengths | Weaknesses |
|---|---|---|---|
| Dedicated line | Reserved capacity on a private circuit between two fixed points | Predictable latency and loss, unaffected by internet congestion | Priced by bandwidth and distance; weeks to provision; fixed endpoints |
| MPLS VPN | Carrier-managed private network with quality of service | Multi-site with contractual SLAs; predictable across many destinations | Cost scales with sites and bandwidth; slower to change |
| SD-WAN | Overlay that steers traffic across multiple internet paths | Fast to deploy, uses cheaper links, policy-driven | Inherits the underlying paths, which are the problem it is meant to solve |
| Site-to-site or client VPN | Encrypted tunnel over the public internet | Cheap and quick to stand up | Inherits every weakness of the cross-border path it rides on |
The pattern is that everything except a dedicated circuit inherits the behaviour of the public path underneath it. SD-WAN makes better use of bad paths; it does not create a good one.
The options for public traffic
For a website the useful question is not how to build a private path to every user, but how to avoid making every user take the cross-border trip at all.
| Option | What it does | When it fits |
|---|---|---|
| Move the origin closer | Shortens the distance problem | Regional user base, and the data is allowed to move |
| Near-shore edge | Terminates requests close to the mainland and caches aggressively | Public sites and APIs with a mainland audience and no filing |
| Mainland hosting | Serves users from inside the country | Latency must be minimal and a filing is acceptable |
| Private backhaul to origin | Carries edge-to-origin traffic over a private circuit | Large, steady, sensitive flows between two fixed points |
Where the cost bites
- Dedicated capacity is priced for peak and billed around the clock. If your peak lasts four hours a day, most of that circuit is idle.
- Edge networks are priced on traffic and requests, so cost tracks usage, which cuts both ways: a cache miss costs more than a hit.
- Cache-hit ratio is a cost lever as much as a performance lever. Improving it lowers the bill and the latency at the same time.
- Provisioning time is a cost too. A circuit that takes six weeks to install is six weeks of lost business.
Choosing
- Public website or API for mainland users: near-shore edge.
- Private access into a mainland network: dedicated line or MPLS, with SD-WAN as a cheaper approximation.
- Both: use the edge for users and a private path for the systems that need one. They are complementary, not competing.