Hosting Provider and IT Services Company Network

The network of a hosting provider, IT services company, or cloud provider must deliver rigorous multi-tenancy, contractual SLAs, 100G/400G connectivity to major carriers, DDoS protection, and 24×7 management. 2026 hosting provider architecture guide.

Requirements

• Multi-tenancy: strict isolation between customers
• SLA: 99.99% minimum (4h/year), often 99.999% (5 min/year)
• Carrier connectivity: 100G peering with Tier-1 carriers (Orange, Telia, Cogent, Level3)
• DDoS: mandatory protection (attacks of 1-500 Gbps are common)
• Compliance: ISO 27001, HDS, and PCI-DSS depending on customer requirements
• Management: real-time dashboard for each customer

Multi-tenant fabric architecture

• Spine-leaf EVPN-VXLAN: one VRF per tenant
• Cisco Nexus 9300/9500 with multi-tenant ACI
• Juniper QFX + multi-tenant Apstra
• Arista 7050X3 + CloudVision
• Hardware segmentation (VRF) + logical segmentation (VXLAN VNI)

External connectivity

• Multi-homed BGP transit: 3-5 Tier-1 carriers
• Public peering: France-IX, AMS-IX, LINX
• Private peering: FB, Google, AWS Direct Connect, Azure ExpressRoute, GCP Partner Interconnect
• Full BGP table (950K+ IPv4 routes, 200K+ IPv6 routes)
• 100G ports minimum, 400G recommended in 2026

DDoS protection

• Scrubbing center: Radware, Arbor, A10 Networks, NSFocus
• Cloud DDoS protection: Cloudflare Magic Transit, Akamai Prolexic
• Hybrid: on-premises mitigation + cloud protection for extreme traffic volumes
• BGP Flowspec for real-time rate limiting
• Capacity: target mitigation capacity of 1-10 Tbps

Multi-tenant orchestration

• OpenStack: open-source IaaS infrastructure
• VMware Cloud Director: vCloud multi-tenancy
• Multi-cluster Kubernetes: Rancher, Anthos, OpenShift
• Customer self-service portal: vCloud Director, CloudStack

SLAs and monitoring

• Contractual SLA: 99.9% to 99.99% with customer service credits
• Monitoring: Prometheus + Grafana, Datadog, New Relic
• Ticketing: Zendesk, Freshdesk
• Status page: Atlassian StatusPage, Statuspage.io
• Detailed monthly reports for each customer

Security

• Shared WAF: F5, Imperva, Cloudflare
• SIEM: Splunk, Elastic, Sentinel
• In-house or outsourced 24×7 SOC
• Continuous vulnerability scanning: Qualys, Tenable
• Annual ISO 27001 audit

Budget for a mid-sized hosting provider (2 data centers)

• Core fabric: 2× modular Nexus 9500 = ~€800,000 excl. VAT
• 100G spine layer, 8 chassis: ~€500,000 excl. VAT
• 25G leaf layer, 40 chassis: ~€1,000,000 excl. VAT
• DDoS protection + WAF: ~€500,000 excl. VAT
• All-flash NAS/SAN storage: ~€2,000,000 excl. VAT
• SOC/SIEM over 3 years: ~€1,500,000 excl. VAT
• Total: ~€8-10M excl. VAT

Order from OPTINOC

Turnkey infrastructure for IT services companies and hosting providers. Cisco/Juniper/Arista spine-leaf + DDoS protection + multi-tenancy. ISO 27001 expertise. Quote within 1 week.