F5 Distributed Cloud Private Interconnect

Overview

F5 Distributed Cloud Private Interconnect enables secure, high-performance private connectivity between customer environments and the F5 Distributed Cloud Regional Edge. This utility extension allows organizations to consume security and networking services without exposing application origins to the public internet.

Core use cases

1. Secure Origin Connectivity Without Public Internet Exposure Customers can connect their application origin environments directly to the F5 Distributed Cloud (XC) Regional Edge (RE) using private connectivity instead of exposing infrastructure to the public internet.

• Capabilities: Eliminates direct public internet exposure for origin servers and establishes a secure private connectivity between customer routers/servers and F5 infrastructure.
• Typical Environments: On-premises data centers, private cloud environments, hybrid cloud deployments, and multi-cloud application architectures.
• Benefits: Reduced attack surface, enhanced security and compliance, more predictable network performance, and lower risk of direct DDoS exposure.

2. DDoS Protection and Security Services for Application Origins Place application origins behind the F5 Distributed Cloud security stack while maintaining entirely private back-end connectivity.

• Traffic Flow: F5 becomes the internet-facing entry point where traffic is inspected and protected before reaching the origin, keeping customer origins completely hidden from direct internet access.
• Available Security Services: DDoS protection, Web Application Firewall (WAF), API security, Bot defense, and threat mitigation services.
• Key Advantage: F5 absorbs and mitigates internet-based attacks at the edge, preventing malicious traffic from directly reaching customer infrastructure.

Note: Routed DDoS and application security services (for example: WAF, WAAP, and more) can't share the same Private Interconnect circuit.

3. Customer Edge (CE) to global network connectivity Customers with on-premises Customer Edge (CE) devices can establish secure private connectivity directly into the F5 Global Network or Global Controller (GC) infrastructure.

• Target Scenarios: Ideal for enterprises with branch or edge infrastructure, regulated environments requiring private routing, or customers implementing hybrid WAN architectures.
• Benefits: Supports secure private control-plane communication without traversing the public internet.

4. Hybrid and multi-cloud application connectivity Supports architectures where application components are distributed across public clouds, private clouds, and on-premises infrastructure. By using private connectivity into the F5 Distributed Cloud infrastructure, customers can maintain secure east-west and north-south traffic flows while standardizing security enforcement across environments.

Technical Connectivity Models

F5 Distributed Cloud Private Interconnect establishes a private, high-performance network path between customer application environments and the F5 Distributed Cloud RE.

Depending on whether your infrastructure is physically co-located within the same facility as an F5 Regional Edge PoP or located remotely within a broader geographic region, F5 offers two primary connectivity models: Dedicated Interconnect and Virtual Interconnect.

Model comparison summary

Technical Attribute	Dedicated Interconnect (Direct Physical)	Virtual Interconnect
Primary Definition	A dedicated, physical fiber cross-connect established directly between customer equipment and F5 router interfaces in the datacenter facility. F5 provides the LOA (Letter of Authorization), and the customer is responsible for ordering the cross-connect.	A software-defined virtual circuit provisioned over an interconnected Network-as-a-Service (NaaS) provider fabric (for example:Equinix, Megaport). No physical connectivity required.
Co-Location Requirement	Customer hardware or a carrier cage must be physically present in the same data center facility as the F5 PoP.	Customer can connect remotely from any data center, colocation facility, or public cloud VPC within the region.
Bandwidth & Port Speeds	Dedicated fixed ports at 10Gbps or 100Gbps.	Flexible virtual capacity from 1Gbps to 10Gbps (in 1Gbps increments).
Physical Interface	Direct 10G or 100G single-mode fiber patch cord (LOA/CFA required).	Virtual VLAN sub-interface over a shared partner fabric port.
Supported Partners	N/A (Direct Fiber)	Equinix Fabric , Megaport, Console Connect, PacketFabric, and Cologix Exchange.
Ideal For	High-throughput, low-latency enterprise backbones, large-scale origin protection, and high-volume data transit.	Moderate traffic volume, multi-cloud connectivity (AWS, Azure, GCP), and rapid virtual deployment.

---

Deep-dive: connectivity models

1. Dedicated Interconnect (Direct Physical Connection)

Dedicated Interconnect provides a private high-speed physical connection between customer-owned network routing equipment (or a customer’s carrier cage) and F5 Regional Edge routers located within the same co-location facility.

Key Capabilities & Technical Features:

• Physical Isolation: Dedicated physical port allocation ensures zero noisy-neighbor interference, maximum hardware-level security, and deterministic line-rate throughput.
• High-Capacity Port Options:
  • 10Gbps : Dedicated 10G SFP+ interface for standard enterprise high-bandwidth requirements.
  • 100Gbps : Full 100G QSFP28 router port allocation.
• Ultra-Low Latency: Directly connects equipment via physical fiber, eliminating any transit network hops.

Physical Requirements: Requires a physical Letter of Authorization / Connecting Facility Assignment (LOA/CFA) issued by F5 to complete the cross-connect installation with the facility provider. You are responsible for ordering and provisioning the cross connect by working with the datacenter provider or a carrier.

---

2. Virtual Interconnect

Virtual Interconnect enables customers to establish private connectivity into the F5 Regional Edge backbone without being physically present in the F5 co-location facility. It uses software-defined Network-as-a-Service (NaaS) fabrics to provide private connectivity between F5 Regional Edge locations and enterprise sites or public cloud environments .

Key Capabilities & Technical Features:

• Elastic Bandwidth: Provision capacity flexibly between 1Gbps and 10Gbps, scaled in precise 1Gbps increments to match application demand.
• No Co-Location Required: Bypasses the need for physical data center space or cross-connect cabling at the F5 PoP site.
• Multi-Cloud Integration: Seamlessly extend the connectivity to cloud service providers, including:
  • AWS Direct Connect
  • Microsoft Azure ExpressRoute
  • Google Cloud Dedicated / Virtual Interconnect
• Extensive Partner Ecosystem:
  • Equinix, Megaport, Console Connect, PacketFabric, and Cologix Exchange

Note: Partner availability varies by F5 Region Edge locations.

---

Architectural Decision Guide: Which Model Should You Choose?

Choose Dedicated Interconnect if:

• Your equipment is already co-located in an F5 PoP facility or you have a carrier in the same facility that can establish a connection between F5 and your environment (for example: Equinix, Cologix, Telehouse).
• Your bandwidth requirements consistently exceed 10Gbps or require a dedicated 100Gbps connectivity.
• You have regulatory,security,or compliance that prefers having a dedicated physical port.

Choose Virtual Interconnect if:

• Your bandwidth requirements are less than 10Gbps and you preference is to have a flexible bandwidth sizing (1Gbps to 10Gbps).
• Your application origins reside in public cloud providers (AWS, Azure, GCP) or remote enterprise facilities without a physical presence in the F5 PoP.
• You require rapid, software-driven circuit turn-up without waiting for physical fiber cross-connect cabling.

Deployment Topologies and Reference Architectures

This section describes the supported deployment models for F5 Distributed Cloud Private Interconnect. These reference architectures demonstrate how Private Interconnect securely connects users, applications, data centers, and cloud environments while leveraging F5 Regional Edge (RE) services.

Design Considerations

Consider the following best practices when designing a Private Interconnect deployment:

• Use dedicated private connectivity when regulatory, compliance, or security requirements prohibit public internet exposure.
• Deploy redundant interconnects to achieve high availability.
• Requires Border Gateway Protocol (BGP)-based routing for dynamic path management and resiliency.
• Standardize security policy enforcement at the Regional Edge across hybrid and multi-cloud environments.
• Use cloud-native connectivity services, such as AWS Direct Connect or Azure ExpressRoute, when connecting cloud-hosted origins.

Deployment Model 1: Internet to Customer Data Center via Private Interconnect

Internet traffic is received by the F5 Regional Edge, where security services such as Web Application Firewall (WAF), Distributed Denial-of-Service (DDoS) protection, API security, and Bot Defense are applied. Clean traffic is forwarded through Private Interconnect to application origins hosted in a customer data center or colocation facility. This deployment model is the most common architecture for protecting application origins.

Deployment Model 2: Internet to Public Cloud via Private Interconnect

This deployment model extends the previous architecture to cloud-hosted application origins in AWS, Microsoft Azure, or Google Cloud. Customers establish private cloud connectivity by using services such as AWS Direct Connect or Azure ExpressRoute and connect through an approved interconnect partner to reach the F5 infrastructure.

Deployment Model 3: Private Enterprise Network to Application Origin

Enterprise users, branch offices, or on-premises systems connect to the F5 backbone through Private Interconnect. Traffic is processed by Regional Edge services and delivered to application origins through either:

• A second Private Interconnect connection for an end-to-end private path.
• Internet-based origin connectivity.

Deployment Model 4: Cloud-to-Cloud Connectivity

Private Interconnect provides a secure transit backbone between workloads deployed across multiple cloud providers. Traffic flows through the F5 Regional Edge, enabling centralized security policy enforcement, secure service-to-service communication, and application connectivity across cloud environments.

Deployment Model 5: Routed DDoS Protection for Data Center Origins

Internet traffic is redirected to the F5 DDoS mitigation infrastructure, where attacks are mitigated before clean traffic is delivered to customer data center environments through Private Interconnect. Optionally, Generic Routing Encapsulation (GRE) tunnels can be configured as backup connectivity.

Availability by Region

Private Interconnect availability varies by F5 Regional Edge(RE) location and connectivity partner. Refer to the following table for the currently supported regions.

Note: Availability is not guaranteed and subject to change.

F5 POP - Private Interconnect Availability- North America and South America Region

POP Metro	Provider	Location	Equinix Fabric	Cologix Exchange	Megaport	Console Connect	Packet Fabric
Ashburn	Equinix	DC11	Yes	No	No	No	Yes
New York	Equinix	NY2	Yes	No	Yes	No	Yes
Atlanta	Equinix	AT1	Yes	No	No	No	Yes
Miami	Equinix	MI1	Yes	No	No	No	No
Chicago	Equinix	CH2	Yes	No	Yes	No	Yes
Dallas	Cologix	DAL3	Yes	Yes	Yes	Yes	Yes
San Jose	Equinix	SV10	Yes	No	Yes	No	Yes
Seattle	Equinix	SE3	Yes	No	Yes	No	Yes
Toronto	Equinix	TR2	No	No	Yes	No	Yes
Montreal	Cologix	MTL7	No	Yes	No	No	No
Mexico City	TBD	TBD	TBD	TBD	TBD	TBD	TBD

POP Metro	Provider	Location	Equinix Fabric	Cologix Exchange	Megaport	Console Connect	Packet Fabric
Sao Paulo	Equinix	SP4	Yes	No	No	No	No

F5 POP - Private Interconnect Availability- EMEA Region

POP Metro	Provider	Location	Equinix Fabric	Cologix Exchange	Megaport	Console Connect	Packet Fabric
London	Equinix	LD6	Yes	No	Yes	Yes	No
Paris	Equinix	PA2	Yes	No	Yes	No	Yes
Paris	Equinix	PA4	Yes	No	No	No	No
Paris	Telehouse	TH2	No	No	No	No	No
Milan	Equinix	ML5	Yes	No	No	No	No
Lisbon	Equinix	LS1	Yes	No	No	No	No
Madrid	Equinix	MD2	Yes	No	No	No	No
Amsterdam	Interxion	AMS9	No	No	No	Yes	No
Stockholm	Interxion	STO6	No	No	No	No	No
Frankfurt	Equinix	FR4	Yes	No	No	Yes	No
Tel Aviv	Tamares	SDS3	No	No	No	No	No
Dubai	Equinix	DX1	Yes	No	No	Yes	No

F5 POP - Private Interconnect Availability- APAC Region

POP Metro	Provider	Location	Equinix Fabric	Cologix Exchange	Megaport	Console Connect	Packet Fabric
Mumbai	Equinix	MB2	No	No	No	No	No
Chennai	Sify Tech	CHE	No	No	No	No	No
Singapore	Equinix	SG3	Yes	No	Yes	Yes	No
Jakarta	Neutra	JK1	No	No	No	No	No
Hong Kong	Equinix	HK2	No	No	Yes	Yes	No
Seoul	KINX	SEL1	No	No	No	Yes	No
Osaka	Equinix	OS1	No	No	No	Yes	No
Tokyo	Equinix	TY8	Yes	No	No	Yes	No
Melbourne	Equinix	ME1	No	No	No	No	Yes
Sydney	Equinix	SY5	No	No	Yes	No	Yes

---