CDN & Edge Providers L4-L7
CDN & Edge — 3 vendors and operators, each broken down by layer L1 to L7: what they sell at that layer, and which layer is their home turf.
Cloudflare
Home turf: L3 / L7
L1 Physical
This layer is deliberately thin, because this domain owns almost nothing at the physical layer — not for want of material but as a consequence of its business model: it has no last mile, no spectrum, no subsea cable and no data centres of its own.
L2 Data Link
This layer is explicitly empty — no product or service. This domain doesn't build switches or manage VLANs — its servers sit inside other operators' facilities (see L1), the layer-2 network is the facility's or its upstream carrier's responsibility, and it has no layer-2 product of its own beyond the L1 physical access already covered.
L3 Network
This layer is where the domain really begins and where it differs most from everything before it. The core mechanism is anycast: one address announced simultaneously from hundreds of locations, so traffic lands wherever internet routing considers nearest.
L4 Transport
The domain thickens noticeably from this layer, and one thing deserves saying first: the 'no ADC' gap thread that has recurred across this site is filled for the first time by a non-cloud vendor in this, the thirteenth domain — it does provide load balancing and health checks (see the fifth item here), though what it fills is global load balancing rather tha…
L5 Session
This layer is far thicker than in the preceding infrastructure domains, and it fills a gap that recurs across this site: Megaport L5, Equinix L5 and AT&T L5 all state explicitly that they do not provide remote access or zero-trust access, whereas this domain has a genuine identity-aware access product (see the first item here) — what it connects is no longer…
L6 Presentation
This is the thickest L6 on the site, for a straightforward reason: the way this domain works is to terminate encryption in the middle, understand the content, and re-encode it for forwarding. Two sentences the preceding twelve domains repeat at L6 are therefore both broken here.
L7 Application
This is the thickest layer in the domain and also where it began — it started as a reverse proxy plus CDN, and everything since has been capability added at that one position, 'traffic already passes through here'.
Cross-layer: Management & Operations
The operational proposition here differs from all twelve preceding domains, and fits in four sentences. First, onboarding equals changing DNS: this is the only domain on the site where provisioning is itself a site-wide change — hand over resolution and the path of all your traffic changes — so lowering record time-to-live before cutover is the single most i…
Akamai
Home turf: L3 / L7
L1 Physical
Like this page's Cloudflare domain, this domain owns no last mile, spectrum, subsea cable or data centre of its own at the physical layer — but its footing at this layer is entirely different from Cloudflare's, and worth spelling out separately: it embeds a very large number of small deployments inside other people's networks — mainly carrier and ISP facilit…
L2 Data Link
This layer is explicitly empty — no product or service. This domain doesn't build switches or manage VLANs — its embedded nodes are deployed inside host networks (see L1), the layer-2 network is the host network's own responsibility, and it has no layer-2 product of its own beyond that.
L3 Network
This layer is where the domain really begins, and its core is something no other domain on this site has: a mapping system. As the previous layers explained, this domain has no products until layer 3, and the first question at layer 3 is how a user gets sent to an edge — its answer is DNS: a continuously recomputed mapping system decides which edge address t…
L4 Transport
This layer contains something very unusual for an edge platform: this domain has a product that runs inside your own data centres and clouds. The two conventional blocks first. Layer 4 attack mitigation covers how connection-based attacks, state exhaustion and reflection amplification are identified and dropped at the edge, along with false-positive risk (th…
L5 Session
This layer is the domain's second not-edge-like block after microsegmentation, and it is more of a system than that one. The core is zero trust application access: an identity-aware proxy in front of your applications, where a user proves identity first and then gains access to one application, rather than gaining a network first and looking for applications…
L6 Presentation
This layer has a clear dividing line on this site: almost every domain states that it is transparent to content and performs no transformation, and only two domains really process content in the middle — the other edge domain and this one. So this layer is not thin. Three blocks.
L7 Application
This is the company's founding business and still its most mature layer. Five blocks. Delivery and caching: the core here is not whether there is a CDN but how the cache key is composed, who decides cacheability and how the hit ratio gets raised — nearly every case of a CDN underperforming comes down to a cache key carrying dimensions it should not, rather t…
Cross-layer / Operations
This layer carries one constraint unique to this domain that directly shapes your release process: configuration releases take time to take effect. Configuration here is a rule tree, and after editing it an activation must run before it applies network-wide, with activation taking minutes to tens of minutes (per current documentation) — which means 'just cha…
Fastly
Home turf: L7 / OPS
L1 Physical
Like this page's Cloudflare and Akamai domains, this domain owns almost nothing at the physical layer — no last mile, no subsea cable, no data centres of its own; it's a customer of facilities and exchange points everywhere, not a supplier.
L2 Data Link
This layer is explicitly empty — no product or service. This domain doesn't build switches, doesn't manage VLANs, and has no standalone product aimed at the layer-2 network — consistent with this page's Cloudflare and Akamai domains, edge-network vendors generally have no substantive product at this layer; this is an industry-wide trait, not a gap unique to…
L3 Network
This layer is this domain's third answer to the recurring question of 'how to send a user to a given edge node' that comes up across this page's other two edge domains: like this page's Cloudflare domain, it uses anycast — the same IP address is announced simultaneously from every node, and internet routing itself decides which node a user actually lands on,…
L4 Transport
This layer's content is relatively thin, since this domain has no general-purpose proxy product for arbitrary TCP/UDP protocols the way this page's Cloudflare domain's Spectrum does — its core business is HTTP/HTTPS traffic, and its real layer-4 capability shows up mainly in two places: absorbing connection-level traffic spikes via the anycast network discus…
L5 Session
This layer needs to draw a boundary honestly first: unlike this page's Cloudflare domain's zero-trust access (Access) or this page's Akamai domain's enterprise application access product, this domain has no product line for enterprise remote access/zero-trust access — its core business is content delivery and edge compute, not replacing a VPN or providing id…
L6 Presentation
This layer's content is standard edge TLS termination and certificate management: TLS between the client and the edge is terminated at the edge node, and the edge-to-origin leg can have its encryption strength configured separately (the same rule this page's Cloudflare domain repeatedly emphasizes — that origin encryption mode must be set to strict verificat…
L7 Application
This is this domain's centre of gravity, and the place it originally established itself — two pieces of content, each corresponding to one of the two core differentiators named up top.
Cross-layer: Management & Operations
This layer needs to directly address the risk flagged ahead of time at L7: the same mechanism that lets a cache purge take effect near-instantly, network-wide, is also what lets a bad configuration change go wrong at the same speed, network-wide, all at once.