DataCentersX > Facility Ops > WAN & Comms Ingress


DC WAN & Comms Ingress


WAN and comms ingress is the physical infrastructure through which external connectivity enters the data center. The category covers the buried fiber entrance from public right-of-way, the demarcation rooms where carrier circuits terminate, the meet-me rooms where customers cross-connect to carriers and to each other, the WAN edge routers that terminate operator-owned circuits, and the path diversity engineering that ensures no single physical event can sever all connectivity. WAN ingress is where the data center stops being an internal network and becomes part of the global internet.


The physical path

External connectivity enters the facility along a sequence of physical layers, each with operational and security implications.

Stage What it is Operational concern
Public right-of-way fiber Carrier-owned dark or lit fiber routed in public utility corridors to the property line Physical exposure to construction, weather, deliberate damage; route diversity from multiple directions
Property entrance vault Underground vault where carrier fiber transitions from public to private right-of-way Physical security; access logging; shared with multiple carriers
Building entrance facility (BEF) Hardened room where fiber enters the building structure Diversity from at least two physically separated BEFs for resilient designs
Demarcation room (demarc) Termination point where the carrier's responsibility ends and the operator's begins Cross-connect cabinet ownership; access policy splits between operator and carrier
Meet-me room (MMR) Neutral interconnection space where customers and carriers cross-connect Carrier neutrality; cross-connect provisioning; physical security at high tenant density
WAN edge / border routers Operator-owned routing infrastructure peering with carriers and internet exchanges BGP operation, DDoS mitigation, transit and peering economics

Path diversity

Resilient WAN ingress requires path diversity across multiple dimensions. Carrier diversity means circuits from at least two independent carriers, ideally with no shared upstream infrastructure. Path diversity means physical fiber routes that do not share trenches, conduits, or BEFs - so that a single backhoe, water main break, or fiber cut cannot sever all connectivity. Geographic diversity at the regional level handles broader events (storms, earthquakes). High-availability data centers typically engineer for at least two BEFs at opposite sides of the building, served by physically separated carrier conduits, with circuits from a minimum of three independent carriers.


Meet-me rooms

The meet-me room is where the data center's commercial value as an interconnection facility lives. In a carrier-neutral colocation facility, the MMR is the room where any customer can cross-connect to any carrier or to any other customer with a copper or fiber jumper. The MMR's interconnection density is the primary driver of facility value in retail colocation - Equinix's MMRs in IBX facilities like LA1, NY4, DC2, FR5, and TY2 are the most concentrated interconnection points in their regions and command pricing based on that density.

For hyperscaler-operated facilities, the MMR concept is replaced by the operator's own peering infrastructure - the operator typically wants direct relationships with major carriers and exchanges rather than mediating customer cross-connects. The economic logic differs but the physical infrastructure (cabling, patch panels, optical distribution frames) is similar.


Carrier hotels

A carrier hotel is a building (or set of buildings) where many carriers terminate their networks specifically to interconnect with each other and with content providers. Notable carrier hotels include 60 Hudson Street (NYC), 1 Wilshire (Los Angeles), Equinix LA1 (formerly Coresite Onepartner Drive), 350 Cermak (Chicago), 165 Halsey Street (Newark), 350 East Cermak (Chicago), Telehouse North (London), Interxion AMS-5 (Amsterdam), Equinix TY2 (Tokyo). Carrier hotels concentrate optical and IP transit interconnection at a level no single-tenant facility can match, which is why retail colocation in carrier-hotel buildings commands premium pricing despite often having older facility infrastructure than purpose-built modern data centers.


Internet exchanges

Internet exchange points (IXPs) sit physically inside major carrier hotels and meet-me rooms. The exchange is a layer-2 fabric that allows participants to peer with each other directly without paying for transit. Major IXPs and their primary host facilities include:

Exchange Region Primary host facilities
DE-CIX Frankfurt (and global expansion) Interxion, Equinix, NTT, Digital Realty in Frankfurt; world's largest IXP by traffic
AMS-IX Amsterdam Equinix AM5/AM7, NIKHEF, Global Switch Amsterdam
LINX London Telehouse North/East, Equinix LD8, Interxion London, Digital Realty London
Equinix Internet Exchange (EIX) Global (multi-region) Equinix IBX facilities globally
JPNAP Tokyo Equinix TY2, NTT Otemachi facilities
SIX (Seattle Internet Exchange) Seattle Westin Building (Equinix SE2)
PAIX, NYIIX, MAE-East / MAE-West (legacy) US Various carrier hotels; partly absorbed into Equinix and Digital Realty exchange operations

WAN edge equipment

Equipment class Vendor examples Role
Border / WAN edge routers Cisco ASR/8000, Juniper MX/PTX, Arista 7800R, Nokia 7750 SR BGP peering with carriers and exchanges; DDoS mitigation entry point
Optical transport (DWDM) Ciena 6500/Waveserver, Infinera GX, Nokia 1830 PSS, Cisco NCS 1000 Long-haul wavelength transport between facilities and carrier networks
Optical distribution frames (ODF) Fibrain, Corning, CommScope, Panduit Fiber patching at MMR and demarc rooms; carrier-customer cross-connect physical layer
DDoS mitigation appliances Arbor Sightline / TMS, F5 Silverline, Cloudflare Magic Transit (cloud), Radware DefensePro Volumetric attack scrubbing; behavioral anomaly detection at WAN edge
Carrier-grade NAT (where applicable) Cisco, Juniper, A10 Networks IPv4 address conservation for managed-service customers

Subsea cable landings

For data centers near coastlines and submarine cable landing stations, the WAN ingress story extends to the cable landing facility itself. Cable landing stations (CLS) terminate transoceanic fiber and provide the first level of switching between subsea and terrestrial networks. Notable subsea hub regions include Marseille (multiple Mediterranean cables), Lisbon (Atlantic cables), Sydney (trans-Pacific cables), Singapore (intra-Asia and trans-Pacific), Virginia Beach (Atlantic), and the US-Pacific coast (Oregon, California). Hyperscalers have increasingly co-located AI training and content delivery facilities near major cable landings to minimize transit latency to global users. Marea (US-Spain), Dunant (US-France), Grace Hopper (US-UK-Spain), 2Africa (Africa circumnavigation), Echo (Singapore-California), and Bifrost (Singapore-California) are examples of cables built or co-funded by Meta, Microsoft, Google, and Amazon to control intercontinental capacity.


Hyperscale operator-owned WAN

The largest hyperscalers operate their own global backbones rather than relying on carrier transit for inter-data-center traffic. Google's B4 network, Meta's Express Backbone, Microsoft's WAN, and AWS's global backbone are operator-built and operator-operated long-haul networks connecting their data center fleet. The WAN ingress at these operator-owned facilities terminates these private backbones in addition to (or in some configurations instead of) public-internet peering. The operational discipline of running a global software-defined backbone at this scale is its own subdiscipline of network engineering and a core competitive advantage for the hyperscalers that have it.


Where this fits

WAN ingress hardware is operated under FACILITY OPS as a physical infrastructure system. The routing, peering, and traffic engineering are operated under Compute Ops as part of Network Operations. The cross-connect commercial relationships with carriers and customers are operated by the facility's revenue and account management teams. The cybersecurity at the WAN edge (DDoS, BGP hygiene, edge filtering) is operated under Security. Compliance evidence on physical interconnection (carrier contracts, cross-connect inventories) flows to GRC:Compliance.


Related coverage

Facility Ops | Compute Ops | Network Ops | Stack: Networking & Fabrics | Security | Physical Access | Life Safety | Colocation DCs