Hardware-Free Managed Network
Build your network out of virtual routers and firewalls rather than physical appliances. We deploy RouterOS, VyOS, FortiGate, or Zscaler VSE as virtual instances wherever your traffic needs them — inside a cloud region, in a colocation cage, at an office edge — then interconnect them into one routed, policy-controlled network over our multi-carrier DIA and Private Connect underlay. No hardware procurement, no customs, no local IT team. Configuration, policy, OS updates, and 24/7 monitoring are handled for you, and you keep administrative access and full visibility.
Key benefits
- Zero hardware: we deploy virtual appliances only — no shipping, customs, or physical installation
- Fully managed: configuration, policy updates, OS patching, and 24/7 monitoring — all handled by our team
- Your choice of platform: FortiGate, VyOS, RouterOS, Zscaler VSE, or bring your own image
- Multi-carrier underlay: DIA for internet, Private Connect for private backhaul — best carrier for each
- Complete visibility retained — administrative access, monitoring dashboards, and regular reporting
- One routed topology across every site, cloud region, and office — not a set of unrelated point links
Who it's for
Enterprises that need a fully operational China network but don't want to build or manage it themselves. Companies extending global SD-WAN into China, deploying Zero Trust access, or replacing legacy MPLS with managed virtual infrastructure.
Our approach
We design your China network topology based on traffic patterns and security requirements, then deploy Virtual Edge appliances at strategic locations connected via DIA (for internet-facing workloads) and Private Connect (for private backhaul). Initial configuration is handled by our engineering team. Ongoing management includes policy updates, OS patching, performance monitoring, and 24/7 incident response.
Architecture overview
How it works
- 1
Deploy virtual edge appliances
We deploy a managed virtual router or firewall at the locations your topology needs, using RouterOS, VyOS, FortiGate, Zscaler VSE, or a compatible image.
- 2
Connect China branches to international headquarters
The CIH backbone provides managed cross-border connectivity between your China branches, international headquarters, data centers, and cloud environments. We select an access method for each site, such as site-to-site IPsec VPN or Private Connect, and configure routing and security policies across the network.
- 3
Managed operations and visibility
CIH handles initial configuration, policy updates, software maintenance, and monitoring. You retain administrative access and visibility into your network.
Key products used
Virtual Edge
Your virtual appliance, our managed infrastructure — we deploy, configure, and support
View productNETWORKDedicated Internet Access
Premium dedicated internet — China and overseas, carrier-grade, uncontended, at pricing enterprises can't get directly
View productNETWORKPrivate Connect
Layer 2 P2P circuits at pricing enterprises can't get on their own — cross-city and cross-border
View productIs this your use case?
Talk to our architects about tailoring Hardware-Free Managed Network to your specific requirements.
Related solutions
Hybrid & Multi-Cloud Connectivity
Organizations running workloads in mainland China often need to connect China-based cloud environments — including AWS China Regions and Azure operated by 21Vianet — or China branches to public cloud regions overseas. These environments are operated separately, and cross-border connectivity requires a separately designed and provisioned path. We coordinate connectivity options for supported architectures, taking bandwidth, latency, route availability, workload design, and applicable requirements into account. Options range from managed 50 Mbps-1 Gbps virtual connections through partners such as Megaport and Equinix Fabric, among others, to dedicated 1-100 Gbps physical connections for data-heavy workloads.
Learn morePrivate Site-to-Site Connectivity
End-to-end private connectivity between your China sites and the rest of the world, built from two circuit types that work together: DPLC for the domestic point-to-point legs between Chinese cities, and IEPL or MPLS for the cross-border leg. Both are Layer 2, so your own routing runs across the whole path, and both are uncontended, so latency, jitter, and packet loss stay stable through the evening peak instead of degrading with the public internet. We source from China Telecom, China Unicom, China Mobile, and alternative operators, then choose the combination that fits your route, bandwidth, and budget — and we hold the carrier relationships, so you sign one contract and escalate through one path. The same point-to-point capability covers routes that never touch China — two overseas sites, or a data centre and an office outside the mainland — on the same Layer 2, uncontended terms.
Learn moreImprove Website Access in China
Help your international business deliver a better website experience for customers, employees, and partners in mainland China. We work with your team to assess current performance, prepare the service, and verify key pages and workflows after cutover. Designed for websites hosted outside mainland China, the solution keeps your existing hostname, origin, and primary storage in place and does not require an ICP filing.
Learn more