Home / Deployments
Deployment records

Four illustrative production deployments

Customers are not named. The engineering is.

DR 01NetOpsLive in production

National 5G transport network: design to activation

Planning to service activation as one automated workflow, from optical to IP.

Customer
Tier one mobile network operator, APAC
Delivery
Through a global systems integrator, selected in open competition
Scope
Optical L0/L1, operator specification L2, 5G backhaul, multivendor L3 IP
L0 to L3Optical, L2, backhaul and IP routing on one platform
1Tracked workflow from planning to service opening
LiveIn production on a national 5G network
0Per layer tooling silos
Engineering detail
The challenge

Service activation too slow for the 5G portfolio

The route from service application to service opening ran through planning, design, construction, configuration and test as a chain of manual handoffs.

Rising workload, shrinking expertise

Parallel 3G, 4G and 5G operation multiplied managed entities while the engineers who held the build knowledge were leaving.

A deeply heterogeneous estate

Multivendor IP routers, operator specification L2 switching, WDM and ROADM optics. No single equipment vendor's tooling could span it.

Carrier grade reliability, no development cycles

Automation had to raise throughput without weakening reliability, and absorb new device types and business rules through configuration.

Layer by layer
Process
BPM
Each rollout is tracked from registration through physical design, logical design, configuration input, test and opening, with planned and actual dates held against every step.
Workflows
Technical process
Design driven provisioning: a finalised design issues an order that passes its parameters straight into provisioning. Partial completion, rollback and idempotent execution are built in.
Configuration objects
Vendor abstraction
A device library models switches, cards, slots, ports and compatibility rules. A time series inventory lets several projects design against the same rack or port without conflict.
Adapters
NBI · SBI
Southbound direct to network elements or through element managers and SDN controllers over CLI, NETCONF, REST and SNMP. REST northbound to the end to end service orchestrator.
What the platform delivers
  • Reconciliation against the live network. Where configuration changed outside the system, the device is read back and compared with the design record, and the divergence is surfaced rather than overwritten.
  • Vendor abstraction as a design goal. New equipment is onboarded by extending the device library, not by rewriting automation logic.
  • Change absorbed without a development cycle. New commands, branches, tasks and device types are introduced through the GUI. This was the requirement pressed hardest, because it decides cost of ownership.
Full brief under NDA. Request the DR 01 brief
DR 02CloudOpsLive in production

National telco cloud: ETSI MANO and service orchestration

A vendor neutral ETSI MANO telco cloud across two national data centres.

Customer
National connectivity and digital infrastructure provider, APAC
Delivery
Through a regional systems integrator, selected in competitive tender
Scope
NFV infrastructure, VNF and CNF lifecycle, service orchestration, two national data centres
80%Reduction in network function capex
2Geo redundant national data centres
VM + CNFVirtual and containerised functions, one lifecycle
LiveCarrying national systems in production
Engineering detail
The challenge

No path to virtualisation

Equipment and network functions came from many suppliers on proprietary hardware. Orchestration could not lock the operator into one vendor.

Spares tied to proprietary hardware

Vendor specific spares were bought and warehoused purely to meet SLAs. Virtualising onto commercial hardware only works with a genuinely neutral orchestration layer.

Time to market held back by vendor permutations

Each region carried a different mix of equipment, so every service launch had to be provisioned across every permutation by hand.

Carrier grade resilience with tenants arriving

Cloud native, highly available and geo redundant across two data centres while voice, IPTV, SDN and 5G core systems were onboarded.

Layer by layer
Process
BPM
Tenant onboarding as a repeatable process: national systems including next generation voice, IPTV, an in house SDN controller and 5G core were absorbed through configuration.
Workflows
Technical process
NFVO and VNFM functions across multiple VIMs, interworking with specialised VNF managers. Thresholds trigger closed loop workflows that reach into OSS and BSS.
Configuration objects
Vendor abstraction
One configuration change model covers VNFs, CNFs and physical functions: the data centre fabric, compute, storage and the security functions running on top.
Adapters
NBI · SBI
OpenStack and Kubernetes VIMs, the Juniper Contrail SDN controller and Juju. SNMP, syslog and telemetry collection. REST northbound with OAuth 2.0 and LDAP.
What the platform delivers
  • Full ETSI MANO lifecycle. NFVO and VNFM in one platform, covering compliant and non compliant network functions, VM based and containerised.
  • One pane of glass with closed loops. Every physical and virtual component reports into one system with dynamic MIB parsing, alarm grouping and user configurable thresholds that trigger workflows.
  • Extended in live service. CNF support, ETSI SOL001 VNF indicators, service function chaining and cross data centre resilience were added as successive work packages.
Full brief under NDA. Request the DR 02 brief
DR 03NetOpsLive in production

Multi site data centre fabric orchestration

Two data centres on different fabric models, run as one network.

Customer
Private cloud operator serving a global enterprise group, APAC
Delivery
Direct, built jointly with the customer's own engineers
Scope
VXLAN EVPN fabrics and data centre interconnect across two sites
2Data centres, ACI and classic Nexus, one window
3Delivery phases, extended in live service
ChosenOver the incumbent vendor's own multi site options
OwnedWorkflow library built partly by the customer's engineers
Where the vendor controller stops and MSActivator takes overTwo data centres, one on Cisco ACI and one on a classic Nexus fabric. In each site the vendor controller manages top of rack, leaf, spine and border leaf. MSActivator manages the custom interconnect switches and core routers in both sites through one operations flow, linked by the data centre interconnect.MSActivatorfabric order · pools · topologySITE A · CISCO ACIMANAGED BY MSACTIVATORMANAGED BY VENDOR CONTROLLERCore routersInterconnectBorder leafSpineLeafTop of rackSITE B · CLASSIC NEXUSMANAGED BY MSACTIVATORMANAGED BY VENDOR CONTROLLERCore routersInterconnectBorder leafSpineLeafTop of rackDCI
Engineering detail
The challenge

A topology the standard tooling would not accept

An extra layer of VXLAN switches between border leaf and core acts as the interconnect, with custom CLI configuration the vendor controller could not manage.

Two sites, two fabric models

One site runs Cisco ACI, the other a classic Cisco Nexus fabric. The vendor's own multi site options could not span both.

Isolated infrastructure on demand

Servers and storage on one leaf and spine fabric had to be split into per service pools, each with its own VRFs, VNIs, VLANs and addressing.

Room for new vendors and in house engineers

Arista was arriving alongside Cisco, and the operator wanted its own developers to build and change workflows.

Layer by layer
Process
BPM
Fabric order: a new isolated infrastructure pool is requested as an order. Subtenant, workflows and settings are created, resources reserved and configuration pushed in one tracked process.
Workflows
Technical process
Underlay and overlay processes are edited in the GUI by UBiqube and customer engineers alike. Constraints, read only fields and linked delete processes keep operators on safe paths.
Configuration objects
Vendor abstraction
Device configuration is sliced into reusable blocks. Central pools allocate ASNs, IP ranges, VNIs, VLANs and vPC IDs with uniqueness enforced at entry. An import parser reads existing configuration.
Adapters
NBI · SBI
Adapters absorb ACI, Nexus and Arista EOS differences over CLI, NETCONF, REST and SNMP. REST API and Python SDK northbound to the operator's infrastructure manager.
What the platform delivers
  • One operations flow across two different sites. The interconnect in both data centres is run through the same workflows, whether the fabric behind it is ACI or classic Nexus.
  • Resource pools that cannot collide. ASNs, subnets, VNIs, VLANs and vPC IDs are allocated and released from central pools as fabrics, tenants and services are created.
  • Topology read from the network itself. Physical, overlay and L3 views built from live SNMP, VLAN, VNI, VRF, BGP, OSPF and CDP state, including multiple links and flow direction.
Full brief under NDA. Request the DR 03 brief
DR 04SecurityLive in production

Managed firewall and WAF as a cloud service

Firewall, UTM and WAF sold as a cloud service across seven regions.

Customer
Managed security services provider for a national enterprise cloud platform, APAC
Delivery
Direct, delivered in phases with the service live throughout
Scope
Fortinet FortiGate and FortiWeb virtual appliances on OpenStack, seven regions
3,000+Firewall, UTM and WAF devices on one platform
1bn+Logs a day collected, reported and streamed to the SIEM
7Regions, one operating model, one customer portal
210Migration workflows in parallel, service live
Engineering detail
The challenge

Security ordered like cloud

Any tenant can order a firewall, UTM or WAF from the cloud portal, in any of seven regions, at any time. Provisioning by hand in a vendor console could not keep pace or be billed as a service.

A vendor console is not a customer portal

Customers manage their own policy, NAT, VPNs, WAF profiles and certificates in the provider's portal, with the provider deciding what is exposed, read only or hidden.

Logs are part of the service

Over a billion security, traffic and system logs a day are collected, retained to policy, turned into incident reports and streamed to the SIEM.

Lifecycle without downtime

Thousands of live tenant devices move to new operating system releases and a new platform generation, region by region, keeping names, references and history.

Layer by layer
Process
BPM
A portal order onboards the tenant in its region and delivers a provisioned, licensed and monitored device. Change, HA and migration follow the same governed path.
Workflows
Technical process
Provisioning, port and HA cluster management, firmware delivery, bulk settings, OS upgrade and migration run as workflows from the portal, the API or by operators.
Configuration objects
Vendor abstraction
FortiGate policy, address, NAT, service, IPsec VPN and security profiles, and FortiWeb server policy, protection profiles and certificates, modelled once and exposed selectively.
Adapters
NBI · SBI
CLI and REST to every device and OpenStack APIs in each region. REST northbound to the cloud portal and order system, Kafka streaming to the SIEM.
What the platform delivers
  • Zero touch service in. A portal order creates the virtual appliance, installs certificates, SNMP, syslog and licence, and places the device live in the customer's portal.
  • Governed self service change. The platform generates, validates and pushes each customer change, shows exactly what was sent, and locks against conflicting edits.
  • Migration as a scheduled event. One workflow moves a device to the current generation and operating system, 15 in parallel per region and up to 210 across the estate.
Full brief under NDA. Request the DR 04 brief
Proven on the failure path

What a tier one proof of concept tested

Partial failure

Orders complete where they can

Rollback

Reverse a completed change

Idempotency

Run it twice, get one result

Reconciliation

Design versus running state

Mixed control planes

One workflow, any interface