Microsoft & Ciena Deliver Zero-Downtime Optical Design

As metro optical networks become increasingly automated and software-defined, service providers face a growing operational risk: catastrophic failures triggered not by fibre cuts or equipment faults, but by automation errors, software misconfigurations and human mistakes that can disable entire ROADM domains simultaneously.

The whitepaper "Zero-Trust Optical Transport: A Tiered Architecture for Metro Network Resilience," co-developed by Ciena and Microsoft, addresses the challenge with a blueprint for metro networks that maintain full service continuity even when primary transport systems fail completely.

Architecture built for operational survivability

The design centres on two fully independent optical domains operating in parallel. The primary layer uses ROADM-based transport built on Ciena's 6500 or RLS platforms, providing flexible photonic routing for metro ring or mesh topologies.

Core sites deploy colorless-directionless-contentionless (CDC) ROADM nodes, while tail sites use simpler colourless direct attach (CDA) configurations.

The secondary layer – termed optical BCDR – operates as a completely autonomous system using Ciena's Waveserver platforms with CMD10 or CMD12 fixed-filter modules.

Such point-to-point architecture runs different software, resides in separate racks with independent power feeds and uses physically diverse fibre routes. The two domains share no optical elements, control planes, or management interfaces.

Both systems terminate into Layer 3 routers where standard EtherChannel bonding creates a single logical interface. 

The Ethernet-layer coupling enables automatic, hitless failover with no optical-level reconvergence required. 

From the client perspective, services remain on a unified port channel regardless of which underlying optical system carries the traffic.

Vinoth Elangovan, Senior Network Engineer at Microsoft, previously said: "We don't want even a second of downtime. We needed a life raft for when failures occur that could also function as a standby network for core site migrations or platform upgrades."

Active-active design for metro continuity

Unlike dormant backup paths, both optical domains actively deliver production services at bandwidth tiers including 10G, 100G and 400G. 

The active-active configuration provides load balancing during normal operations and maintains full capacity if either system experiences a systemic failure.

The architecture addresses real operational scenarios that disable ROADM networks: automation rollouts that accidentally zero out configurations, provisioning scripts that disable services across multiple nodes, failed software rollbacks, or misapplied policy changes. 

When such events occur, traffic continues uninterrupted on the optical BCDR layer while engineers restore the primary system without business impact.

Operational benefits for service providers

The tiered design delivers several practical advantages for metro operations. During site migrations, the optical BCDR layer sustains services while ROADM equipment is physically moved and reconfigured at new locations. 

Network expansion projects – adding new CDC or CDA nodes – can proceed through complex integration steps without affecting production traffic.

For planned maintenance windows, service providers can perform software upgrades, configuration changes, or patching on either domain while the other handles full workloads. It eliminates the need for customer-impacting maintenance notifications for many routine operational activities.

The architecture optimises for metro path characteristics. In symmetric designs where fibre distances are comparable, all paths run active-active with equal traffic distribution. For asymmetric topologies, the shortest ROADM path and optical BCDR remain active while longer paths stay passive, minimising latency while preserving seamless redundancy.

Target deployment scenarios

The whitepaper identifies high-value applications for service providers: metro DCI supporting AI infrastructure/hyperscale replication, campus/lab interconnects with high change frequency, financial/healthcare availability zones and enterprise backbones with strict SLA requirements.

Operators can selectively deploy this model for premium customers or critical geographies, adapting the configuration to match specific continuity requirements and existing footprint.

Infrastructure isolation as operational strategy

The paper reframes "zero trust" not as security posture but as infrastructure isolation – recognition that complex systems can be unintentionally taken offline and that true resilience requires architectural design, not just redundant hardware.

By coupling independent ROADM and CMD-based photonic layers only at the Ethernet edge, the architecture ensures no single operational failure can compromise service delivery. 

As a result, it shifts metro network design from reactive recovery to proactive survivability. Acknowledging that rare but high-impact operational events will occur and building continuity into the transport foundation.

For service providers delivering high-availability services the Microsoft-Ciena blueprint demonstrates how Ciena's 6500, RLS and Waveserver platforms can be architected to guarantee metro continuity during complete domain failures.