Parinita  /  Products  /  Parinita Per-Tier POP Architecture
Foundation Layer

Parinita Per-Tier POP Architecture

The Physical Blueprint Every Parinita POP Follows — 101 Sites, One Image

Four standardized tiers. Same switches, same firewalls, same NICs. One playbook across every site.

Per-Tier POP Architecture is the standardized T1-T4 design that every Parinita POP follows. Same Cisco 8000 BGP edge, same Arista Fabric 2 east-west, same PA-5580/5560 firewalls, same ConnectX-7 NICs — so software above the network plane never has to care which tier it's on.

101
Sites Worldwide
4
Standardized Tiers
367
Firewalls Deployed
1
Image, 101 Sites
Request a Demo → Explore Capabilities
01 / The Problem

Per-Site Customization Creates Drift and Operational Risk

When every POP has custom network config, software above it must handle a different substrate at each location.

Custom per-site network configurations mean OS images, Kubernetes profiles, and security policies must all account for site-specific behavior — multiplying complexity with every new POP.

  • Per-Site Customization Creates Drift

    When every POP has custom network config, OS images and security policies must account for per-site behavior — complexity multiplies with every new location.

  • Inconsistent NICs Break eBPF/XDP Enforcement

    Crucible's per-packet identity enforcement depends on ConnectX-7 ASICs at every node. Non-standard NICs break the enforcement model platform-wide.

  • No Standard Tier Model Means No Predictable Capacity

    Without standardized uplink tiers, capacity planning for new POPs becomes a custom engineering exercise rather than a parameterized tier selection.

Capability
Current / legacy
What's needed
Network configuration
Per-site custom config — 101 independent designs to maintain
Four tier templates — one image, one playbook, 101 sites
Firewall management
Per-site firewall policies — inconsistent controls across locations
Panorama M-700 manages all 367 PA-5580/5560 firewalls centrally
NIC consistency
Mixed NIC vendors break eBPF/XDP enforcement across the fleet
ConnectX-7 at every node — line-rate crypto offload and Crucible enforcement
Fabric management
Separate management planes for each site's switches
Arista CloudVision and Cisco Crosswork manage the full 101-site fabric from one control plane
Upgrade cadence
Per-site upgrade windows — high coordination overhead and drift risk
Opera coordinates one synchronized rollout across all tiers simultaneously
Capacity planning
Custom engineering exercise per new site — no repeatable template
Tier selection from four parameterized templates — seat count and bandwidth requirement determine tier
02 / Architecture Tiers

Four tiers. One image. One playbook.

The T1-T4 tier model standardizes scale while keeping the architecture identical — the same management plane, the same fabric controller, the same NICs at every site.

Instrument, Maestro, Crucible, and Orchestra all assume one network substrate. The Per-Tier Architecture is what makes that assumption valid across 101 sites.

  • T1 — Flagship POPs

    32 sites, 129K seats per site, 400G uplinks, Active/Active PA-5580 HA firewall pair. The highest-capacity tier.

  • T2 — Regional POPs

    29 sites, 79K seats per site, 300G uplinks, Active/Active PA-5580 HA. Full capability set at regional scale.

  • T3 — Secondary POPs

    19 sites, 55K seats per site, 200G uplinks, Active/Passive PA-5560. Same management plane and fabric controller as T1.

  • T4 — Edge POPs

    21 sites, 54K seats per site, 100G uplinks, Active/Passive PA-5560. Lean footprint, identical software substrate.

  • Cisco 8000 BGP Edge

    Every POP fronts the public internet through Cisco 8000 routers speaking standard BGP — the only place BGP runs inside Parinita's infrastructure.

  • Arista Fabric 2 East-West

    Lossless RoCEv2/DCQCN across the entire POP fabric for GPU-to-GPU and storage traffic. Same Arista CloudVision management at every site.

  • 367 Palo Alto Firewalls

    PA-5580/5560 across 101 POPs. Panorama M-700 manages all 367 centrally. NGFW, IPS, SSL inspection, DNS security, and Wildfire sandbox at every site.

  • ConnectX-7 at Every Node

    Same NIC at every node on every plane — line-rate hardware crypto offload, eBPF/XDP for Crucible enforcement, RoCEv2 for storage and GPU traffic.

  • Cisco Crosswork + Arista CloudVision

    Centralized management planes for North-South and East-West fabrics. noBGP signals both via API for identity-aware path enforcement.

03 / Architecture

The Plane Model

Orchestra introduces "planes" — logical groupings of hardware optimized for a specific workload class. Unlike Kubernetes node pools, planes represent fundamentally different hardware architectures with different drivers, network requirements, and scheduling semantics.

The plane model is what makes Orchestra different from every other orchestration tool. Kubernetes sees nodes. Orchestra sees purpose-built hardware tiers and routes workloads accordingly.

P1
Reasoning Cortex
AMD Instinct MI350P
Primary AI inference · LLM serving
1,450+ nodes · 288GB HBM3e · high-bandwidth accelerator
P2
Training & Generation
NVIDIA RTX PRO 6000 Blackwell
Training · TTS · creative compute
950+ nodes · 96GB GDDR7
P3
Chain & CPU Compute
AMD EPYC Turin 9005
Chrysalis validators · CPU inference
700+ nodes · Zen 5c
P4
Knowledge & Retrieval
Intel Sierra Forest
Almanac vector search · RAG anchor
1,250+ nodes · 144 E-cores
P5
Long-Term Memory
NVMe Storage
Enclave · Stratum immutable object
850+ nodes · ransomware-resistant
P6
Media & Acceleration
RTX 4500 BSE · Alveo MA35D
Four tiers · GPU + FPGA + CPU
2,150+ nodes · 4K/8K hardware acceleration
P7
Edge Reflex
Qualcomm Cloud AI 100 Ultra
Ultra-low-latency edge inference
2,000+ nodes · sub-10ms response
P8
Coordination Layer
AmpereOne A128
Orchestra · Chorus routing · agents
2,400+ nodes · 128 ARM cores
P9
Nervous System
Cisco 8000 · Palo Alto · Arista
Routing · firewall · dual fabric
3,500+ devices · ConnectX-7 NICs
04 / Tier Selection Model

Four tiers, one set of rules.

POP tier is determined by capacity and uplink bandwidth — T1 (400G, 129K seats) through T4 (100G, 54K seats). All tiers use the same hardware vendors and management plane.

  1. 01
    Tier capacity
    Tier selected at site design time based on seat capacity and uplink bandwidth requirements.
  2. 02
    Uplink bandwidth
    T1: 400G, T2: 300G, T3: 200G, T4: 100G — uplink scales with tier while management plane stays identical.
  3. 03
    Firewall HA mode
    T1/T2: Active/Active PA-5580 HA pairs. T3/T4: Active/Passive PA-5560 for cost-appropriate resiliency.
  4. 04
    Fabric controller
    Same Arista CloudVision and Cisco Crosswork deployment at every tier — one management plane across all 101 sites.
  5. 05
    NIC standardization
    ConnectX-7 at every node across all tiers — required for Crucible eBPF/XDP identity enforcement platform-wide.
  6. 06
    Geographic coverage
    T1 POPs anchor major metros; T4 POPs extend coverage to secondary markets — all on the same architecture.
  7. 07
    Software compatibility
    Instrument, Maestro, Orchestra, and Crucible assume the Per-Tier substrate. No per-site software customization required.
  8. 08
    Upgrade path
    Opera coordinates OS, cluster, control-plane, and network-OS upgrades as one synchronized operation across all tiers.
python 
# Per-Tier POP Architecture Reference
# T1: 32 POPs | 400G | 129K seats | Active/Active PA-5580
# T2: 29 POPs | 300G |  79K seats | Active/Active PA-5580
# T3: 19 POPs | 200G |  55K seats | Active/Passive PA-5560
# T4: 21 POPs | 100G |  54K seats | Active/Passive PA-5560
#
# All tiers:
#   Edge:    Cisco 8000 (BGP to internet only)
#   Fabric2: Arista (lossless RoCEv2 east-west)
#   NICs:    ConnectX-7 (eBPF/XDP, RoCEv2, hardware crypto)
#   Mgmt:    Cisco Crosswork + Arista CloudVision + Panorama M-700
05 / Proof

Proven at scale. Not in a lab.

Parinita AI Edge is the production deployment of the Parinita platform and the largest heterogeneous AI infrastructure deployment in the United States.

Reference Deployment

Parinita AI Edge

The most complex heterogeneous AI infrastructure in the United States. 101 sites, 9 planes, 12,000+ nodes, 4 accelerator vendors, dual network fabrics, four-layer tenant isolation — all through a single sovereign control plane.

101
Points of Presence
4 tiers: T1 (32), T2 (29), T3 (19), T4 (21)
909+
K8s Clusters
101 sites x 9+ plane types
12K+
Compute Nodes
Supermicro, Dell, Ampere, Cachengo
4
Accelerator Vendors
Intel Habana, NVIDIA, AMD, Qualcomm

Network & Security Infrastructure

2,491+
Cisco Switches
+ 303 routers (EVPN-VXLAN)
1,734+
Arista Switches
Lossless GPU backend fabric
367+
Palo Alto Firewalls
PA-5580/PA-5560 series
152+
Petabytes Storage
NVMe over RDMA
  • Multi-vendor accelerators
    Four accelerator vendors — Intel Habana, NVIDIA, AMD, Qualcomm — orchestrated through one control plane with unified scheduling, monitoring, and lifecycle management.
  • Dual-fabric networking
    Cisco production fabric and Arista GPU backend fabric operating as a coordinated system, bridged by identity-aware routing.
  • Nationwide scale
    101 sites across 42 U.S. states, each operating autonomously with a local control agent and a sovereign cross-site routing plane.
  • Multi-tenant isolation
    Four-layer defense-in-depth: VXLAN VNIs, identity-routing, Palo Alto firewalls, and Cilium eBPF — validated across every plane and site.
  • Compliance readiness
    FIPS 140-2 at launch, with FedRAMP Moderate, CJIS, and IL4/IL5 certification paths active through Parinita compliance profiles.
  • Sub-millisecond routing
    Every request classified and dispatched in under 1ms, enabling real-time SLA enforcement without perceptible overhead.
06 / Use Cases

The substrate every other Parinita product runs on.

Per-Tier POP Architecture is not a product you provision — it is the physical layer that makes the software stack deterministic across all 101 POPs.

Understanding the Per-Tier Architecture is essential for operators building on or extending the Parinita platform at any site.

  • New POP Deployments

    Select a tier based on capacity, apply the template, and the software stack above it works without per-site configuration.

  • Multi-Site Operators

    One supported network substrate means one maintenance cadence, one management plane, and no site-specific incident investigation.

  • Software Development on Parinita

    Products built on the Parinita platform assume the Per-Tier substrate — developers do not need to account for network heterogeneity across sites.

  • Compliance and Audit

    Standardized topology means security controls apply consistently at every site — auditors review one architecture, not 101.

  • Capacity Planning

    Four parameterized tiers convert site capacity planning from a custom engineering exercise to a parameterized tier selection decision.

07 / Getting Started

How It Applies

Every Parinita POP is deployed against one of the four tier templates. Tier selection happens at site design time based on capacity requirements.

T1 Flagship Deployment
Highest Capacity

32 POPs — 400G uplinks, Active/Active PA-5580, 129K seats. Anchors major metro markets.

T2/T3 Regional Deployment
Regional Coverage

48 POPs combined — 200G-300G uplinks, Active/Active or Active/Passive firewalls. Full capability at regional scale.

T4 Edge Deployment
Widest Reach

21 POPs — 100G uplinks, Active/Passive PA-5560. Lean footprint, identical software substrate and management plane.

08 / Get Started

Talk to Us

Our infrastructure team can walk through the Per-Tier Architecture and how it applies to your deployment or co-location requirements.

09 / Related

More from the fabric.

Products that compose with this one. Every Parinita product runs on the same 9-Plane Architecture across 101 edge POPs.