Connect the studios. Keep security in the path.
Routing, load sharing and network security across ALT VFX’s studios, data centres and AWS connections.
ALT VFXThe constraint
Artists, remote workstations, transfer services and cloud workloads depended on different paths through the same network. Changing a connection could also change a public address, a NAT rule or the return path through a security control. The uplift had to account for those dependencies while improving the use of available capacity.
Our work
Quokka joined ALT VFX’s studio, data-centre and cloud connections through a coordinated routing and security design. The work put available capacity to use, preserved the return paths required by application inspection, and carried production services through changes to providers, public addresses and edge infrastructure.
What changed
Use the paths according to the service
Coordinate BGP routing across the studios and both data centres. Share load across both data centres, with service-specific route preferences for AWS and internet access.
Keep routing and security aligned
Connect route selection with Palo Alto edge inspection, NAT and published services. Add private AWS connectivity with explicit route filters and access to the internal services that cloud workloads require.
Migrate the services behind the links
Stage public-address, DNS, NAT and policy changes around production services. Validate remote workspaces, transfers and application dependencies before retiring the superseded connections.
The result
The completed uplift put dynamic routing, load sharing and consistent edge security into operation. Quokka consolidated internet and cloud egress and retired superseded services. Subsequent private AWS connectivity extended the design with filtered route exchange and defined access between cloud workloads and internal services.
Network design, migration and delivery by Quokka Advisory for ALT VFX.
The engineering decisions.
The work spans provider connectivity, BGP, Palo Alto security controls and the application changes needed for a live migration.
Put available capacity to work
The edge design uses Cisco Nexus cores and Palo Alto Networks appliances with Megaport, Superloop and AWS connections. BGP local preference, path prepending and route communities control how services use those paths. Load sharing applies where the service permits it; other traffic has a defined preferred route and fallback. The team can change a path without rebuilding the routing policy by hand.
Preserve the return path through inspection
Stateful inspection and NAT depend on both directions of a session reaching the appropriate edge. Quokka aligned route advertisements, outbound preferences and service publishing so a path change remained compatible with those controls. The design also accounts for inter-data-centre connectivity and IPsec fallback, with route filtering to constrain what each peer can advertise.
Control what private AWS connectivity exposes
The later AWS as-built records a Megaport-hosted Direct Connect private interface connected through a Direct Connect Gateway and Virtual Private Gateway. The Palo Alto edge exchanges approved internal and VPC routes and rejects default routes in both directions. Separate security policies cover management access into AWS and cloud access to internal directory, DNS and time services.
Move public addresses and applications together
The migration plan covers new public address ranges and ASNs alongside DNS, NAT and firewall policy. It reduces DNS lifetimes before cutover, retains old and new paths where practical, and moves services in tracked groups. Checks cover Horizon sessions, web and API access, backend dependencies, external licensing services and partner allowlists.
Retire superseded services after validation
The team checked BGP peerings, route changes, session persistence and application reachability through the cutover. The closure report records service consolidation, automated routing and consistent edge policy, with legacy transit services decommissioned. The cost story comes from the complete connectivity footprint: using capacity well and removing overlap after migration.
More of our work
All project storiesAI-built applications. Enterprise-ready foundations.
Quokka designed and implemented Forge and its operating methods so ALT VFX could develop useful studio applications, with the complexity of running them handled through a shared foundation.
ALT VFXProduction workspaces built for demanding creative work.
Secure access to physical workstations and virtual desktops, with GPU acceleration planned around production workloads.
ALT VFXWhat needs to work better?
Talk to us about the environment, the constraint and the change.