Here is the situation every video product in Vietnam eventually meets: your monitoring is green, your CDN dashboard is green, and half your users on one ISP are staring at a spinner. Nothing is "down" in the usual sense. The route between that ISP and your CDN's edge has simply degraded — and with a single CDN, you have no move to make. This is the flagship reliability problem we solve for clients serving video to Vietnamese audiences, and it needs an architecture, not a support ticket.
Three failure modes unique to serving Vietnam
1. Undersea cable cuts
Vietnam's international bandwidth rides a small number of undersea cables, and incidents on routes like AAG and APG are a recurring fact of life — sometimes several per year, with repairs taking weeks. When a cable is cut, routes to foreign CDN edges degrade: latency spikes, throughput collapses in the evening, and video is the first thing users notice. Domestic traffic keeps flowing; it is the international hop that suffers.
2. Per-ISP throttling and misrouting
The big access networks — VNPT, Viettel, FPT — each maintain their own peering arrangements. In practice, individual ISPs intermittently throttle or misroute specific CDN IP ranges, unpredictably and without announcement. Your video can be perfect on Viettel mobile and unwatchable on FPT fibre in the same city, on the same afternoon. No single-vendor status page will ever show you this.
3. Collateral damage from national-level blocks
Occasionally, blocks aimed at some other service take down shared infrastructure — an IP range or shared certificate endpoint — and innocent domains hosted behind the same ranges go dark for Vietnamese users. You did nothing wrong; you are simply standing next to the target.
The architecture: dual-CDN with player-level failover
- Two CDNs, minimum. Pick two providers with genuinely different network footprints — for example Cloudflare plus Bunny — so a route problem to one is unlikely to correlate with the other.
- A regional origin. Keep the origin (or an origin shield) close to Southeast Asia so that cache misses do not cross a damaged cable twice.
- HLS manifests with multiple base URLs. Structure your packaging so every rendition and segment is reachable under both CDN hostnames. The manifest — or the player configuration — carries both bases.
- Failover in the player, not in DNS. The player retries a stalled or failed segment from CDN B the moment CDN A misbehaves — a mid-playback switch the viewer experiences as, at worst, one skipped buffer. This is the heart of the design.
- Health probes from real ISP vantage points. Synthetic checks from a datacentre tell you nothing about VNPT residential routing. Probe segment downloads from vantage points on each major ISP, and feed the results into which CDN the player prefers by default.
- Signed URLs on both CDNs. If your content is protected, token authentication must be configured — and tested — on both CDNs with the same expiry semantics, or your failover path will serve 403s at the worst possible moment.
Operational traps
| Trap | Consequence | Mitigation |
|---|---|---|
| Cold secondary CDN | Failover dumps traffic onto an empty cache; origin saturates; the "rescue" is worse than the outage | Send a steady share of real traffic (even 10–20%) to CDN B so its cache stays warm |
| Divergent cost models | Per-GB pricing tiers differ between providers; a long failover event lands on the expensive tier | Model egress cost per CDN and alert when the traffic split drifts |
| Testing at 10 a.m. | Everything passes; peak-hour users still suffer | Test during peak evening hours — that is when domestic peering congests and the real behaviour shows |
| Signed-URL drift | Token config updated on one CDN only; failover serves errors | Treat CDN config as code, deployed to both providers from one source |
What this looks like in production
A well-built setup fails over silently dozens of times a week and nobody files a ticket. Your dashboard shows the split shifting toward one CDN on a given ISP for a few hours, then drifting back. During a genuine cable incident the system leans hard on whichever provider has the healthier route — and your videos keep playing while single-CDN competitors' comment sections fill with "video không xem được".
If video is part of your commerce stack — product demos, livestream replays, ad creatives from an AI video pipeline — this reliability layer is what makes the rest worth building. It is also why the end-to-end automation architecture lists redundancy as non-negotiable for anything involving video, and why your auto-posting pipeline should never assume a hosted asset is reachable just because it uploaded successfully.