This article is an overview and implementation points of Tianyi Internet U.S. high-defense server migration guidelines, aimed at operations and security teams. The content covers DNS configuration and switching, security group rule mapping, backup and recovery strategies, migration testing and rollback, aiming to reduce migration risks and maintain business continuity.
Pre-migration assessment and preparation
Before migration, you should complete resource inventory, dependency services, traffic models, and SLA assessments, clearly specifying the IPs, domain names, databases, storage, and application components to migrate. Establish time windows, communication plans, and emergency contacts to assess the impact of high-defense features on traffic cleansing and connection sessions, ensuring migration windows overlap with business off-peak periods.
DNS strategy planning and record design
Key points in DNS planning include clearly identifying A/AAAA, CNAME, MX, TXT, and SRV records, ensuring the records align with the target server's IP mapping. Set TTL reasonably for quick switching, while retaining redundancy from old records for rollback. For services using CDN or global load balancing, the back-to-source configuration should be updated in sync.
DNS switching and propagation control
The switching process recommends lowering TTL to a lower value 48 hours before the switchover, updating records and monitoring resolution ratios in stages during the switchover. Using multi-region resolution tests, and after switching, continue to observe the resolution trajectory within the TTL cycle to ensure clients gradually migrate to the new IP, minimizing connection interruptions and caching impacts.
Security groups mapped to network rules
Security group rules should be checked against the original environment item by item, including port, protocol, source/destination IP, and priority. When connecting to Tianyi Interconnect high-defense nodes, it is necessary to consider mapping the front port of the node, the real backend port, and NAT to avoid service inaccessibility caused by port conflicts or missing whitelists.
Entryrules are being refined in high-security environments
In high-protection environments, management password access should be restricted, SSH/remote desktop should only allow internal network or specified jump board IPs, and port rate limiting and login auditing should be enabled. Configurable traffic thresholds, connection concurrency limits, and source geolocation policies for business ports in coordination with cleaning strategies to reduce false killings of legitimate traffic.
Outbound control and log auditing
During migration, outbound traffic must also be controlled, including external DNS, third-party API calls, and email services to prevent sensitive data leaks or outbound traffic triggering security policies. Enable network and audit logs to ensure traceability of connection links and security incidents after migration, facilitating problem identification.
Data backup and recovery strategies
Data backup should cover databases, file storage, configuration, and mirroring, using a combination of full volume + incremental or snapshot solutions, with clear backup retention periods and offsite backup requirements. Backups should be completed before migration and recovered with a recovery exercise to verify data consistency and integrity, ensuring that migration failures can be quickly rolled back.
Backup types, cycles, and validation
It is recommended to use at least three backup strategies: local snapshots, offsite cold standby, and real-time log backup (such as database binlog/replication). To prevent backup corruption, regular automated validation and recovery drills must be conducted, recording recovery time objectives (RTO) and data recovery point objectives (RPO).
Data transmission and consistency assurance
Data migration can adopt solutions such as segmented transmission, rsync increment, logical export, or master-slave replication. For databases, establish replication or use binary log incremental synchronization before migration. During the switch, ensure the last batch of transactions commits consistently to avoid data loss or multi-source write conflicts.
Switchover testing, rollback, and monitoring
Comprehensive testing should be conducted before switching, including connectivity, certification, performance, and security policy verification. Lower DNS TTL and first scale up in a small range, observing error rates and cleaning triggers. Establish rollback steps and pre-verify rollback paths, enabling monitoring alerts to cover traffic, response time, and error rates.
After migration, a period of parallel monitoring and gradual traffic release were conducted, with continuous adjustments to security groups and high-defense policies, ultimately restoring the original TTL and archiving migration records. It is recommended to keep the emergency recovery plan operable for at least one week.
Summary and suggestions
Migrating Tianyi Internet's high-defense servers in the US requires rigorous planning and rehearsal in DNS, network security groups, and backup policies. It is recommended to migrate in low-risk batches first, keep backups available and verify recovery paths, reduce TTL during migration windows, and enable detailed monitoring and logging to ensure business continuity and secure control.
