Multi-site corporate network

The challenge

A company operating from a head office, a warehouse and two branches typically ends up with four unrelated networks: a consumer router per site, one flat address range, the Wi-Fi password written on a wall, and no way to tell whether a link is down until somebody phones.

The point-of-sale terminals, the CCTV cameras, the office computers and the guest Wi-Fi all sit on the same segment, which means any one of them can reach the others.

What we built

A survey of every site first: what is cabled, what is wireless, which equipment must talk to which, and what the company loses per hour when a link is down.

Then an addressing plan with one VLAN per role — office, point of sale, cameras, guests, management — and firewall rules that state explicitly which segment may reach which. Guests reach the internet and nothing else.

The sites are joined by an IPsec tunnel so the ERP and the file server are reachable from every branch without exposing them to the internet, and remote staff connect through the same VPN rather than through a port forward.

Wi-Fi is centrally managed with per-site coverage planning, and everything reports into a monitoring server with alerts that name a person on call. The whole thing is handed over documented: topology, addressing, credentials in a password manager, and a one-page runbook for the three failures that actually happen.

Results

• One addressing plan across every site, documented
• Segments that cannot reach each other unless a rule says so
• Link failures raise an alert before a user notices
• Guest Wi-Fi isolated from the business network