Connect multiple offices: site-to-site VPN or SD-WAN?

A small business that opens a branch, acquires another company or sets up a workshop a few kilometers away has to connect multiple sites. Employees expect the same files, the same business software, the same printers and the same phone system wherever they work.

Two approaches dominate: the site-to-site VPN, proven and simple, and SD-WAN, newer and more flexible. The right choice depends on the number of sites, the applications and the level of availability you expect.

Needs before technology

• Where do the data and applications live: a server at headquarters, the cloud, or both?
• What traffic has to flow between sites: files, business software, phones, cameras?
• How many people work at each site, and how much downtime can they tolerate?
• What internet connection is available at each site?
• Who can go on site when there is a problem?

Site-to-site VPN: how does it work?

Each site has a firewall, and the firewalls set up a permanent encrypted tunnel between them across the internet. For users, everything works as if the sites shared one network, with rules that define what each site can reach.

For two to a few sites connected by a reliable line, it is often the simplest and most economical solution. Firewalls from the same vendor make configuration and follow-up easier.

When should you move to SD-WAN?

SD-WAN adds a layer of intelligence: each site can combine several links (two fiber lines, or fiber and 5G), and the system continuously picks the best path for each type of traffic. Phone calls and video conferencing take the most stable link, backups the least loaded one. Configuration is managed centrally.

It becomes worthwhile with several sites, multiple links or applications that are sensitive to connection quality. For two sites with one fiber line each, it often adds little compared with a well-configured VPN.

Redundancy and monitoring

If headquarters hosts the server, an outage of its connection stops every site. Redundancy therefore starts where the data lives: a backup link at headquarters, and at the sites where an outage stops production. Monitoring of the tunnels and links can flag a problem before users start calling, during the agreed monitoring hours.

Also check what happens to the phones when the link between sites drops: each site must still be able to make outside calls. And every application moved to the cloud reduces the dependence on headquarters, since each site then reaches it over its own connection.

Document the architecture

• An up-to-date network diagram: sites, links, firewalls, address ranges.
• The rules between sites and the reason for each.
• Each provider's contracts and contacts, with line numbers.
• The procedure when a site or a link goes down.