SD-WAN: connecting multiple stores and offices securely and without disruptions

7 min read · DataRoad

SD-WAN It is the modern way of connecting multiple stores, restaurants or offices to each other and to the internet, without a single operator failure stopping a location. Instead of each location relying on a single connection and a manually configured setup, each location now has two connections — for example, fiber and a mobile connection — and a device that decides on its own which to use, managed from a central panel. For a company with multiple locations, it is the difference between “the store in Braga is without a system” and “the store in Braga changed connection and no one noticed it.”.

What is SD-WAN, in management language

In practice, one SD-WAN device at each location does four things:

• Uses several connections at the same time — fiber, a second fiber from another operator or a mobile connection.
• Choose the connection by application — billing and calls go through the more stable connection; an update of the software might go through the other one.
• Changes connection automatically when a failure or degradation occurs without anyone intervening on the spot.
• Calculates traffic between locations and applies the same security rules to everyone, from a single dashboard.

SD-WAN or VPN between offices: when it makes sense for each

A VPN between offices is a encrypted tunnel between two locations, usually over a single internet connection on each side. It works well, is cheap, and remains the right choice in many cases. SD-WAN adds intelligence and centralized management on top of that.

A practical rule: if an hour without internet in a store costs more than the equipment and the second connection from that store for a year, the SD-WAN is paid for. To put numbers to that downtime, use the article account How much does an hour of downtime cost.

Dual internet: the piece that makes the difference

Without two connections, SD-WAN has little to choose from. Redundancy is the heart of the system, and there are three rules for doing it well:

1. Different operators. Two fibers of the same operator can fail together.
2. Different physical paths. If the two fibers enter the same conduit, a streetwork project cuts them off. A mobile or satellite connection avoids this common point.
3. Energy. If the equipment does not have an uninterruptible power supply (UPS), a power failure will shut everything down. We explained how to prepare the company in blackout: is the company prepared?

We have detailed the connection options — and what to ask the operator — in the guide on Internet speed and redundancy in companies.

Security: a rule for all locations

Connecting local networks also means that a problem in one can reach the others. Therefore, an SD-WAN project should come with segmentation (separating the box, office, cameras, and Wi-Fi from customers on separate networks) and the same firewall policy everywhere. This is the topic of our article about security in several stores with a central firewall.

Many current firewalls already include SD-WAN functions. On many networks, the most cost-effective way is to activate and configure what already exists — rather than buying a new box for each location.

A real case: 16 restaurants managed as a single entity

A Fullicious, The restaurant group with 16 restaurants in Lisbon and Porto — including Adega de São Roque, Bacalhau com Todos and Peixaria do Rossio — chose DataRoad for its network infrastructure. The project included firewall and security, enterprise wireless network, centralized management via the cloud with configuration applied to all restaurants, a segmented network for employees and customers, and real-time remote monitoring of consumption, signal quality, and security settings.

In another case, the Boost Portugal, The , a tourist animation group operating in Lisbon, Porto, Douro and Madrid, has in the contract with DataRoad internet redundancy with automatic fail-over between connections and aggregation of connections, as well as remote monitoring with alerts and availability reports.

In both cases, the principle is the same: the locals do not depend on who is there to keep themselves connected and protected.

How to advance the operation without stopping

1. Survey by location: current connections, operator, equipment, critical applications and the cost of a stop.
2. Drawing: which second connection at each location, which applications have priority, which security rules apply to everyone.
3. Pilot: a location with billing, voice, and access to the cloud validated — including a deliberate cut to the main connection.
4. Expansion in phases: local to local, outside of the busiest hours.
5. Continuous surveillance: degraded connection alerts before a drop, and availability reports by location.

Frequently Asked Questions

Does SD-WAN replace VPN?

In networks with multiple locations, yes: SD-WAN creates encrypted tunnels between locations and adds automatic connection selection and centralized management. For access by remote workers, the solution is different — see the article VPN is no longer enough: secure remote access.

Do I need two internet connections in each location?

To take advantage of SD-WAN, yes, at least in places where downtime costs sales or productivity. Ideally, with different operators and physical paths, for example fiber and a mobile connection.

Do I have to replace all the equipment?

Not always. Many current firewalls already have SD-WAN functions. We start with the assessment and only recommend replacing devices that do not support central management or no longer receive updates.

How long does the implementation take?

It depends on the number of locations and the availability of secondary connections from the operators. The pilot takes off from one location and the expansion follows in phases, without stopping the operation.

Listing of connections from all your locations in 10 working days

We map the connections, critical equipment and applications of each store or office, calculate the downtime risk and deliver the SD-WAN design and redundancy per location. For companies with more than 10 locations · contract support · remote, on-site and telephone support. Management firewalls and computer security It is included in the plans IT Unlimited Premium, With on-site assistance.

Sources

• Cisco — What is SD-WAN? (definition, multiple connections, centralized management, and application-based routing)