Multi-Site Network: WAN Design and Centralization

April 15, 2026·3 min read·433 words

Designing a multi-site network for headquarters, branch offices, and warehouses requires a robust SD-WAN architecture, consistent security, and centralized management, with a phased replacement of legacy MPLS. Complete 2026 multi-site design guide: topologies, WAN, security, sizing, and TCO.

Site Types

HQ (Headquarters): 100-500 users, local data center, high-speed internet
Branch offices: 5-100 users, little or no local IT support
Secondary data center (DR)
Remote workers: individual endpoints connected via ZTNA
Mobile sites: vans and food trucks (4G/5G)

Topologies

Hub-and-Spoke

All spokes connect to the HQ. This architecture is simple and provides centralized inspection, but it increases inter-spoke latency.

Full-Mesh ADVPN

Dynamic on-demand inter-spoke tunnels (FortiGate ADVPN, Cisco DMVPN) provide optimal latency.

Hybrid (2026 Standard)

Hub-and-spoke for outbound internet traffic, with a dynamic full mesh for inter-site VoIP and video.

Multi-Site SD-WAN

FortiGate SD-WAN: 60F/80F/100F at spokes and 200F/400F at the hub. Native SD-WAN at no additional cost
Cisco SD-WAN (Viptela): Catalyst 8200 at spokes, 8500 at the hub, and cloud-based vManage
Meraki MX: cloud-first, easy to deploy, with mandatory licenses
Palo Alto Prisma SD-WAN: native SASE integration

WAN Connectivity

Primary link: FTTH 300 Mbps-1 Gbps (carrier A)
Secondary link: FTTH 100-500 Mbps (different carrier B)
4G/5G backup: Teltonika RUTX11 router or FortiExtender
Critical sites: 3 links (2 fixed links + 4G/5G)

Multi-Site Security

Consistent firewalls across all sites (using the same vendor is recommended)
NGFW inspection enabled everywhere (IPS, AV, Web Filter)
Consistent VLAN segmentation (VLAN 10=data, 20=voice, etc.)
Centralized policies (FortiManager, Panorama, Meraki Dashboard)
Centralized AD/Azure AD authentication (RADIUS)
SASE for remote workers and cloud access

Centralized Management

FortiManager: 10-10,000 FortiGate devices, with ADOMs by site
Cisco DNA Center: templates and intent-based networking
Panorama: Palo Alto templates and device groups
Meraki Dashboard: simple and cloud-only

Multi-Site Voice Services

Centralized SIP trunking at the HQ (Teams, 3CX, Asterisk)
IP phones on the VOICE VLAN with PoE+
End-to-end DSCP EF QoS
Backup: emergency DISA access and mobile SIP phones

Typical Sizing for 20 Branch Offices

HQ: 2× FortiGate 200F in HA + FortiManager + FortiAnalyzer
20× FortiGate 60F or 80F devices at spokes
Switches and APs at each site based on size (5-50 users)
WAN: FTTH + 4G at each site
Budget: ~€180,000 excluding tax for hardware + €80,000 for licenses and 3 years of coverage

MPLS → SD-WAN Migration

Phase 1: pilot at 2-3 sites alongside MPLS (1-3 months)
Phase 2: rollout in waves (5-10 sites/month)
Phase 3: MPLS+SDWAN coexistence (6-12 months)
Phase 4: MPLS decommissioning
Savings: 40-70% over a 3-year TCO

Order from OPTINOC

Turnkey multi-site design and migration. MPLS → SD-WAN audit. FortiGate/Cisco/Palo Alto/Meraki. Quotes for 10-500 sites within 48 hours.