Retail and commerce networking: POS, Wi-Fi, video surveillance

Retail networks for stores, franchises, and chains must combine high availability (every minute offline means lost sales), PCI-DSS compliance for payments, customer WiFi with analytics, security cameras, IoT (ESL electronic shelf labels), and centralized multi-site management. 2026 retail guide for chains of 10-1000 stores.

Retail requirements

• Availability: 99.95% minimum (4h downtime/year)
• PCI-DSS: for every store processing card payments (TPE, SDC)
• Consistency: every store uses the same architecture (simplifies support)
• Rapid deployment: new store operational within 48h
• Security: segmentation of card payments / inventory / guests
• Analytics: footfall, heatmaps, and time spent in departments (via WiFi)

Standard store architecture

• 1× FortiGate 60F or Meraki MX67 (FW + SD-WAN)
• 1× 24-port PoE+ switch (FortiSwitch-224E, Meraki MS210)
• 2-6× WiFi 6 APs (FortiAP-231F, Meraki MR36)
• Uplinks: primary FTTH + 4G/5G backup
• Isolated PCI VLAN for TPE/SDC

PCI-DSS segmentation

• VLAN 10: STAFF (employees, checkout computers)
• VLAN 20: PCI (TPE, SDC, POS server)
• VLAN 30: GUEST (guest WiFi)
• VLAN 40: IoT (ESL labels, cameras)
• VLAN 50: BACKOFFICE (office, printers)
• FW inspection between zones is mandatory

Multi-store SD-WAN

Ideal SD-WAN use case:

• ZTP: the store connects the FortiGate, which is automatically provisioned from FortiManager
• Primary FTTH + automatic 4G backup
• Centralized PCI policies at HQ
• MPLS savings: 60-80% TCO
• Solutions: FortiGate SD-WAN, Meraki MX, Cisco Viptela, Palo Alto Prisma

WiFi analytics

• Meraki Location Analytics: footfall, dwell time, and popular departments
• Aruba Analytics and Location Engine (ALE): equivalent solution
• Cisco Meraki MV + MR: combined CCTV + WiFi analytics
• GDPR: MAC anonymization is mandatory (hashing)
• ROI: identification of low-traffic areas and merchandising optimization

Retail IoT

• Electronic shelf labels (ESL SES-imagotag, Pricer): via a dedicated 2.4 GHz AP
• 4K IP cameras: Meraki MV, Hanwha, Milestone
• Bluetooth beacons: proximity marketing (push offers)
• Self-checkout: Zebra, NCR

Security

• Annual penetration tests for PCI-DSS level 1 (>6M transactions/year)
• VLAN segmentation + microsegmentation within the PCI zone
• Minimum log retention of 1 year (12 months under PCI DSS)
• Patching: weekly maintenance windows
• 24×7 support: stores open on Sundays/public holidays

Chain sizing

10 franchised boutiques

• 10× FortiGate 60F + UTM = ~12,000€ HT
• 10× FortiSwitch-224E = ~16,000€ HT
• 20× FortiAP-231F = ~7,000€ HT
• FortiManager (10 devices) = 1,900€ HT
• Centralized SD-WAN + FortiAnalyzer
• Total: ~50,000€ HT

100-store chain

• 100× FortiGate 60F + UTM = ~120,000€ HT
• FortiManager + FortiAnalyzer: ~30,000€ HT
• WiFi + switches: ~250,000€ HT
• 3-year total including licenses: ~700,000€ HT

Order from OPTINOC

Turnkey multi-site retail networking. FortiGate/Meraki + SD-WAN + PCI-DSS. Deployment across 10-1000 stores. Centralized ZTP and FortiManager. Quote within 48h.