Multi-Site Connectivity and SD-WAN
Connect distributed operations without losing visibility or control.
Design and support resilient connectivity across offices, plants, mines and commercial locations.
Discuss this requirement →Start with the environment, risk and required outcome.
Design and support resilient connectivity across offices, plants, mines and commercial locations. Namandla Consultants begins with evidence and recommends a proportionate engagement rather than a generic technology package.
Connected expertise for the wider environment.
Clear steps. Visible decisions.
The options and where each one fits
| Option | Typical use | Strength | Constraint |
|---|---|---|---|
| Site-to-site VPN over internet | Most branch offices | Cheap, uses connectivity you already have | Performance follows the internet path, no guarantee |
| MPLS | Where a carrier-guaranteed path is required | Predictable performance, contracted service levels | Expensive, slow to provision, inflexible |
| SD-WAN | Several sites, more than one link each | Uses multiple links, application-aware routing, automatic failover | Adds a platform to run, needs enough sites to justify it |
| Point-to-point wireless | Sites in line of sight, campus buildings | High capacity, no recurring carrier cost, fast to deploy | Needs line of sight, weather-affected at some frequencies |
| LTE and 5G | Failover, temporary sites, low-bandwidth remote sites | Deploys anywhere with coverage, quick | Data cost, coverage dependent, contention |
| Satellite | Genuinely remote sites | Works where nothing else does | Latency, cost, weather |
Most South African multi-site estates end up with a mix rather than one technology, and the design question is how they combine rather than which one wins.
Failover, which is the part most often wrong
A second link is not failover. Failover is a second link plus a tested mechanism that moves traffic to it and back, without anyone intervening.
Diversity matters more than capacity
Two fibre circuits from different providers that share the same physical duct fail together. Ask any provider whether your primary and secondary follow diverse physical paths. The answer is frequently no and it is frequently discoverable only by asking directly.
Test it
A failover configuration that has never been exercised is a hypothesis. Scheduled failover testing, where the primary is deliberately dropped during a planned window, is the only way to know. It routinely finds that the secondary link has been down for weeks, that a route does not come back automatically, or that a firewall rule references the primary interface explicitly.
Monitor the backup link
It is idle by design, so it fails silently. Monitoring the standby is as important as monitoring the primary and it is almost never configured.
Decide what actually needs to fail over
Full capacity on a backup link is expensive. Deciding in advance that a site on failover runs core business systems and voice while large file transfers and non-essential traffic wait, is a policy decision that makes a smaller backup link viable. SD-WAN enforces that automatically. Without it, the decision has to be made in the design.
Remote and industrial sites
This is where South African multi-site work differs from the textbook version.
Mining operations
Corporate offices, shafts and surface facilities frequently sit far from carrier infrastructure, with a mix of microwave, LTE and satellite reaching them. Bandwidth is limited, latency varies and the physical environment is hostile to equipment. Design for constrained links rather than assuming fibre: local caching, tolerance of high latency in applications, and honesty about what will and will not work at the end of a satellite hop.
Depots and distribution
Often industrial parks with variable fibre availability. Frequently the requirement is modest, a warehouse management terminal set, a handful of users and voice, which means an LTE primary with a modest fibre backup can be the right answer rather than the compromise it sounds like.
Plants and manufacturing sites
Business connectivity alongside operational technology, with a hard requirement to keep them separated. The link design has to carry both without letting them mix, which is a segmentation question as much as a connectivity one.
Temporary and project sites
Construction, seasonal operations, exhibitions. LTE with a router that can be redeployed, rather than a fixed circuit with an installation lead time longer than the project.
Power
A link is only up while the equipment at both ends is powered. Network equipment at remote sites needs battery backup sized for the outage duration you actually experience, and generator integration where one exists. This is the most common cause of a site being unreachable when the link itself is fine.
Design considerations
Addressing
Overlapping address ranges between sites is the most common obstacle in a merger or an acquisition, and it is painful to fix later. An addressing plan across the estate, allocated centrally, costs nothing at the start.
Routing
Dynamic routing where the topology justifies it, static where it does not. The failure mode to avoid is a routing design only one person understands.
Quality of service
Voice and interactive traffic prioritised over bulk transfer, applied at every egress point rather than only at the core. Covered in more detail on corporate VoIP, where it matters most.
Encryption
Site-to-site traffic encrypted, including over private circuits. A carrier link is not a private network in the sense people assume.
Segmentation across sites
Segments should be consistent estate-wide. A camera segment at head office and a flat network at the depot means the depot is the weak point, and it will be reached from head office.
Documentation
Circuit references, provider contacts, contract dates, IP allocations and the escalation path per provider, in one place. During an outage this is what determines whether the fault gets logged in four minutes or forty.
What Namandla delivers
Assessment
Current links, contracts, costs, utilisation, failover state and what actually happens when a link drops.
Design
Topology, technology per site matched to what is available and what the site needs, failover, addressing, routing, quality of service and segmentation across the estate.
Provider selection and liaison
We help select carriers and then deal with them, for provisioning and for faults. The circuits are contracted with the carrier.
Deployment
Router and firewall configuration, tunnel establishment, SD-WAN platform where applicable, testing and cutover.
Failover testing on a schedule, with results recorded, so the failover is a measured fact rather than a design intention.
Monitoring. Circuit availability, latency, jitter, loss, utilisation and standby link state, with alerting.
Support. Fault resolution and carrier escalation under the response commitments on managed IT services.
Onsite work is Gauteng. For sites elsewhere we design and manage centrally with contracted local installation, which we help you arrange.
Common questions about Multi-Site Connectivity
What is SD-WAN and do we need it?
SD-WAN manages several links at each site as one, routing traffic by application and failing over automatically. It earns its cost where you have multiple sites with more than one link each.
Below roughly four or five sites, or with a single link per site, the platform overhead frequently exceeds the benefit. A well-configured VPN with a tested failover mechanism does most of what a small estate needs. SD-WAN is often sold into environments whose actual requirement was a second link and a working failover configuration, which costs considerably less.
Do we still need MPLS?
Rarely, and it still has a place where a contracted performance guarantee on a specific path is genuinely required. For most estates, internet-based connectivity with proper failover delivers comparable outcomes at lower cost.
The consideration is what you lose: a carrier-backed service level on the path itself. If your business genuinely depends on that guarantee and can evidence why, MPLS remains defensible. If it is there because it was specified in 2016, it is worth re-examining at renewal.
How do we connect a remote site with no fibre?
LTE or 5G where there is coverage, point-to-point wireless where there is line of sight to a connected site, and satellite where there is neither. The design then has to suit the link rather than assume it will behave like fibre.
That means local caching where it helps, applications tolerant of latency, quality of service that protects the traffic that matters, and honesty at the design stage about what will not work well. A remote site on satellite will not run a latency-sensitive application acceptably and it is better to know that before the deployment.
Two links means we have redundancy, correct?
Only if the failover has been tested and the links are genuinely diverse. Two circuits from different providers sharing the same physical duct fail together, and that is more common than people expect.
Ask your providers directly whether the primary and secondary follow diverse physical paths. Then test the failover in a planned window. Testing routinely finds that the standby has been down for weeks, that routing does not return automatically, or that a rule references the primary interface by name.
How do we know the backup link works?
Monitor it and test it. A standby link is idle by design, so it fails silently and the failure is discovered at the worst moment.
Monitoring standby link state is as important as monitoring the primary, and it is almost never configured. Scheduled failover testing, dropping the primary deliberately during a planned window, is what turns a design intention into a measured fact.
Can you connect sites in other provinces?
Yes. Design, configuration, provider liaison and ongoing management run nationally. Onsite installation outside Gauteng is done through contracted local installers, which we arrange and manage.
We are direct about that split. Central design and management with local hands works reliably for a distributed estate. A national onsite claim from a Gauteng-based firm generally resolves into a long drive at the point it matters.
What about connectivity for mining or industrial sites?
Design for constrained and variable links rather than for fibre. Microwave, LTE and satellite in combination, local caching, latency-tolerant application design, battery and generator-backed equipment, and a clear separation between business and operational technology traffic.
The two things most often underestimated are power and environment. Equipment at a remote site needs backup power sized for the outages that site actually experiences, and enclosures suited to dust, heat and vibration. A link that is technically fine is still down when the router is not powered.
How long does a multi-site deployment take?
Design is two to four weeks. Deployment is driven by carrier provisioning, which is typically four to twelve weeks per circuit depending on the technology and whether new infrastructure is needed.
The sequence that works is to design fully, order circuits early because they are the long pole, and configure and test everything in parallel so that cutover per site is short. Sites migrate one at a time with a fallback, not all at once.
When is a simpler design enough?
Two sites with a single fibre link each and a VPN between them, plus an LTE backup with tested failover, covers a great deal of what mid-market multi-site estates actually need.
Complexity should follow requirement. If your sites are two offices with fifteen people each, an SD-WAN platform is effort and cost for something a pair of firewalls will do. We will say so rather than scoping the larger thing.