Case study
Multi-site WAN consolidation across three vendors
A decade of site-by-site growth in three vendors: static routes layered over partial dynamic routing, overlapping address space in two regions, and a core whose second path had been repurposed and never restored.
An audit first, then one addressing plan, OSPF with a scoped area design and filtered boundaries, VRFs for the traffic classes, and the second core path restored and tested by switching the primary off.
One design a new engineer can follow, convergence after a link failure down from minutes to seconds, and a second core path that has since been used in anger.
A wide-area network that had grown site by site over a decade, in three vendors, with no two branches configured the same way. The brief was to make it one network again without an outage window long enough to notice.
The problem
Each site had been connected when it opened, by whoever was available, with whatever hardware was in budget that year. The result worked, in the sense that packets arrived. It also had static routes layered over a partial dynamic routing design, overlapping address space in two regions, three different VLAN numbering conventions, and a core that had quietly become a single point of failure because the second path had been repurposed during an earlier project and never restored.
None of that cost anything on a quiet day. It cost on the bad ones. A link failure took minutes to converge rather than seconds, a change at one site could reach places nobody had predicted, and no two branches could be diagnosed the same way, so every fault started again from the beginning with a different set of assumptions. Nobody had a current diagram either, which meant the first deliverable was not a design — it was an audit.
What I did
- Read everything first. Every running configuration collected and diffed against its neighbours, so the variations were catalogued rather than discovered mid-migration.
- Re-address before re-routing. The overlapping ranges were resolved first, in isolation, because every later step depended on them.
- One routing protocol, deliberately scoped. OSPF with a sane area design replacing the static-route patchwork, with route filtering at the boundaries so a mistake at one site could not propagate to the rest.
- Segmentation that matches the business. VRFs separating the traffic classes that should never have shared a table, with controlled leak points rather than a firewall rule nobody could explain.
- Restore the second path. Then test it by switching the primary off during a planned window, which is the only test that counts.
The cutover went site by site, in reverse order of importance, each with its configuration prepared and reviewed in advance and a rollback that had been rehearsed on the bench. The smallest and least critical branches went first, so that anything unforeseen surfaced where it cost the least. By the time the core sites were reached, the procedure had been performed a dozen times.
The result
One routing design, one addressing plan, one naming convention, and documentation that a new engineer can follow. Convergence after a link failure dropped from minutes to seconds. The second core path exists, and has since been used in anger.
Because every branch now follows the same design, connecting a new one is a repeat of a documented procedure rather than a fresh set of decisions taken by whoever happens to be available that year — which is how the estate arrived at the state it was in.