Multi-site networks managed from one dashboard

What a multi-site network is

A multi-site network joins two or more locations so that people at any site can reach the systems they need, under the same security rules, and so that IT can manage the whole estate centrally. Traditionally that meant private circuits back to head office and a separate box to configure at every branch. Today most organisations combine internet connections at each site with an SD-WAN overlay: encrypted tunnels across the internet, with policies deciding which traffic goes where.

The hard part is rarely connecting the first two sites. It is keeping the fortieth site configured the same way as the first, seeing problems before users report them, and changing a rule everywhere at once. That is what cloud management is good at.

How a Meraki multi-site network fits together

Picture the network as layers, from the data centre or head office out to a single home desk:

1. Hub. At head office or in a data centre, one or two MX appliances act as the VPN hub. Two can run as a warm spare high-availability pair. Shared servers, internal applications and the main internet breakout sit here if you still have them on premises.
2. Branch sites. Each branch has an MX as its firewall and SD-WAN edge. With Auto VPN enabled, it builds encrypted tunnels to the hubs you choose; the routes are exchanged automatically through the Meraki cloud.
3. Local LAN. Behind each MX sit Meraki MS switches or cloud-managed Catalyst switches and access points, in the same dashboard network as the MX.
4. Internet links. Each site has one or two wired internet connections, such as broadband or a leased line, with SD-WAN policies choosing between them.
5. Cellular backup. A Meraki MG cellular gateway hands 4G or 5G connectivity to the MX as a backup uplink if the wired line fails.
6. Home workers and kiosks. Z-series teleworker gateways join Auto VPN like a very small branch, bringing corporate Wi-Fi and wired ports to a home desk.
7. The dashboard. Above it all, the Meraki dashboard holds every site's configuration, monitoring, alerts and firmware schedule. Management traffic goes to the cloud; user traffic does not.

The same structure works with a hub in the cloud: Meraki's virtual MX (vMX) can act as a hub in a public cloud platform such as Microsoft Azure, which suits organisations that have moved servers out of their own building.

Connecting sites with Auto VPN and SD-WAN

Auto VPN is Meraki's automated site-to-site VPN. Instead of configuring each tunnel by hand, you mark each MX as a hub or a spoke in the dashboard:

On top of the tunnels, SD-WAN policies decide how traffic uses each site's internet links: load balancing across two uplinks, preferring one link for particular applications, and failing over when a link degrades. The edition of MX licence decides which SD-WAN and security features you get: compare them on Enterprise vs Advanced Security vs Secure SD-WAN Plus. For Meraki SD-WAN as a supplied and supported service, see our Meraki SD-WAN page.

Keeping sites consistent with templates

Configuration templates are the main tool for running many similar sites. A template holds one base configuration; every network bound to it inherits that configuration, and a change to the template reaches every bound site.

• Addressing: an MX template can allocate a unique subnet to each bound site from a range you set, so you do not plan every branch's addressing by hand.
• Firewall rules: template rules can use VLAN objects instead of IP ranges, so one rule means the right local subnet at every site.
• Wi-Fi: every site broadcasts the same SSIDs with the same authentication, so staff connect automatically when they visit another branch.
• Switching: switch templates share port configurations across switches of the same model.

Templates are not for every site. Head office, a data centre or an unusual site usually stays as a standalone network, because some settings cannot be changed locally on a template-bound network. Meraki setup covers how we decide.

Resilience at each site

A branch that loses its internet connection loses access to almost everything, so resilience is built in layers:

• Two wired connections from different providers or technologies where the site justifies it.
• Cellular backup through an MG gateway, on the network chosen by the signal available at each site. Forever Group supplies EE Business and Three Business, and can also supply O2 Business and Vodafone Business.
• Warm spare MX pairs at hubs and critical sites, so a hardware failure does not take the site down.
• Redundant hubs, so spokes can fail over to a second hub.

Meraki devices keep passing traffic on their last configuration if they lose contact with the Meraki cloud; you just cannot make changes until it returns. Our page on cloud vs on-premise networking explains why.

Central visibility and control

With every site in one organisation, the dashboard becomes the single place to answer questions such as which sites are offline, which uplinks have failed over, which access points are struggling, and which firmware is running where.

• Network tags group sites, by region or type, for example, and admin permissions can be granted per tag so a regional team sees only its own sites.
• Admin roles range from full access to read-only and monitor-only, so service desks can see without changing.
• Alerts by email or webhook flag devices going offline, VPN problems and configuration changes.
• Firmware is scheduled across networks from one page, with maintenance windows per site.
• The Dashboard API lets you automate repetitive changes and pull data into other tools; see Meraki dashboard.

Security at the edge

Each MX enforces the same firewall policy at every site, and with the Advanced Security edition adds intrusion prevention, content filtering and malware protection locally (see Meraki Advanced Security licence). Many multi-site organisations add DNS-layer protection with Cisco Umbrella with Meraki, or move towards SASE, where security is delivered from the cloud for users at any site or at home: see Cisco SASE.

Access control matters too. Cisco Access Manager brings cloud-delivered network access control to Meraki switches and access points, so the same identity rules apply in every branch.

Phones and other services across sites

A multi-site network usually carries more than data. Voice traffic needs quality of service across the WAN, cameras need VLANs and storage planning, and building systems need isolating. If you are also looking at phones for several offices, Forever Group's multi-site phone system guide on cloudphone.cloud covers that side.

How Forever Systems helps

Forever Systems is a Cisco Partner. For multi-site networks we can design the topology, addressing and templates, supply MX, MS, MR, MG and Z-series equipment and licences, arrange internet connections through Forever Group, stage equipment so branches can be installed quickly, and plan site-by-site rollouts.

Contact us with the number of sites, how they connect today and what you want to change.