Leased line & multi-WAN failover with encrypted remote access.

The problem

Plants often run everything over one leased line: accounting and ERP, CAD sync, voice, CCTV uploads and OS updates. When it drops at 2:00 PM on dispatch day, invoices and gate passes stop with it.

The tiers

• Tier 1 — leased line. Guaranteed committed information rate (CIR) and SLA. Reserved for ERP, CAD sync and voice via policy-based routing.
• Tier 2 — fibre broadband. Carries bulk traffic under QoS in normal operation; becomes the primary path on failover.
• Tier 3 — 4G/5G cellular. The last-resort path for critical traffic only.

Failover triggers

Each link is monitored continuously. A tier is marked down when packet loss exceeds 15% or latency exceeds 80 ms, and the firewall promotes the next tier. Our target recovery time is under 3 seconds.

# Gateway group (conceptual)
Tier 1  WAN_LEASED   trigger: loss > 15% OR latency > 80 ms
Tier 2  WAN_FIBRE
Tier 3  WAN_LTE

# Policy-based routing
ERP, CAD-sync, voice  -> GW_GROUP_PRIORITY (Tier 1 > 2 > 3)
Bulk / updates        -> WAN_FIBRE (shaped)

Encrypted site-to-site and remote access

Plants are joined by encrypted site-to-site tunnels (AES-256-GCM with dead-peer detection), so traffic between sites never crosses the internet in the clear. Remote engineers connect through an encrypted VPN with handshakes under 50 ms in our builds. Nothing like remote desktop or file shares is ever port-forwarded to the internet, and MFA is mandatory.

For who may connect, see Secure remote access: VPN access only from approved devices, with sign-in against your Active Directory.

Where we've deployed it

At a multi-site laser fabrication plant, Site 1 runs a leased line plus broadband behind a multi-WAN firewall with intrusion prevention and VLAN isolation. Site 2 load-balances dual broadband, and all three sites are joined by encrypted tunnels.