Multi-site network architecture refresh (2023)

End-to-end network architecture refresh across every office in a regional estate that had been the outlier in the company's network footprint. Replaced an inherited fragmented stack of mixed firewalls, switches, and APs with a standardized three-vendor design: Cisco Meraki MX firewalls, HPE Aruba Instant On switches, and Aruba Instant On access points. Designed, procured, shipped, and self-installed at every site over a two-week road trip in October 2023.

Pre-upgrade state

When I took the IT Manager role in October 2022, the company's other regions were already on Cisco Meraki firewalls and APs. This region was the outlier, still running an inherited fragmented multi-vendor stack with no Meraki footprint at all.

The pre-project firewall inventory showed mixed-vendor firewalls (SonicWall, Peplink, and others), assorted unmanaged or partially-managed switching across a mix of vendors and port counts, and Ubiquiti and Ruckus APs at different offices. Each site was effectively its own island: no consistent VPN topology, no central monitoring, no IT cloud access for troubleshooting, no shared policy.

Target state

• Perimeter / VPN Cisco Meraki MX (MX67 / MX75 / MX85, right-sized per site). Site-to-site VPN mesh, one dashboard for all sites, consistent firewall rules, content filtering, IDS.
• Switching HPE Aruba Instant On switches, cloud-managed via the Instant On portal.
• Wireless Aruba Instant On access points on the same Instant On management plane.
• Printers / MFPs Centrally monitored through the printer-vendor portal over the new VPN. Auto supply ordering, usage reporting fed back to the printer company.
• IT troubleshooting access Cloud-based access to each office network via Meraki dashboard. Eliminates most "drive to the site" trips.

Equipment procured (mid-2023)

A single Meraki reseller handled the quote and shipped directly to each site for self-install:

• Meraki MX85 + 3-year Enterprise License/Support at larger sites
• Meraki MX75 + 3-year Enterprise License/Support at mid-size sites
• Meraki MX67 with 802.11ac + 3-year Enterprise License/Support at smaller sites

Around 13 Meraki MX appliances total, with three-year coverage across the regional estate. HPE Aruba Instant On switches and APs procured through separate channels and shipped to the corresponding offices ahead of the install trip.

August 2023: per-site discovery and coordination

Per-site discovery threads captured local context: existing-state IT info, per-site cutover plans, equipment serials, and any office-specific gotchas. Per-site folders in the install workspace held the corresponding cutover notes.

October 2023: two-week road trip

Two-week road trip across every office in the region. At each site:

1. Unboxed the pre-shipped Meraki MX, Aruba Instant On switches, and Aruba APs.
2. Mounted the new perimeter appliance, ran cable as needed, replaced the inherited firewall in place.
3. Brought the new switches online in the rack, migrated office endpoints over, decommissioned the old switching.
4. Mounted the Aruba APs, confirmed wireless coverage end to end.
5. Brought the site onto the Meraki dashboard and verified the site-to-site VPN tunnel was up.
6. Confirmed the printer vendor's central monitoring agent could see the office's MFPs over the VPN, and that supply auto-ordering was active.
7. Validated cloud-based IT troubleshooting access end to end before leaving.

Sites visited covered 10+ offices across the region.

What this enabled

• Centralized MFP monitoring with auto supply ordering (the user-facing outcome office managers care about: nobody runs out of toner).
• Cloud-based IT troubleshooting into every office network.
• Site-to-site VPN mesh that later became the carrier for unified UC (a 2025 region-wide cutover from a legacy hosted PBX to Microsoft Teams Phone ran on top of this).
• One dashboard, one policy across all sites, which then made the 2025 Meraki firewall fleet refresh trivially executable as a drop-ship workflow.
• Aruba Instant On in production as the standardized switching and wireless layer, which informed the broader AP refresh program.

What this demonstrates

• End-to-end ownership of a multi-site network refresh: requirements, vendor selection, quoting, procurement, logistics, installation, post-cutover validation, all carried by one IT Manager.
• Multi-vendor design judgment Cisco Meraki where the cloud-management plane and VPN mesh mattered most; Aruba Instant On where cost-effective managed switching and Wi-Fi was the right fit. Single management surface within each vendor.
• Hands-on operational execution A two-week road trip to install at every site personally built a deep direct knowledge of every site's physical state.
• Foundation-laying This project produced the platform that the next two years of regional work (UC, M&A integrations, supply auto-ordering, remote troubleshooting) all leverage.
• Right-sized capacity planning Three MX models chosen per site rather than over-buying the same model everywhere.