SD-WAN Migration · Multi-Site
SD-WAN gives each office two or more internet lines and picks the best one for every application automatically, so one bad circuit does not stop work. We move multi-site organizations off MPLS (the older private carrier line), onto broadband pairs, or from an older SonicWall or Meraki edge onto Fortinet SD-WAN (we’re a Fortinet Engage Advocate Partner). Published fixed fee: $7,500 for the hub design and build, plus $1,750 per spoke site cut over. Every site gets a written migration and deployment plan, parallel running before the flip, and a rollback reviewed before cutover day. Your senior engineer leads the design, cutover and documentation, and stays your point of contact.
Track Record
We only do networks. That is not a limitation — it is why the outcomes are different.
Years of network-only practice. Architecture, security, and operations — not IT generalism.
Sites delivered. Healthcare clinics, law offices, financial branches, multi-site operations.
Design target for fully redundant builds with HA firewalls, diverse ISPs, and backed-up power.
Senior engineer–led. No junior handoffs. No ticket queue. No escalation chain.
Career aggregate. The 20+ years and 300+ sites span the operator’s full network-only practice, including prior-employer engagements. 99.99% availability, about 53 minutes of downtime per year, is an architecture design target for engagements that fund full redundancy. It is not a service guarantee or uptime SLA. Contracted response times and service levels are defined in each customer agreement.
Why SD-WAN Projects Go Wrong
SD-WAN itself is mature. Fortinet, Cisco, VMware/Velocloud, Versa, Aruba — the platforms work. The failures we’ve seen reviewing client environments are migration failures: a site nobody surveyed, no rollback plan, path-selection rules (the SLA-based steering that decides which line each application uses) left at vendor defaults, or two ISPs that look fine on paper and both drop the same video call. SD-WAN migrations that go badly are projects that didn’t document their assumptions.
Every site gets an actual assessment before cutover — current circuit, traffic patterns, application dependencies, identity-provider integration paths, on-site cabling realities. Generic SD-WAN vendor assessments miss the boring details that cause the actual outages on cutover day.
Every migration has a written plan: parallel deployment strategy, scheduled cutover windows per site, validation steps, rollback paths. We don’t cut over a site without a written rollback that’s been reviewed. If cutover day finds something unexpected, you already know the exact steps that put the old setup back.
Multi-site SD-WAN migrations roll out site-by-site, not all-at-once. Pilot with one or two sites, validate the architecture in production, then deploy to the rest in waves. Each site cutover is its own contained project — if something goes wrong at site 5, sites 1–4 are still running fine on the new architecture.
Hub-and-spoke to SD-WAN cutovers across distributed sites. Lab-verified before any live change.
We’re a Fortinet Engage Advocate Partner. For a new build we recommend Fortinet SD-WAN because one FortiGate handles the SD-WAN, remote access, user authentication and Wi-Fi control that used to take four separate products, so there is less to patch, license and troubleshoot. Other SD-WAN platforms (Velocloud, Meraki SD-WAN, Versa) we can support if you already run them; for Meraki, see Fortinet vs Meraki.
SD-WAN Migration Phases
Migrations break down into discrete phases, each with its own deliverables. Skipping any of them is how projects fail.
Per-site inventory of current circuits, traffic patterns, application dependencies, and identity-provider integration paths. Gap analysis between current state and target architecture. Output: site-by-site migration matrix with prioritization based on complexity and risk.
SD-WAN topology design (hub-and-spoke, full-mesh, or hybrid), which applications ride which line and what happens when a line degrades, ISP combinations per site, and whether FortiManager (Fortinet’s central console for pushing one template to every site) is in scope. Reviewed with your team before any deployment. Every design decision and the reason for it is written down.
One or two pilot sites cutover with full instrumentation: synthetic application monitoring, ISP path quality measurements, user-experience tracking. Run in parallel with old architecture for 1–2 weeks before declaring pilot success. Adjust architecture based on real production behavior.
Remaining sites cut over in waves, typically 3–5 sites per wave with 1–2 weeks between waves. Each wave validated against the same metrics as pilot. Communication plan for each cutover (when, who, what to expect, how to escalate).
Performance baselines re-established. Application behavior validated. ISP failover tested. Documentation updated to reflect actual deployed state. Ongoing operations handed off to your team or transitioned to a Fortinet multi-site managed plan.
From migration you can move straight into a managed plan from $695 per site per month: automated monitoring, human response Mon–Fri, 8 AM–5 PM Pacific, config backups and a monthly summary. Policy changes and new-site additions are scoped on top of the plan. Or take the as-built documentation and run it yourself; it is yours either way. Migration projects typically run 3–9 months depending on site count.
Migration Patterns We Handle
Different starting points, same engineering discipline. If your network looks like one of these, the migration path is already mapped.
Replacing one firewall without SD-WAN? A like-for-like FortiGate swap is $2,500 fixed; a firewall migration starts at $6,500 (from $8,900 for 100F–200F or an HA pair). The FortiGate sizing guide covers which model each site needs.
National scope — SD-WAN migrations are primarily remote engineering work. Multi-site clients nationally. On-site visits are scheduled for cutover days at sites where physical presence helps. Local clients: see our Fortinet MSP in Sacramento and Fortinet MSP in San Francisco pages.
Our Approach
No mystery. No black box. Every step is documented, explained, and approved before execution.
A Network Risk Assessment, at a fixed price. Configurations reviewed, segmentation validated and gaps documented, in a report you keep.
Address critical risks first, then build toward a standardized architecture. Every change documented, tested, and scheduled with a rollback plan.
Ongoing monitoring, change management, and architectural review. The network does not just work today — it evolves with your operations.
Your Engineer
Not a team of rotating technicians. Not a ticket queue. Every site migration has one named senior engineer as your point of contact, from assessment through ongoing operations, who knows your circuits, your compliance requirements and your business context.
Background: Founder, ex-Meta. Past engagements include Cisco, Wells Fargo, Fannie Mae, and other Fortune 500 networks — the same caliber of engineering, now applied to mid-market organizations.
We are a Fortinet Engage Advocate partner and supply FortiGate, FortiSwitch and FortiAP. We also monitor and manage the Cisco, Aruba, Arista and other enterprise gear you already run. You don’t have to rip anything out to work with us.
Best-Fit Migration Profiles
The migration economics work best at certain shapes — multi-site with current circuit cost pain, or single-site with WAN reliability problems that broadband+SD-WAN can solve.
POS systems, payment networks, customer Wi-Fi, and back-office traffic across many sites. SD-WAN replaces brittle MPLS or ad-hoc broadband+IPsec setups. Application-aware steering keeps payment traffic on reliable paths even when broadband degrades.
EHR cloud reachability, secure remote clinician access, branch site reliability across multi-clinic operations. SD-WAN provides the hub-and-spoke or full-mesh connectivity to centralized clinical systems with per-application monitoring that shows an auditor the clinic link was healthy.
Production-floor OT networks, warehouse-management traffic, ERP application paths to centralized data centers or cloud. SD-WAN provides the redundancy and application-aware quality measurement that production environments require.
Legal firms, engineering consultancies, accounting practices with multiple offices. SD-WAN consolidates branch connectivity onto a documented architecture — replacing the office-by-office setups that nobody documented and nobody can troubleshoot consistently.
Branch banking, financial advisory offices, fintech satellites. PCI-DSS-aware SD-WAN architecture isolates payment traffic, provides documented network controls auditors expect, and gives operations real visibility into branch network health.
Post-acquisition cleanup: consolidating multiple inherited branch-connectivity setups onto a single SD-WAN architecture. In a multi-vendor M&A environment, one documented architecture is the direct path to operational consolidation.
FAQ
Project timeline depends on site count, complexity, and ISP procurement lead times. Single-site migrations run 4–6 weeks end-to-end. 5–10 site multi-site rollouts run 3–5 months. Larger fleets (20+ sites) typically run 6–9 months in waves. ISP procurement (broadband installs at new sites) is often the longest single dependency, which is why we start that early in the project.
No. For a new build we recommend Fortinet SD-WAN because that’s where we have depth, and one FortiGate covers SD-WAN, secure remote access, user authentication and Wi-Fi control, so there is less to patch and troubleshoot. But we’ll also work with Cisco Meraki SD-WAN, VMware Velocloud, Versa, and other platforms if you have a vendor preference or existing investment.
If your migration adds broadband to sites that previously had MPLS-only connectivity, we coordinate that procurement: identify the right carriers per site (often two for redundancy), order the circuits, manage the install schedule, and handle the carrier troubleshooting before bringing the site live. Put ISP lead times on the schedule first.
For each site cutover: scheduled window (typically off-hours or weekend), parallel deployment running for 1–2 weeks before flip, on-site or remote engineer doing the cut, validation steps run, rollback path tested before any change is permanent. Post-cutover monitoring for 24–48 hours, then site is declared stable.
Common scenario. We design the rollout sequence so sites with circuits-ready-now go first, and circuits-arriving-later sites wait for their wave. The sequencing means you don’t lose project momentum; you just adjust the wave plan. This is a standard part of SD-WAN migration project management, not a setback.
Fixed fee, published: $7,500 for the hub design and build (overlay, underlay, SLA rules, per-site template) plus $1,750 per spoke site cut over. A five-site rollout is $14,500 in engineering before hardware and licenses, which are quoted separately. Rollouts above fifteen sites or with multiple hubs are scoped after the assessment.
Yes. Hybrid MPLS plus broadband is a supported design: the SD-WAN overlay runs across both, broadband carries the bulk of traffic, and MPLS stays as a second path until its contract ends. You cancel MPLS site by site once each site has passed its validation window, not before.
Start the SD-WAN Migration
Before any migration plan, before any ISP order, the first step is a Network Risk Assessment of where you are: current circuits, traffic patterns, which applications depend on which sites, how users sign in, and how complex each site is. You get a written report, a diagram and a site-by-site migration order. Whether you continue with us or not, the assessment is yours. $3,500 for a single small site; larger networks are priced on the assessment pricing page. See a sample report (PDF). The migration itself is a published fixed fee: $7,500 for the hub plus $1,750 per spoke site, quoted in writing before any work starts.
Response from a senior engineer within 1 business day.
A direct conversation — no sales team, no runaround.
An honest assessment of whether we are the right fit.
Clear next steps if we are — no pressure if we are not.
