300 stores on one secure fabric: WireGuard SD-WAN with PCI segmentation
A specialty retail chain with stores across the United States, a leader in its segment.
- Scale
- 300 stores, dual-path internet per store, 3 regional hubs, isolated payment segment
- Engagement
- Design, pilot and national rollout over 12 months
The challenge
Each store relied on a single expensive carrier circuit and a flat in-store network where payment terminals sat with staff laptops and guest Wi-Fi. Outages closed registers, and the payment environment was hard to scope.
A retail chain has the problem of a thousand small networks. Each store needs to be secure, always selling and cheap to run, and nobody there understands routers. Each store relied on a single expensive carrier circuit and a flat in-store network where payment terminals sat with staff laptops and guest Wi-Fi. Outages closed registers, and the payment environment was hard to scope.
The answer is a standard store kit that arrives configured and is managed from one place: a firewall, a managed switch and access points. Each store connects with two paths, a primary wired circuit and a 5G cellular backup, and builds WireGuard tunnels (Noise IK handshake, ChaCha20‑Poly1305 over UDP) to three regional hubs. BGP on BIRD 2 over those tunnels lets the network learn which paths are healthy and route around failures. Inside the store, payment terminals sit alone in their own VLAN with firewall rules that allow only traffic to the payment processor, which keeps the cardholder-data environment small. Staff devices, cameras, back office and guest Wi-Fi are separate again.
The rollout began with a ten-store pilot, then regional waves. A store's firewall was shipped pre-enrolled, plugged in by store staff and configured itself on first contact with the hubs, so the cutover of a store took under an hour outside trading hours and needed no engineer on site. A rollback was a cable swap back to the old router, kept in place for two weeks. Stores near hubs went first so any design issue showed up where support was closest.
Failure testing happened at the pilot stores before the national rollout. We pulled the primary circuit during trading hours and measured the time to a healthy path: the cellular tunnel carried card authorizations within seconds, and register sessions survived. We then took a regional hub offline and watched the stores converge to the next hub through BGP. Payment segmentation was tested by trying to reach the terminals from every other VLAN and from the guest network, and the result was recorded for the assessor.
Because an expensive private carrier network could be replaced with commodity broadband plus encrypted tunnels, circuit spend fell substantially while uptime rose. The payment environment is now small enough to scope and assess clearly, and every store reports health to one dashboard. A circuit outage that used to close registers is now an alert that someone reads the next morning.
What our team delivered
- A standard store kit: firewall, managed switch and access points, with a primary broadband or fiber circuit and a 5G cellular backup
- WireGuard tunnels (Noise IK handshake, ChaCha20-Poly1305 over UDP) from each store to three regional hubs, orchestrated centrally
- Routing between stores and hubs with BGP on BIRD 2, so a failed path or hub is bypassed automatically
- Separate VLANs for payment terminals, point of sale, staff, back office, cameras and guests; the cardholder-data environment limited to the payment VLAN to reduce PCI DSS scope
- Zero-touch deployment: a store firewall is shipped, plugged in and configures itself
- Central monitoring and logging of every store
Result
Store connectivity that survives the loss of a circuit without anyone noticing, a payment environment small enough to scope and assess clearly, and lower monthly circuit costs than the private carrier network it replaced. In the modeled rollout, a pilot of 12 stores ran for eight weeks before the national wave, then roughly 25 stores a week were cut over with the old carrier circuit kept until each store had held a clean week. Stores failed over between the two paths in seconds, a regional hub could be lost without store impact, and the payment segment was documented as a small, separately assessed scope.
One overlay over three very different links
The SD-WAN overlay runs over MPLS, business broadband and LTE or 5G at once. Probes measure latency, jitter and loss on every path, and each application follows its own policy: when the MPLS path degrades, voice moves to the healthier link in moments while backups stay on the cheap one.
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
Failover in under a second
ISP A fails at 300 ms. BFD (RFC 5880) with a 50 ms interval and multiplier 3 declares the session down 150 ms later, BGP withdraws the routes, and the forwarding table repoints to ISP B. Traffic is back at full rate in well under a second; without BFD the router would wait for the 90 s BGP hold timer. Illustrative figures.
Licences: from rented to owned
Yearly software licence and subscription cost for a 250‑seat organisation, by category, before and after moving to open-source and self-hosted software. What remains after is paid support and hosting. Illustrative figures in US dollars.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.