SD-WAN Transformation Across 192 Sites

A rail operator’s wide-area network had reached the point where the cost of keeping it running was outweighing what it delivered. The estate ran on legacy MPLS across 192 sites — stations, depots and administrative offices — and it was expensive to maintain and inflexible in the face of modern operational demands.

The programme migrated the whole estate to SD-WAN over 18 months, and handed it to the internal team fully able to run it.

Assessing what was already there

MPLS had served the organisation well, but 192 geographically dispersed sites meant significant complexity and very little consolidated knowledge of it. I led an assessment of the existing infrastructure, documenting circuit types, bandwidth requirements and dependencies at every location, so the scale of the migration was understood before anything was committed to.

Designing the target architecture

Working with network architects and the selected SD-WAN supplier, I helped define an architecture built for resilience, central management and cost efficiency. Three decisions shaped it:

• Dual-circuit resilience — critical sites were provisioned with two WAN links so failover was real rather than theoretical.
• Centralised orchestration — policy managed in one place, removing site-by-site configuration and making future changes fast.
• Integrated security — embedded security features replaced standalone firewall appliances at many sites, simplifying the architecture and taking hardware cost out.

Holding the suppliers together

A programme this size runs across several suppliers at once: the SD-WAN platform vendor, circuit providers, hardware logistics partners and installation teams. I established a supplier governance model with regular checkpoints, defined escalation paths and shared tracking of site readiness, so that circuit installations, hardware deliveries and engineering visits stayed aligned and dependencies between suppliers were actively managed rather than discovered late.

Rolling out in phases

192 sites cannot be migrated in one movement without accepting more risk than the operation can carry. I designed a phased plan grouping sites by type, criticality and region. Early phases deliberately took lower-risk administrative sites, which let the team refine the installation process and find the common problems before going anywhere near high-criticality operational locations. Each phase had defined entry and exit criteria, rollback procedures and its own stakeholder communications.

Managing the operational risk

In a transportation environment, losing connectivity at the wrong site can affect passenger services, safety systems or revenue operations. That shaped how every cutover was run: out-of-hours migration windows for high-risk sites, real-time monitoring during cutover, and on-site engineering support for the most critical transitions. A dedicated war room ran during major migration waves so that anything going wrong met a response immediately rather than in the morning.

Handing it over properly

A stated objective was that the internal team should be able to support the new environment without ongoing reliance on external resource. I established a structured knowledge transfer programme — hands-on training, documented operational procedures, and a period of shadowed support with internal engineers working alongside the implementation team. By the end of the programme the internal network operations team was running the SD-WAN platform independently.

What changed

Annual network operating costs came down through the removal of expensive MPLS circuits and hardware consolidation. Bandwidth utilisation and application-aware routing improved network performance. Centralised management reduced the time to make a network change from days to hours. And the resilience architecture reduced both the frequency and the impact of outages across the estate.

The lasting point is the last one: the organisation ended up with a modern, cheaper network and the capability to evolve it themselves.