Branch connectivity with a controlled recovery path
Combine diverse WAN services, restricted branch networks and an explicit surveillance policy for a financial-services location.
Separate transaction and surveillance traffic
Test both transport and tunnel failure
Keep recovery access controlled
How the solution connects
Independent uplinks meet a controlled network boundary. Local access is separated by purpose.
Read the connection map
- Primary branch circuit → Balance 580X · Primary path
- RUTC50 cellular WAN → Balance 580X · Alternate WAN
- Balance 580X → Security + access layer · Policy boundary
- Security + access layer → Branch applications · Separate zone
- Security + access layer → CCTV isolated network · Separate zone
- Security + access layer → Staff wireless · Separate zone
The challenge on the ground
Two ISP contracts can still share a duct, upstream carrier or building power supply. A branch design must identify these shared dependencies and distinguish a failed internet path from a failed tunnel endpoint.
Surveillance uploads and software distribution should not consume the capacity reserved for branch applications during recovery.
Inside the design
Use a Peplink Balance 580X to manage the branch WAN transports and terminate a SpeedFusion tunnel at a properly hosted FusionHub endpoint. Connect a RUTC50 cellular router as an additional Ethernet WAN when required.
Place the institution’s approved security controls at the branch/service boundary; a multi-WAN router is not a substitute for the bank’s security architecture. Keep staff, surveillance, visitors and management isolated through managed switching and explicit policy.
Operating it day to day
Define which applications require tunnel continuity and which may use ordinary internet egress. Size the cloud endpoint and its network capacity for the aggregate branch load, and document its own recovery path.
Agree camera retention, operator access and export procedures separately. Keep administrative access attributable and test the branch while monitoring records actual path changes.
What to test before handover
- Fail each WAN transport independently during an approved test workflow.
- Interrupt the tunnel endpoint and verify the documented recovery action.
- Confirm CCTV and visitor isolation from branch applications.
- Check backup capacity with surveillance uploads limited.
Technical references
The bill of materials
One branch with staff terminals, meeting rooms and an existing camera system. Availability targets determine whether paired edge devices are needed. Quantities below describe the example; your proposal confirms the final equipment and services.
Peplink FusionHub 100
FHB-100-AVirtual tunnel endpoint
Requires a supported host, public connectivity and an appropriate licence tier.
View product
Complete the installation
The equipment above is one part of the project. Include these items in the final scope.
- Institution-approved firewall/security services
- FusionHub hosting and Peplink entitlements
- Carrier services and UPS
- Camera system and retention storage
Questions before you specify
Are two circuits sufficient for branch resilience?
Only if the complete service path is designed for the required recovery. Check carrier routing, power, edge hardware, tunnel endpoints and application dependencies.
Let’s design it for your site.
Send us the details below. We can turn the reference architecture into a scoped design, equipment schedule and quotation.
Start your projectBring these to the first conversation
- 01Application/tunnel requirements
- 02Carrier route diversity
- 03Institution security standards
- 04Camera retention and recovery objectives
