Multi-site network architecture

A multi-site office architecture meets three simultaneous requirements: service continuity, traffic security and budget control over 5 to 7 years. There are now more than 4 million active companies in France, a growing share of which operate at least 2 physical locations with constant SaaS, ToIP and videoconferencing needs. The bandwidth per office workstation has multiplied several times over in a decade: SaaS, ToIP and videoconferencing needs now bring everyday usage to 5-10 Mbps usable per workstation, compared with 2 Mbps ten years ago.

Legacy MPLS star topologies hit a ceiling against cloud migration (Microsoft 365, hosted ERP), which accounts for a dominant share of outbound traffic on office sites. Our reading diverges here from the operator orthodoxy: routing this traffic through a central MPLS node before exiting to the internet (backhaul architecture) adds 15 to 40 ms of unnecessary latency to each SaaS session and saturates the headquarters link. Local breakout (direct internet access) secured by an NGFW firewall becomes the rule, with MPLS reserved for ToIP and internal application traffic. The GDPR and the French Labour Code also require strict segregation of HR, accounting and guest traffic, supervised via segmented VLANs.

The fibre optic connection runs through a main server room, often on an intermediate floor between R+3 and R+5, then distributes to floor VDI cabinets via OM4 multimode fibre (up to 150 m, 10 Gb/s) or OS2 single-mode fibre (several km, 100 Gb/s+). Compliance with EN 50173 and ISO/IEC 11801 secures the performance measured at acceptance testing.

The Kytom method in 5 milestones over 12 weeks

The Kytom deployment is organised over the standard lead time, structured into five distinct milestones adapted to the scheduling constraints of IT departments.

1. Technical audit (1 to 2 weeks): mapping of application traffic, measurement of actual throughput, inventory of cabinets, switches and Wi-Fi access points.
2. Target architecture design (2 to 3 weeks): choice between operator MPLS, managed SD-WAN or hybrid, sizing of primary and backup links, IP addressing plan, VLAN segmentation.
3. Tender documents and consultation: comparative analysis across at least 3 operator offers, integrators required.
4. Coordinated deployment (5 to 6 weeks): category 6A or 7 cabling, 42U cabinets, active equipment, centralised supervision.
5. Technical acceptance (1 to 2 weeks): failover tests, target inter-site latency measurements below 30 ms, training of internal IT teams.

Kytom’s teams spread across the country ensure an on-site presence within 200 km of each client location, bringing intervention times on critical incidents down to 4 working hours on average. Simultaneous coordination across several regions compresses the scheduling timelines on projects of 8 to 15 sites.

For the IT department: the real hidden cost is the missing audit. Multi-site projects that start without a prior throughput/traffic audit almost systematically suffer post-delivery rework, with an additional cost of 15 to 25 % of the VDI budget. Conversely, an audit costed at 8 to 12 k€ excl. VAT in phase 1 secures the budget through to acceptance. An audit is not an expense: it is insurance against re-cabling during operation.

When this method is not the right one. With fewer than 3 interconnected sites and no critical ToIP, the tender + third-party integrator sequence becomes counterproductive: the engineering overhead (12 to 18 k€ excl. VAT) often exceeds the operator savings, and an IPsec VPN connection operated directly by the internal IT department remains more cost-effective. Likewise, on a fleet of fewer than 30 workstations per site and with no hosted business application, managed SD-WAN delivers no measurable ROI before 36 months: prefer a shared operator fibre with a standard router.