A site-to-site VPN can connect branch offices over the internet while encrypting traffic between network gateways. It is useful when staff at different locations need access to shared applications, but the design should account for internet reliability, addressing, routing, authentication and ongoing monitoring.
Check the use case and topology
List the subnets at each site and the services that need to communicate. Overlapping IP ranges can complicate routing, so address planning should happen before deployment. Decide whether all traffic should pass through a central site or whether each branch should access the internet locally.
Select suitable gateways and encryption
Confirm that both gateways support compatible VPN protocols, encryption settings and key management. Estimate expected throughput with encryption enabled, not only raw routing throughput. Protect administrative access and store configuration details securely.
Plan for outages and troubleshooting
Document how tunnels are monitored, how keys or certificates are renewed and who responds to failures. A VPN cannot fix an unavailable local internet connection, and failover behaviour should be tested. Compare routers and gateways against the number of sites, throughput and security requirements.
