Global Healthcare Manufacturer Modernizes WAN with Cisco Catalyst SD-WAN
Customer Overview
Our customer is a global healthcare manufacturer specializing in the production and distribution of medical gloves and personal protective equipment (PPE). With approximately 5,000 employees operating across 60 locations worldwide, the organization required a modern, secure, and highly available network to support manufacturing operations, business applications, and an increasingly cloud-first strategy.
Business Challenge
The customer’s legacy WAN was built on Cisco DMVPN with MPLS circuits connecting global manufacturing plants, distribution centers, corporate offices, and data centers. While the solution had served the organization for years, it presented several operational and business challenges.
The MPLS network was costly to maintain and lacked the flexibility required to support a rapidly expanding cloud footprint. Branch-to-branch communication relied on hub-and-spoke routing, introducing unnecessary latency and reducing application performance. Managing the WAN required significant operational effort, and security policies were inconsistent across locations.
The customer sought a modern networking solution that would:
- Eliminate expensive MPLS connectivity in favor of Internet-based transport.
- Improve WAN resiliency with redundant Internet connections at every site.
- Enable secure full-mesh connectivity between all global locations.
- Optimize performance for Microsoft 365, Dynamics 365, Salesforce, and Azure-hosted workloads.
- Strengthen security through integrated firewall services and identity-based access control.
- Simplify network operations through centralized management and policy automation.
The Solution
As the customer’s Managed Services Provider (MSP), our team was responsible for the architecture, implementation, migration, and deployment of a global Cisco Catalyst SD-WAN solution spanning 60 locations.
The legacy DMVPN infrastructure was replaced with Cisco Catalyst SD-WAN (Viptela), creating an intelligent, application-aware WAN built entirely on redundant Internet connectivity. MPLS services were successfully retired, significantly reducing recurring carrier costs while increasing network agility.
Each location was equipped with dual Internet Service Providers (ISPs) to provide resilient connectivity. Cisco Catalyst 4300, 4400, and the latest 8200 Series edge routers were deployed based on site requirements, providing a scalable platform for current and future growth.
The new SD-WAN fabric established secure, encrypted full-mesh connectivity between every site, allowing applications to communicate directly without relying on centralized hub locations. This significantly reduced latency while simplifying the overall WAN architecture.
Intelligent Traffic Engineering
To maximize application performance and user experience, advanced Cisco SD-WAN traffic engineering capabilities were implemented throughout the environment.
Application-Aware Routing (AAR) continuously monitors latency, packet loss, and jitter across all available WAN transports. Traffic was dynamically steered to the optimal path based on real-time network conditions rather than static routing decisions.
Direct Internet Access (DIA) was enabled at each branch, allowing cloud-bound traffic to exit locally instead of traversing the corporate data center. This reduced latency for cloud applications while decreasing unnecessary WAN utilization.
To further improve resiliency, SD-WAN was configured to intelligently reroute traffic through an alternate branch when a direct tunnel between two sites became unavailable, maintaining application availability even during transport failures.
Cloud Connectivity
As part of the customer’s cloud transformation initiative, Cisco Cloud OnRamp technologies were deployed to optimize access to both SaaS applications and Microsoft Azure.
Cloud OnRamp for SaaS continuously evaluated network quality and selected the optimal path to business-critical applications including:
- Microsoft 365
- Microsoft Dynamics 365
- Salesforce
For Azure connectivity, Cisco Cloud OnRamp for Multicloud extended the SD-WAN fabric directly into Microsoft Azure Virtual WAN (vHub) using Cisco Catalyst SD-WAN virtual routers. This architecture provided secure, optimized connectivity between branch offices, Azure-hosted workloads, and on-premises data centers while maintaining centralized policy enforcement.
Security Architecture
Security was integrated into every layer of the solution.
Redundant Cisco Secure Firewalls—including the 1010, 1200, and 2100 Series—were deployed at every branch location, within the data centers, and in Microsoft Azure. This provided consistent security policy enforcement, high availability, and advanced threat protection across the enterprise.
To strengthen identity and access control, a distributed Cisco Identity Services Engine (ISE) deployment was implemented across the global environment.
Cisco ISE provided:
- 802.1X network authentication
- MAC Authentication Bypass (MAB) for non-802.1X capable devices
- Centralized TACACS+ administration for network infrastructure
This identity-driven approach improved network security while simplifying user and device access management across geographically distributed sites.
Business Outcomes
The completed deployment delivered measurable improvements across performance, resiliency, security, and operational efficiency.
Increased WAN Availability
Intelligent path selection combined with dual Internet providers at every location enabled automatic failover based on latency, packet loss, and jitter, improving WAN availability to 99.9%.
Improved Application Performance
Local Internet breakout and Cloud OnRamp technologies reduced latency to cloud applications, improving SaaS performance by 5–10% while lowering application response times.
Reduced Network Latency
Replacing hub-and-spoke routing with secure full-mesh SD-WAN connectivity allowed branches to communicate directly, while local Internet breakout reduced latency by 10–50% depending on application and geographic location.
Lower Operational Costs
The complete removal of MPLS circuits significantly reduced recurring WAN costs while providing greater bandwidth and flexibility through redundant broadband Internet connectivity.
Enhanced Security
Integrated Cisco Secure Firewalls and Cisco ISE delivered consistent security policies, identity-based access control, and centralized management across all global locations.
Simplified Operations
Centralized orchestration through Cisco Catalyst SD-WAN reduced operational complexity by enabling policy-based configuration, automated failover, simplified provisioning, and end-to-end network visibility from a single management platform.
Technologies Deployed
• Cisco Catalyst SD-WAN (Viptela)
• Cisco Catalyst 4300, 4400, and 8200 Series Edge Platforms
• Cisco Cloud OnRamp for SaaS
• Cisco Cloud OnRamp for Multicloud
• Microsoft Azure Virtual WAN (vHub)
• Cisco Secure Firewall 1010, 1200, and 2100 Series
• Cisco Identity Services Engine (ISE)
• Application-Aware Routing (AAR)
• Direct Internet Access (DIA)
• Dual ISP WAN architecture
• Automated SLA-based path selection
• Full-mesh SD-WAN overlay networking
• 802.1X, MAB, and TACACS+ authentication
Conclusion
By replacing a legacy MPLS and DMVPN environment with Cisco Catalyst SD-WAN, the customer transformed its global network into a resilient, cloud-ready, and security-focused platform. The new architecture improved application performance, reduced operating costs, strengthened cybersecurity, and provided the scalability needed to support continued global growth.
Through intelligent traffic engineering, optimized cloud connectivity, integrated security, and centralized management, the organization now operates a modern enterprise WAN capable of supporting mission-critical manufacturing operations and cloud services with confidence.