How to Plan Fiber Connectivity Across Multiple Enterprise Locations

01 / Understand the estate

List the locations—and where their traffic goes

Identify offices, data centers, cloud connections and other sites. For each location, record the address and space, business owner, important applications, expected growth, existing providers, contract dates and building access contacts. Include remote dependencies: a branch may need both Internet access and a private path to a central data center.

Draw the actual connections instead of assuming all traffic takes the same path. An employee’s cloud application may use local Internet access, while backup replication travels over a private Ethernet service. A diagram should identify where security devices, service handoffs and encryption endpoints sit.

Ask what happens if a site, application or connection is unavailable. The acceptable interruption and essential services may differ between a small office and a facility supporting several locations. ^[1]

02 / Build the worksheet

Compare sites on the same terms

The following example is illustrative. Capacities, sites and recovery priorities are fictional, not service recommendations or a depiction of a customer’s network.

For each actual location, add the current and proposed services; provider and underlying access operator where known; handoff; peak and fallback capacity; availability and restoration terms; installation dependencies; target date; named owners; and unresolved risks. Mark unknowns as unverified rather than treating a missing route detail as evidence of independence.

03 / Select the connections

Match each service to the job

Dedicated Internet provides Internet access with service characteristics defined by the agreement. It can connect a site to public cloud applications and other Internet destinations. Confirm where the committed capacity and service-level agreement (SLA) apply; they do not control every network or application beyond the provider’s boundary.

Private Ethernet, such as Stealth’s Transparent LAN Service, connects agreed customer handoffs between locations. It is useful when sites need a private Ethernet connection and the customer wants the provider to operate the transport. Internet access is a separate requirement. Explore Transparent LAN Service.

Dark Fiber provides dedicated, unlit fiber strands that the customer equips and operates. It can suit organizations that want control over transmission equipment and how the fiber is used; the customer must plan optics, operations and compatible security. Explore Dark Fiber.

Cloud connectivity should be specified by the actual provider, location, handoff and access model. A private connection to one network is not automatically private access to every cloud resource. Confirm how the cloud service is reached and where responsibility changes hands. Explore Cloud Connect.

These services can be combined. A connection’s dedicated capacity or private path does not automatically encrypt the data it carries; the customer’s security requirements determine what additional protection is needed. See where your data is encrypted and how to connect two offices. ^{[2] [3]}

04 / Size each path

Measure busy periods and the backup case

Use measured upload and download traffic where available. Examine peak intervals, recurring jobs, expected growth and simultaneous workloads—not just monthly averages or employee counts. Record which flows traverse each path so the same traffic is not counted twice, and distinguish bandwidth, the capacity of a connection, from throughput, the useful data actually transferred.

Build the normal and failure cases separately. If one circuit fails, where will traffic go, and what share of that traffic must still fit? A backup does not always need to support everything; agree which applications take priority and which work can wait. The bandwidth planning guide provides a starting point.

Check the whole path: Ethernet interfaces, optics, firewall performance with inspection and encryption enabled, storage systems, application behavior and the receiving site. Measure a representative transfer before relying on a deadline. For large datasets, consider the transfer in both normal operation and the remaining-capacity scenario after a failure.

05 / Understand shared risk

Two circuits need more than two labels

Separate circuits, providers or optical wavelengths do not prove separate physical routes. Trace the access from each handoff through the equipment room, riser, building entrance, conduit, cable and relevant provider facilities. Ask where services share equipment, power or an upstream location. A single cut or shared power failure can affect more than one circuit. CISA’s resiliency guidance illustrates why separate access paths and equipment dependencies matter. ^[4]

Request a scoped engineering review for the failures that matter. Providers may not know another company’s exact facilities or may restrict detailed route disclosure; agree what can be verified and record what remains unknown. A shared risk link group (SRLG) is a planning term for links that can fail together because they share a resource. ^[5]

For every site that needs a backup, document what detects failure, where traffic moves, which applications must survive and the capacity available afterward. A route can remain physically up while a remote destination is unreachable. Automatic failover and separate fiber paths are useful only if the design is tested against the failures it is intended to handle. See how to assess shared paths and Internet redundancy.

06 / Routing between paths

Where does SD-WAN fit?

A software-defined wide area network (SD-WAN) uses software and centrally managed policies to help route traffic across connections between sites or services. The physical and provider connections underneath it are often called the underlay; the logical network built over them is the overlay.

Depending on the platform and configuration, SD-WAN can monitor paths, apply application policies and move traffic when a path fails or degrades. The exact detection method, thresholds and recovery behavior require design and testing. Cisco describes one platform’s use of monitoring to detect reachability problems and adjust routes. ^[6]

SD-WAN does not create an independent second route or extra capacity by itself. It cannot eliminate shared physical risks, and an application session may still pause or reconnect during a change. Confirm security, encryption, management, licensing and who operates the system. The example describes a technology choice, not a claim that Stealth supplies a managed SD-WAN service.

A closer look / Data center connections

EVPN over dark fiber and SD-WAN: how do they compare?

Ethernet Virtual Private Network (EVPN) uses Border Gateway Protocol (BGP) to help switches and routers share information about how to reach network segments across locations. One common design uses Virtual Extensible LAN (VXLAN) to carry that traffic over an Internet Protocol (IP) network. EVPN can also use other transport technologies, so EVPN does not always mean VXLAN. ^[7]

With dark fiber, an enterprise supplies and operates the optical equipment at each end. A suitably engineered EVPN design can connect data centers over a dedicated fiber path with high capacity and low, consistent latency—useful for storage replication, large data transfers and moving virtual workloads. Actual performance depends on the fiber route, optics, equipment, configuration and workload.

These are different choices at different layers. Dark fiber is the physical medium; EVPN organizes connectivity; and SD-WAN applies traffic policies across available connections. An enterprise can use EVPN and SD-WAN in the same overall network. SD-WAN can also use a private fiber connection as an underlying path.

A capable switch may forward VXLAN traffic in specialized hardware at or near its port rate, but that is not a universal promise of zero overhead or loss. Similarly, SD-WAN is not limited to a few Gbps. As one vendor example, Cisco lists up to 100 Gbps of SD-WAN Internet Protocol Security (IPsec) throughput for a specific Catalyst 8500 model using an Internet mix of packet sizes under its stated test conditions. This is a vendor specification, not a Stealth measurement or a per-tunnel guarantee. ^[9]

What does distance add?

VXLAN also adds headers: a common example adds about 50 bytes with an outer IPv4 Ethernet header and about 70 bytes with IPv6, before optional tags or other encapsulation. Check the maximum transmission unit (MTU)—the packet size supported along the entire path—and account for additional security headers where used. ^[8]

For a fair evaluation, measure the same endpoints and direction, route length, load, packet sizes, encryption and inspection settings. Record throughput, latency, jitter and loss, then test the backup and the actual application. Neither a dedicated path nor an EVPN label alone guarantees a particular result. See where your data is encrypted for more on encryption boundaries.

07 / From proposal to rollout

Sequence the work by site and dependency

1. Qualify each address. Confirm the exact location, space and desired handoff. Ask whether the building is already connected to the provider or requires a different access arrangement.
2. Identify who delivers each segment. Ask whether the provider owns and operates the access infrastructure or uses another carrier. Document the provider’s responsibilities for the site, including escalation and any different terms for third-party access. Do not assume that a provider’s network map confirms a specific building’s eligibility.
3. Resolve building and construction dependencies. Identify landlord permissions, equipment-room access, risers, cross-connects, surveys and any permits or construction. Ask which steps can proceed in parallel and what requires separate approval.
4. Plan the equipment and change window. Confirm handoff location, port speed, media and optics, addressing, routing, security, power and the customer team’s readiness. Coordinate maintenance, migration and rollback. The router and firewall handoff guide has a checklist.
5. Stage the rollout. Prioritize business-critical sites, account for interdependent applications and provider lead times, and agree on a fallback if one location is delayed. Do not assume every site will be delivered on the same schedule.

For Stealth, availability, scope and delivery timing are determined for the actual location and service. Nearby building orders are subject to address verification and a site survey; special construction or changes to displayed prices or terms require separate customer approval. See how to check fiber availability.

08 / Acceptance and operation

Test the connection your applications will use

Agree on test endpoints, methods, timing and success criteria before activation. Record interface state and errors; addressing and routes; upload and download throughput; latency and packet loss where relevant; and representative application behavior. A speed test from one device does not establish the capacity or health of every path. Coordinate high-volume tests so they do not disrupt production.

Test backup behavior in a controlled window with a rollback plan. Include a local circuit failure and, where feasible, a reachable link with a failed upstream service. Measure detection, switchover and application recovery separately; ask whether existing sessions reconnect. Check security policies and the backup’s capacity under the expected load. NIST recommends testing contingency procedures and updating plans based on the results. ^[1]

Keep the circuit identifiers, handoff details, support and escalation contacts, ownership boundaries, test results and unresolved issues in an accessible operations record. Schedule repeat tests and update the record after a material network change.

09 / Take this to a provider

Questions for your network and facilities teams

• Which applications and locations are in scope, and which services must keep working during a failure?
• Where do Internet, cloud and site-to-site connections start and end? Which parts are dedicated?
• Which access segments do you own and operate, and which depend on another carrier or building operator?
• Which routes, entrances, risers, facilities, devices and power sources are separate? What cannot be verified?
• What capacity is available normally and after a failure? How and where is it measured?
• What are the handoff, optics, frame-size, routing and encryption requirements?
• What does each SLA cover, exclude and provide as a remedy? Who opens tickets and coordinates repairs?
• What survey, permissions, construction, costs and approvals are needed at each address?
• What are the dependencies and realistic delivery dates for each site?
• How will we test failover, application recovery and rollback, and who will maintain the records?

Use the same questions with each provider and compare the answers for the same location and failure scenario. Follow the details into the written proposal and agreement. For more on measurement, exclusions and remedies, read Understanding your Internet SLA. For the engineering and field work behind an outage, see The Reality of Uptime.

Reference

Terms to know

• Dedicated Internet: Internet access with dedicated service characteristics defined at the agreed boundary.
• Dark Fiber: Unlit fiber supplied for a customer to equip and operate.
• EVPN: Ethernet Virtual Private Network, a way for network devices to exchange information for Ethernet and IP connectivity.
• Handoff: The agreed point where a provider’s service connects to the customer’s equipment or infrastructure.
• MACsec: Media Access Control Security, a standard that can protect Ethernet traffic between compatible peers.
• MTU: Maximum transmission unit, the largest IP packet an interface is configured to transmit without fragmentation.
• On-net: A location connected to a provider’s network; the provider should confirm the exact address and service eligibility.
• SD-WAN: Software-defined wide area network, a policy-driven way to manage traffic across network connections.
• SLA: Service-level agreement, which defines covered commitments, measurement rules and remedies.
• SRLG: Shared risk link group, links that can be affected by the failure of a shared resource.
• Throughput: The rate at which useful data is transferred, which may be lower than the connection’s capacity.
• Type 2 access: Access supplied by another carrier as part of a provider’s service; confirm the actual arrangement and support responsibilities.
• VXLAN: Virtual Extensible LAN, a way to carry Ethernet traffic over an IP network.