Network & Security Support · Case study
Firewall and SD-WAN Edge Rollout for 12 Branch Offices in Italy and Spain.
A representative walkthrough of rolling one firewall policy and SD-WAN edge out to branches in four cities.
Representative scenario. Last reviewed October 2026.
Engagement profile
- Customer
- Professional services firm standardizing branch security on one vendor platform
- Scale
- 12 branch offices, about 450 endpoints
- Service
- Network & Security Support
- Where
- ItalySpain
Representative scenario. This case study shows how Deploris scopes and delivers this kind of work. It does not describe a real client, and no results are claimed. Want a plan like this for your own sites? Request a quote.
Quick answer
What does this engagement look like?
A firewall and SD-WAN edge rollout replaces branch security and WAN devices with one standard policy. In this scenario, Deploris coordinates local field engineers in Milan, Rome, Madrid and Barcelona to stage appliances, install them in agreed windows, apply the customer's approved templates, and validate every site. The customer receives configured devices, test results, as-built documentation and change records for each branch.
THE CHALLENGE
The challenge.
The customer's branches had grown through local decisions. Each office ran a different firewall model or a router with basic filtering, and rule sets had been edited by hand over several years. Some sites reached the internet through a single broadband line, others through a leased circuit with a backup LTE modem. The security team wanted one policy applied the same way everywhere, and the network team wanted SD-WAN edges that steer traffic between two uplinks at every site.
The hard part is not the configuration, which the customer's architects had already drafted as templates. It is executing the same design in four cities with different building rules, different carrier lead times, and offices that cannot lose connectivity during working hours. A firewall swap that goes wrong leaves a branch with no internet and no way to reach central applications, so every site needs a tested rollback, a person on site who can follow it, and a record of exactly what changed.
Constraints the plan had to respect
- Cutovers had to happen outside office hours, so evening and weekend windows had to be agreed with each building manager in advance, and in Italy and Spain overnight work is planned early because local working-time norms apply to the engineers and to site contacts.
- Office buildings in all four cities restrict after-hours access, so every engineer needed to be on an access list with a named contact, and equipment deliveries had to fit loading and ZTL or city-center vehicle restrictions in Milan and Rome.
- Firewall configurations and logs can contain personal data such as usernames and IP addresses, so backups and test captures had to stay in the customer's own repository under EU data protection expectations, handled by confidentiality-bound engineers.
- The customer wanted a single approved template with per-site variables only, so no engineer could improvise rules on site, and any deviation had to go back to the customer's change process first.
- New carrier circuits had different lead times by city, so the plan could not assume every site would have its second uplink on the install date.
HOW THE WORK RUNS
How the work is run.
- 1
Scope the sites and freeze the template
The engagement manager walks the customer's design with the network and security leads and writes the scope before any work starts. For each branch the site sheet records the current device, uplinks and handoff type, rack or wall mount, power outlets and plug type, LAN subnets, VLAN IDs, and the building contact. The firewall template and SD-WAN edge template are frozen as versioned files with per-site variables for hostname, WAN addressing and LAN ranges. Pilot sites are chosen first: one Italian and one Spanish branch.
- 2
Stage and pre-configure in the EU
Appliances ship to a staging location inside the EU, which avoids customs clearance on the Italy to Spain leg. Engineers upgrade firmware to the customer's target release, apply the template with the site variables, register each unit with the central management platform, and bench-test it with a loopback and a test client. Serial numbers, MAC addresses and asset tags are recorded, and each unit is boxed with the correct regional power cord, a labeled console cable, and a printed one page runbook in English plus Italian or Spanish.
- 3
Pilot cutover and rule-base review
The two pilot branches are cut over first. Before the window, the engineer exports the old device configuration and takes photos of the rack and patching. During the window, the new firewall is placed in line, then the engineer checks DHCP and DNS, internet breakout, the IPsec or SD-WAN overlay to the hub, and key applications. The customer's security lead reviews the loaded rule base and flags shadowed or overly broad rules. Template fixes are made once and applied to the remaining sites.
- 4
Wave rollout by city
Remaining branches are scheduled in waves of two or three sites per city. Each wave starts with a pre-check call covering circuit status, building access confirmation and rollback readiness, with the engineer holding the previous configuration on a console laptop. Install, cutover and validation follow the pilot checklist, including a primary uplink pull test to confirm failover to the second path. Remote hands are available around the clock for anything that needs a second pair of eyes, and the customer's team can watch tunnels and logs live.
- 5
Validate, document and close out
Every site gets the same test set: throughput check with iperf3 against the hub, path traces, tunnel and BFD state, failover timing record, NTP, syslog and SNMP checks into the customer's monitoring, and a spot check of policy hit counters. Engineers update the topology diagrams and port maps, file change records in the customer's ITSM tool, and attach photos. The engagement manager assembles a closeout report per site and a rollup, then confirms the handover to the customer's network operations team.
WHAT WAS PRODUCED
What the engagement delivers.
Each item links to a full guide with its scope, process and FAQs.
WHAT THE CUSTOMER ENDS UP WITH
What the customer ends up with.
- 01Every branch runs the same approved firewall policy, with site differences limited to documented variables.
- 02SD-WAN edges at each site have a recorded primary and secondary path, along with a failover test result for that site.
- 03The customer holds versioned configuration backups, serial numbers and asset tags for every device, stored in its own repository.
- 04Topology diagrams, port maps and rack photos reflect what was installed rather than what was planned.
- 05Change records in the customer's ITSM system describe each cutover, its window, and the rollback that was ready.
WHAT APPLIES TO YOUR PROJECT
Decisions that apply to similar projects.
Pilot in two countries before scheduling the wave plan. Italy and Spain differ in carrier handoffs, building access paperwork and available windows, and a pilot in each exposes those differences while a template fix still costs only one reissue.
Keep the template read-only for engineers on site. Per-site variables, a console backup of the old device, and a written rollback step let a local engineer finish a cutover without making policy decisions at night, and keep rule changes inside the customer's change control.
Treat second-circuit readiness as a separate track. When a carrier line is late, install and validate the firewall on the single uplink, mark the SD-WAN failover test as pending, and revisit it as a short follow-up visit rather than delaying the whole branch.
WHERE IT APPLIES
Metros in this scenario.
Local engineers in each metro, coordinated by one engagement manager. Open a metro to see local details.
QUESTIONS
Frequently asked questions.
How are firewall and SD-WAN rollouts across several countries scheduled?
Who configures the firewall, the customer or Deploris?
What happens if a cutover fails during the window?
More case studies
Other scenarios we have planned.
QUOTE
Plan a project like this.
Share a few details and we will come back with the next steps.
Get started
Need engineers on site? Tell us where.
Tell us the sites, the scope and the timeline. We reply with a written plan.