Skip to content

One Network Design for Three Country Offices

By Bikram Bhujel

Network case study · 2026

One Network Design for Three Country Offices

In 2026 I moved the CIMMYT offices in Nepal, Bangladesh and Turkey off end-of-life Cisco and SonicWall equipment onto the same Fortinet design, so that offices without IT staff on site can all be supported remotely in the same way.

PlatformFortiGate · FortiSwitch · FortiAP · FortiLink
OfficesNepal · Bangladesh · Turkey
PeriodMarch – October 2026
My roleDesign, configuration, cutover, testing and reports
3 officesMoved to one design in 2026, each with its own migration report
1 console per officeFirewall, switches and access points managed together
1 office fully remoteTurkey was delivered from Nepal without travel
01 · Why a standard

Offices without IT staff need to be supportable from anywhere.

Several country offices have no IT staff on site. When each office is built differently, every problem has to be solved differently, and remote support depends on whoever remembers how that office was set up.

All three offices were running equipment that no longer received security updates. Replacing it was the moment to make them the same, so that a fix, a change or a check in one office applies to the others.

This post describes work I did in my role at CIMMYT. The network and equipment belong to CIMMYT; addresses, configurations, device names and the names of colleagues are left out on purpose. All figures come from my own project reports.
02 · The common design

The same building blocks in every office.

FirewallOne FortiGate per office, which also manages the switches and access points over FortiLink.
Switching and Wi-FiFortiSwitch PoE switches and FortiAP access points, powered from the switches and managed from the firewall.
NetworksSeparate staff, guest and camera networks. Guests and cameras cannot reach staff devices, and blocked attempts are logged.
Content securityWeb filtering, DNS filtering and application control on every office firewall.
Wi-FiThe same staff and guest network names in every office, and one access point profile per model with no per-device exceptions.
Guest accessPrinted QR-code signs in several sizes, so the guest password is never handed out by hand.
InternetSD-WAN with health checks, set up so a second provider can be added without a redesign.
03 · Three migrations

Same design, three very different deliveries.

OfficeWhenHow it was deliveredHeadline result
NepalMarch and September 2026On site, in two phases as equipment arrivedWi-Fi median 5.8 → 92.9 Mbps (different test devices)
BangladeshJuly – September 2026Planned and pre-configured in advance, cutover Thursday evening to SundayWired median 92 → 723 Mbps
Turkey28 Sep – 2 Oct 2026Fully remote, guiding an on-site colleague by video call71.8–93.9 Mbps on the same PC, from 24.4

Read the Nepal case study

Read the Bangladesh case study

Read the Turkey case study

04 · Documentation

Every office gets the same report.

Each migration ends with a report built from the same script, so the reports are comparable and nothing is skipped.

  • Executive summary and scope
  • Before and after speed tests, with the number of tests and any reason they are not directly comparable
  • Equipment installed and equipment retired
  • Port map and network design
  • Issues met during the work and how they were handled
  • Open items and recommendations, then sign-off
05 · What comes next

Turning three migrations into a plan for the next one.

Before the next office, I wrote a remote migration plan based on what the three migrations taught. A few settings, such as network numbering and firmware version, still differ between offices; I raised these as decisions to make before the next office rather than copying whichever office came first.

01
Check the physical layer before the design.

In Bangladesh the speed limit came from 100 Mbps switch ports and the wrong cable, not the firewall.

02
Use the same test device before and after.

In Nepal the before and after tests used different devices, which weakened the comparison. The plan now requires the same laptop.

03
Check the provider's router before cutover.

In Turkey the provider's router used the same address range as the firewall's default ports.

04
Assume the remote session will drop.

Short steps, frequent saves and a second call open made the Turkey migration possible.

Comments

Questions and corrections are welcome. I read every comment before it appears, and remove spam and promotional links.