Site-to-Site VPN for Multi-Site Australian Small Business

Many sites, few staff: the very Australian problem

Here's a pattern we see all the time at TYO Store. A business is 'small' on paper — a handful of staff, not much gear — but it's spread across a surprising number of locations.

Think of a franchise or retail chain, a trades business with depots scattered around the state, an allied-health or dental group with several clinics, a real-estate group with branch offices, a hospitality operator with a few venues, or a head office plus a couple of regional and remote sites.

And this is Australia. Those sites might be hundreds or thousands of kilometres apart, sitting on completely different connections, with absolutely no IT person at any of them. You can't run a cable between Perth and Brisbane. So how do you make all those locations behave like one network?

The answer is a site-to-site VPN.

What a site-to-site VPN actually is

Let's clear up a common mix-up, because the word 'VPN' gets used for two very different things.

• A client (remote-access) VPN connects one device — a laptop, a phone — back to the office. The person on the device starts the connection when they need it, and drops it when they're done.
• A site-to-site VPN permanently links whole locations. Every device at every site can reach shared resources as if they were all in the same building.

The key difference: a site-to-site VPN isn't something anyone has to switch on. Once it's up, it stays up. The receptionist at a regional clinic never thinks about it — the printers, phones, booking system and file shares simply work, just like they would at head office.

Under the bonnet it's a set of encrypted IPsec tunnels running over the public internet, so your traffic between sites is private even though it's travelling across whatever connections you've got.

Why a multi-site SMB needs one

Once your sites are stitched together, a lot of everyday headaches quietly disappear:

• A shared file server or NAS at head office, reachable from every branch — one set of files, one source of truth.
• Central booking, POS or inventory systems that every site reads and writes to in real time.
• VoIP phones across all sites — internal extensions, transfers between locations, one phone system.
• Centralised backups, so remote sites back up to head office without anyone lifting a finger.
• Secure access to head-office systems without exposing them to the open internet — staff reach them through the tunnel, not through a port you've had to open to the world.

In short: less duplication, fewer logins, fewer 'how do I get to that file from the Dubbo office' phone calls.

Meraki AutoVPN: the hero for businesses with no on-site IT

Manually building IPsec tunnels between sites is fiddly, and it gets exponentially worse as you add locations. This is where Cisco Meraki AutoVPN genuinely shines.

You put a Meraki MX security appliance at each site, and AutoVPN builds the secure tunnels between them almost automatically from the cloud dashboard. You choose your topology with a few clicks:

• Hub-and-spoke — every branch connects back to head office.
• Full mesh — every site connects directly to every other site.

The part that matters most when you've got no IT staff on the ground? It's zero-touch.

You can pre-configure an MX here, ship it to a remote site, and have a non-technical person plug it into power and the internet. It phones home, downloads its config from the cloud, and joins the VPN automatically. No site visit, no console cable, no walking someone through settings over the phone.

The awkward real-world stuff AutoVPN handles for you

This is where Australian conditions make life hard for manual VPNs — and where AutoVPN earns its keep:

• Dynamic IP addresses. Most NBN services do not include a static IP. With traditional VPNs that's painful, because the addresses keep changing. AutoVPN copes with it natively.
• NAT traversal. It works through the typical carrier and modem setups without you fighting port forwards.
• Self-healing tunnels. If a link drops and comes back — as they do in the real world — the tunnel re-forms itself. Nobody has to reboot anything.

SD-WAN: keeping calls clear and links resilient

The Meraki MX doesn't just build tunnels — it does SD-WAN across them. That means:

• It can use two internet links at a site at once.
• It fails over automatically if one link drops.
• It can prioritise important traffic like VoIP, so calls between sites stay clear even when the connection is busy.

For a business running phones across multiple locations, that traffic prioritisation is the difference between crisp calls and choppy, frustrating ones.

Cellular resilience for regional and remote sites

Fixed-line connections in regional Australia can wobble. A good answer is cellular failover.

Pair an MX with a Meraki MG cellular gateway such as the MG41 (MG41-HW), or use an MX with built-in cellular, so a remote site can fail over to 4G/5G when the fixed line drops out. The tunnel rides over the cellular link until the fixed connection recovers — and staff on site often won't even notice.

For a one-clinic-in-the-country or a depot at the edge of coverage, this is the bit that turns 'mostly works' into 'reliably works'.

Extending the same idea to the cloud

The same approach reaches your cloud servers, too. You can stand up a virtual MX in AWS, Azure or Google Cloud, or run a standard IKEv2 tunnel, so all your sites securely reach cloud-hosted systems through the same network.

One honest budgeting note: the cloud provider charges for its side of the connection, so factor that into your costs. If you're going down the Google Cloud path, our step-by-step Meraki-to-Google-Cloud guide walks through it.

A sensible gear pattern

You don't need the same appliance everywhere. A practical, cost-effective pattern looks like this:

• Smaller branches: an MX67 (MX67-HW) or MX68 (MX68-HW) — plenty for a clinic, shop or depot.
• Busy head-office hub: a higher model like the MX75 (MX75-HW), which carries the load of every branch connecting back.
• All of it managed from one cloud dashboard, so you see every site, every tunnel and every link health status in a single pane of glass.

Being fair: it's not the only way

We supply more than just Meraki, so let's be straight. Other vendors do site-to-site VPN too. Ubiquiti UniFi is the obvious one: its entry-level business gateways support manual IPsec and Site Magic — a zero-config, one-click site-to-site VPN that auto-builds tunnels between UniFi gateways, much like AutoVPN, with no recurring licence. Standard IPsec will also link almost any brands together, so if you've already invested in another ecosystem, there's a path.

Where Meraki still pulls ahead for many-site businesses with little or no on-site IT is the whole package around the VPN: full cloud management, zero-touch provisioning, a mature and proven self-healing AutoVPN, integrated SD-WAN and security, and a real support line behind the licence. UniFi gives you a capable, licence-free auto site-to-site; Meraki wraps it in more hand-holding and polish. There are no silver bullets — Meraki costs what it costs, and the right answer depends on your sites, your budget and how much you want to manage yourself — so it's worth weighing up properly.

For that, see our Meraki-vs-UniFi VPN comparison and our honest total-cost-of-ownership comparison.

Let TYO Store stitch your sites together

If you've got offices, clinics, depots or venues scattered across the state — or the country — and you're tired of treating each one as an island, we can help.

TYO Store designs and rolls out multi-site VPNs for Australian small and medium businesses, and we'll supply the right gear — Meraki or another manufacturer — to suit your sites, your connections and your budget. Pre-configured, shipped ready to plug in, and managed from one dashboard.

Get in touch and let's make your many offices behave like one network.