A multi-site converged network for a biochemical manufacturer and its affiliated operations, designed under Michael Young Technologies: a headquarters data center, an affiliated business and a plant site, joined over an encrypted wide area network.
The encrypted path is the network
Site-to-site tunnels carried AES-256, with the default route pointed at the tunnel interface and a static route holding the tunnel endpoint. That arrangement is the point rather than a detail. The encrypted path is the network, not an overlay bolted on beside it — there is no unencrypted path to fall back to, and no route that quietly prefers one.
Around it: OSPF running multi-area across the estate, voice and data separated into their own VLANs with Call Manager Express handling telephony on site, management carried on its own segment, and a remote access pool for users off the estate.
Reliability the circuits were not going to provide
The interesting constraint was the access. This was consumer-grade DSL, not carrier Ethernet — no service level agreement worth invoking, no committed rate, no meaningful repair commitment.
A small manufacturer does not get to buy its way out of that, so the design had to earn its reliability somewhere else: from the encryption, the routing and the failover behavior rather than from the link. That inverts the usual order of work. On a carrier estate the circuit is the dependable part and the configuration is where the risk lives. Here it was the other way around, and the design had to assume the transport would fail regularly and be uninteresting when it did.
Outcome
A converged voice and data estate whose resilience was engineered rather than purchased.