You have just opened a second office and someone has asked how to connect it to the first one. In most Australian SMEs in 2026 the correct answer is that you do not connect them at all. Both sites get their own internet service, both reach the same cloud services independently, and there is no tunnel between them.
A site-to-site link is not a default. It is a specific answer to a specific dependency, and if you cannot name the dependency in one sentence, you do not have one.
The ladder, in order of cost and complexity
There are four honest options and they are not equally likely to be right.
Option one: nothing. Two independent sites, each with its own internet connection, firewall and wireless. Identity, email, files, phones and line-of-business applications are all cloud services that both sites reach over the public internet. Nothing at site B depends on anything at site A.
Option two: a site-to-site VPN. An encrypted tunnel between the two firewalls so that devices at one site can reach devices at the other by IP address. Cheap, well understood, and the source of most of the problems in this article.
Option three: SD-WAN. Software-defined WAN, which in practice means a managed overlay that builds and monitors tunnels automatically across whatever underlying links you have, steers traffic by application, and fails over between links when one degrades. Both major SME platforms include it: Ubiquiti’s Site Magic in UniFi Site Manager automates tunnels between UniFi gateways, and Cisco Meraki’s Auto VPN does the same across the Meraki dashboard, with the application-aware path selection and cellular failover behaviour sitting under the Secure SD-WAN Plus licence edition.
Option four: a carrier-provided private link. A Layer 2 or Layer 3 service bought from a carrier that joins the two sites as if they were one network, with a contractual service level attached. In Australia this generally sits on dedicated fibre, of which nbn Enterprise Ethernet is the wholesale product, delivered over point-to-point fibre with symmetrical speeds. The carrier owns the path and the fault.
When each one is actually justified
Take option one, nothing, unless you can name the dependency. This is right for the large majority of professional services, retail, health and trades businesses opening a second location in 2026, because their entire working set is already in Microsoft 365 or Google Workspace. Two independent sites is not a compromise. It is a more resilient design than a hub and spoke, because a failure at head office does not take the branch offline.
Take option two, site-to-site VPN, when a small number of specific systems live at one site and are needed at the other. A practice management server, a CAD or drawing store, a line-of-business database, a legacy application that has to be on a LAN. The tunnel is justified by named systems and it is sized around those systems, not around everything.
Take option three, SD-WAN, when you have three or more sites, or when the link genuinely matters. The value is not the tunnel, it is not having to build and maintain each tunnel by hand, and having a console that tells you which link is degraded before staff do. If you already run UniFi or Meraki across both sites, you effectively have this available already, so the question is only whether to turn it on. Where SD-WAN earns its keep is failover: two internet services at each site with automatic path selection turns a carrier outage into a slow morning rather than a closed office.
Take option four, a carrier private link, only when you have a real-time dependency with a contractual consequence. Voice or video that must not degrade, a clinical or manufacturing system with a latency requirement, a data replication obligation with a recovery time objective you have committed to in writing. Note that the relevant part of the purchase is the service level rather than the bandwidth. nbn Co lets providers add enhanced service levels to business services, defined across an operational period (the hours during which faults can be worked), a response time, and a rectification time for faults within nbn’s control. That is what you are buying. Bandwidth you can buy anywhere.
Before you price any of this, check what nbn technology serves each address, because the two sites may be on completely different technologies with completely different upload capability, and that alone can settle the design. In the outer east and the Dandenong Ranges in particular, the address determines the option set more than the budget does, which we cover in business internet in the outer east.
The real problem is identity and file access, not the tunnel
Businesses ask how to connect two offices when the question they actually have is how someone at site B logs in and opens a file that someone at site A created. Those are different problems and only one of them is solved by a network.
Identity has to be single, and it does not care where the person is sitting. One directory, one account per person, one set of multi-factor authentication and conditional access rules, applied consistently at both sites. If site B was set up in a hurry with its own local accounts, or its own tenancy, you have created two of everything: two joiner processes, two leaver processes, and one account you will forget to disable. In a Microsoft environment this means Microsoft Entra ID as the single authoritative directory with Conditional Access doing the policy work, and in a Google environment it means single sign-on configured at the Workspace level. Whichever you use, the answer is one directory, not one per building.
File access is where the tunnel gets built for the wrong reason. If both sites work out of SharePoint, OneDrive or Google Drive, there is nothing to connect: both sites reach the same service over the internet and the local cache on each laptop does the rest. If there is a file server at head office, a VPN will make it reachable from the second site and it will be miserable to use, because opening a large file over a WAN link is not the same experience as opening it over a LAN. The correct fix is almost always to move the files to cloud storage, not to buy a bigger tunnel. Do it before you open the second site if you can.
Whichever way the files go, they need to be backed up independently of either site, and you should know where your data actually lives before an audit or a client security questionnaire asks you.
Printing and phones: two small problems with different answers
Printing is not a WAN problem and should never be one. Nobody at site B should print to a printer at site A. Each site has its own printers, and the only thing that needs to be central is the print management and driver deployment, which modern cloud print services and endpoint management handle without any site-to-site connectivity. If your current design routes print jobs across a tunnel, that is a leftover from a print server that should have been retired.
Phones are genuinely easier across sites than within one site. A cloud or hosted phone platform treats both offices as extensions of the same system, with internal extension dialling, shared call queues, a shared receptionist and one set of numbers, and none of it depends on a link between the buildings, because both sites register to the platform independently. This is the single strongest argument for getting off any phone system with physical dependency on a building before you open the second site, and the options are compared in choosing a business phone system.
What phones do require at each site is a decent upload path and quality of service configured locally. Voice quality problems at a branch are nearly always a local internet or local network issue, not a distance issue.
“The second site feels slow” is almost never the second site
This complaint arrives within a month of opening and it is worth knowing what it usually turns out to be, because the reflex fix (buy more bandwidth) almost never works.
- All internet traffic is being hairpinned through head office. Someone built the tunnel as a default route so the branch would inherit head office’s firewall and filtering. Now every Teams call, every web page and every cloud file request at site B travels to site A and back out, adding latency to everything and limiting the branch to head office’s upload speed. This is the single most common cause.
- DNS is pointing at a server at the other site. Every lookup crosses the tunnel. If the tunnel wobbles, the branch appears to lose the internet entirely even though its own connection is fine.
- A file server at head office is being used as if it were local. See above. Bandwidth does not fix latency and file protocols are latency sensitive.
- Head office’s upload speed is the ceiling. If site A is on an asymmetric service, every branch user is sharing that upload. This is why the head office link, not the branch link, is usually the one that needs upgrading.
- It is not the WAN at all, it is the wireless. Access points placed by eye in a new fit-out, or a single access point covering a floor plate it cannot cover. Test with a laptop on a cable before you blame the link.
Diagnose in that order. The number of times the answer has genuinely been “the branch needs a faster internet service” is much lower than the number of times it was assumed.
Do not build something that needs a network engineer to change
This is the constraint that should shape the whole design, and it is the one that gets ignored because the person building it is comfortable with complexity.
A two-site network in a 40-person business will be modified by whoever is available on the day: a new VLAN for a camera system, a firewall rule for a new application, a subnet change because someone bought a new appliance. If those changes require reading a routing table, the business is now dependent on one person or one provider, and every change becomes a ticket with a lead time.
Three rules keep it maintainable:
- Use non-overlapping, obvious IP addressing from the start. Site A on one clearly numbered range, site B on another, with room to add site C. Two sites that both use 192.168.1.0/24 cannot be joined without renumbering one of them, and renumbering a live site is a weekend nobody enjoys.
- Keep both sites on the same platform and the same management console. Whatever you pick, pick one, so that a change looks the same at both sites. This is a real argument in the platform you choose for each site, and it is why the automated overlay options are worth more than their feature lists suggest: they generate the tunnel configuration rather than asking a human to.
- Write it down. The addressing plan, the tunnel endpoints, the firewall rules and why each one exists, the circuit IDs and carrier account numbers for both sites. If it is not written down where the next person can find it, the design is only as durable as one person’s memory.
The direction this is all heading, and why it argues for doing less
The reason “connect nothing” is a defensible answer in 2026 and would not have been ten years ago is that the security model has moved. Access decisions are increasingly made on identity, device compliance and context rather than on which network a device is plugged into, which is the premise behind SASE and zero trust network access as a replacement for the VPN. In that model, a tunnel between two buildings buys you very little, because being on the network is no longer what grants access to anything.
Practically, that means the money is better spent on identity and endpoint security than on the link. A second site with strong conditional access, managed devices and cloud file storage is more secure and easier to run than two sites joined by a flat tunnel, where a compromise at the branch reaches head office because the firewall between them was configured to allow everything.
A short decision path
Ask these in order. Stop at the first yes.
- Is there a system at one site that people at the other site must reach directly by IP? If no, connect nothing. Give each site its own internet service and its own firewall, and finish.
- Is it one or two named systems? Build a site-to-site VPN scoped to those systems only, not a default route, and plan to retire it when the systems move to cloud.
- Do you have three or more sites, or does an outage at either site cost real money? Use the SD-WAN capability you already own in your network platform, with a second internet service at each site for failover.
- Do you have a real-time dependency with a written recovery obligation? Buy a carrier private link with enhanced service levels, and buy it for the service level.
Most businesses stop at one. Some stop at two. Very few genuinely need four, and the ones that do usually know why.
If you are opening a second site in the next few months, the connectivity order and the identity design are the two things worth getting right before anything is installed, and both have longer lead times than people expect. Call TechAssist on 1300 028 324 or get in touch at https://techassist.au/contact/ and we will map the honest option for your two addresses. If the second site is also a relocation, work through the office move runbook alongside it.
An office move fails on connectivity or it fails on phones. Everything else can be recovered on the Monday. The single decision that determines whether your move is calm or catastrophic is when you place the carrier order, and almost every business places it far too late because it is waiting on a lease that is still with the lawyers.
This is the sequence we run. The week markers below are our planning schedule rather than published vendor lead times, and where a carrier or regulator publishes an actual figure we say so explicitly.
Twelve weeks out: three decisions, one of which cannot wait for the lease
Three things get decided at twelve weeks. Two of them are cheap to change later. One is not.
Decision one, and the urgent one: what connects the new site to the internet. Order this before the lease is signed if you possibly can, on a conditional basis, because carrier delivery is the longest single item on the critical path and it does not care about your moving date.
Start by checking what serves the address. nbn Co’s address checker will tell you whether a premises is ready to connect, whether more work is required, or whether it is not currently available, and the technology serving it. That check is free and takes a minute. If the building is served by a non-nbn network such as Opticomm, the process runs through that operator instead. If you need symmetrical, higher-grade connectivity, nbn Enterprise Ethernet is the wholesale product, delivered over dedicated point-to-point fibre wherever nbn has declared the fixed line footprint ready for service, and where fibre is not already in the building it requires a build.
nbn publishes no build or delivery time for Enterprise Ethernet. Its customer-facing pages say only that it will work with your provider to confirm a committed delivery date. The single delivery figure in nbn’s published material is in the wholesale agreement, in the Service Levels Schedule for the Enterprise Ethernet product module, and it is an operational target that nbn states is non-binding, aspirational and not reported to the retail service provider: nbn aims to provide a Committed Delivery Date within 10 business days of the Order Accepted Notification. That is ten business days to be given a date, not ten business days to be connected.
Once the Committed Delivery Date exists it does carry weight, but the weight falls on the wrong side of the counter. If delivery is late against it, nbn pays rebates to your retail service provider, not to you: for an Ordered Product with a Committed Delivery Date on or after 15 November 2021, 100 per cent of the monthly recurring charge whether delivery runs 5 to 9 business days late or 10 business days or more late. That will not fund a fortnight of not trading.
So treat the timeline as entirely retail service provider dependent, which is exactly why it belongs at week twelve rather than week four. Get the Committed Delivery Date in writing from the retail service provider, with the slip terms, and get it before you commit to a moving weekend.
Two things to specify while you are ordering. First, whether you want enhanced service levels. nbn Co lets providers opt in to enhanced service levels on business plans, and defines them across three components: the operational period (the hours during which faults can be worked), the response time, and the rectification time for faults within nbn’s control. A standard consumer-grade service can be restored on a timeline that would be unacceptable for a business that cannot trade without it. Second, order a backup path at the same time. A 4G or 5G failover service, or a satellite link, ordered on day one costs a fraction of what it costs to arrange in a panic in week eleven. If the address is marginal, read business internet options in the outer east and work out which nbn technology serves the address before you assume anything.
Decision two: whether the phone numbers move with you. If you are still on any service with physical dependency on the old address, the numbers have to port, and porting is the second-longest item on the critical path. More on the mechanics below, but the decision is made now.
Decision three: what the new site’s network will be. Platform choice, switch count, access point count, whether the comms room needs a rack or a wall-mounted cabinet. This drives the cabling design, which drives the electrician and the builder, which is why it has to be settled before anyone touches the walls. The comparison is in which network platform the new site should run.
Ten weeks out: survey the new premises properly
The site survey is not a walk-through. It produces a drawing.
Walk the floor plate with the person who will do the cabling and mark: every desk position and how many outlets each needs, every wireless access point position, every printer, every camera, every door with access control, every screen, and the comms room. Note ceiling type and height, because it determines cable pathway and access point mounting. Note where the building’s lead-in and any existing carrier equipment sits, because your comms room wants to be near it.
In the comms room, confirm three things that get missed: dedicated power circuits with enough outlets, ventilation or cooling adequate for a sealed room in a Melbourne February, and physical security. A cabinet in an open corridor that anyone can walk up to is not a comms room. The detail is in designing the comms room and the cabling standards in structured cabling done properly. Work out the UPS you need now, not when the rack is already full.
Two survey items that consistently get skipped. First, meeting rooms: measure them, decide the AV approach, and specify the table power and cable runs before the joiner builds the table. Retrofitting power to a boardroom table is expensive and ugly. Read meeting room AV before you sign off on room design. Second, wireless: do a real predictive design rather than spacing access points evenly, because plasterboard, glass partitioning and metal racking behave very differently.
Finally, agree the labelling scheme now and put it in your documentation set. Every outlet, every patch panel port, every switch port. Do it once at the front and you never do it again.
Eight weeks out: submit the port, and understand what you have submitted
Number porting in Australia runs under the Local Number Portability Code, C540:2023, registered by the ACMA on 1 June 2023. The code introduced completion timeframes where previous versions had none. For a single number being ported, the ACMA states the code generally requires telcos to complete 80 per cent of ports within 8 business days, 90 per cent within 10 business days, and 98 per cent within 15 business days, with the timeframes varying by the number of services and the complexity of the port.
Read that carefully, because most businesses moving office are not porting a single number.
Simple versus complex is the distinction that matters. A simple port (Category A) is a single standalone number. A complex port (Category C) covers multiple lines, DID number ranges, and ISDN services. The percentile timeframes above apply to single-number ports. Complex ports are project managed manually between nominated contacts at the losing and gaining carriers, with a mutually agreed cutover date, and the code does not set a maximum completion timeframe for them. If your business has a main number with a block of direct dial numbers behind it, you have a complex port, and you should treat the timeline as open ended until the carriers agree a date in writing.
Practical points that prevent rejections:
- The Customer Authority is valid for 90 days from signature. Sign it too early and it expires before the port runs. This is a documented rejection ground.
- Account details must match exactly. The account number with the losing carrier, the account name, and the service address as the losing carrier holds them. A trading name where the carrier holds a company name will fail.
- A losing carrier cannot reject a port because you are still in contract. The ACMA’s guidance to telcos is that they must tell a customer about the costs of changing providers, including contract terms, but that is not a basis to block the transfer. Exit fees may still be payable. The port still proceeds.
- Other valid rejection grounds include the service being disconnected or pending disconnection, a port already pending on that number, the number no longer being with that carrier, and insufficient information supplied.
If you are moving to a cloud phone system anyway, the move is the right moment. Numbers ported to a hosted 3CX system stop being tied to a physical address at all, which removes this problem from every future move. Whoever sells you the voice service takes on obligations under the Telecommunications Consumer Protections Code, C628:2019 as varied in 2022, which is the currently registered version, and the Telecommunications Industry Ombudsman is the external dispute resolution path if it goes wrong. That is covered in what the TCP Code means when your IT provider sells you phones.
Six weeks out: settle the data and server position
Where your data lives determines how hard the weekend is.
If everything is in Microsoft 365 or Google Workspace, and there is no on-premises server, the weekend is easy. People carry laptops to a new building and sign in. Nothing moves. This is the strongest single argument for finishing a cloud migration before a move rather than after it.
If there is an on-premises server, decide now whether it moves or retires. Physically relocating a server is the highest-risk item in the entire move: it has been running for years, it may not survive a power cycle, and its disks do not enjoy being carried down stairs. If it is at end of life, the move is the natural retirement point and the cost of replacing it now is lower than the cost of moving it and replacing it in eighteen months anyway.
Whatever you decide, this is the week you verify that backups you have actually tested restore. Not that they ran. That they restore. Take a full verified backup immediately before anything is unplugged, and keep a copy off site and offline through the entire move.
Also at six weeks: line up the printers. Multifunction devices are usually on a lease with the supplier responsible for relocation, and their calendar is not your calendar. Book the de-install and re-install now, confirm the new IP addressing, and confirm scan-to-email and scan-to-folder settings will be reconfigured, because they always break.
Four weeks out: the sequence that has to hold
By four weeks you should be able to state the following as facts, not hopes:
- The carrier has a confirmed installation date at the new site, and it is at least two weeks before the move, not the Friday of it.
- Cabling is scheduled and the comms room will be ready to accept equipment before the movers arrive.
- The port has a confirmed cutover date and time agreed by both carriers.
- Every asset that is moving is on an accurate asset register, with a destination location.
- Building access is arranged for the weekend, including loading dock booking, lift booking and after-hours security access for both buildings.
If the carrier date is not confirmed at four weeks, escalate now and plan a fallback: a temporary 4G or 5G service and a Starlink terminal will keep a business trading for a few weeks, badly but functionally, and arranging that at four weeks is a decision. At four days it is a crisis.
Two weeks out: bring the new site live before you need it
This is the step that separates a calm move from a bad one. Get the new site’s internet, network and wireless working, tested and signed off two weeks before anyone moves into it.
Install the gateway, switches and access points. Bring the carrier service up and test it under load, not with a single speed test. Configure VLANs, wireless, firewall rules and remote access. Put a laptop and a printer on it and use them. Find the problems in a quiet building with two weeks to fix them, rather than at nine o’clock on a Monday morning with 60 people watching.
For a period you will be running both sites simultaneously, which is a small version of the problem in running two sites at once. Keep it deliberately simple: both sites reach the same cloud services independently, and nothing at the new site depends on the old one.
The weekend, hour by hour
Assume a Friday close and a Monday open. The critical instruction: do not port numbers on the Friday of the move.
The reasoning is in the code text, and it is worth quoting because it sets the window you are working inside. C540:2023 defines Standard Hours of Operation as “8 a.m. to 5 p.m. (Standard Time) on Business Days”, where Standard Time means Australian Eastern Standard Time or Australian Eastern Daylight-Saving Time. That is the window. The Code does not oblige a carrier to port outside those hours, and where a carrier does agree to port outside them, that port normally runs through the complex Cat. C process.
Two more numbers from the same code that shape a move. For a complex port, the minimum lead time for a cutover date within Standard Hours of Operation, measured from the gaining provider receiving a valid Complex Port Confirmation Advice, is 5 business days, and losing carriers must support 85 per cent of gaining provider requests for a cutover date within those hours. Rejections on a complex port also have their own clock: the losing carrier must issue a reject advice for 90 per cent of failed validations within three business days and 99 per cent within five business days. Build that into your schedule, because a rejection you learn about on day five costs you a fortnight.
Now apply it. If a Friday port fails or partially completes at four in the afternoon, the window closes at five, the people at both carriers who can fix it have gone home, and you spend the weekend with numbers that ring nowhere and no way to escalate. Port on a Tuesday or a Wednesday, early in the window, with the old service still live and calls forwarding, and keep the whole week either side clear.
The sequence:
Friday, from midday. Last full verified backup. Users log off and shut down. Label and photograph every cable at the back of every device before anything is unplugged, including the server, the rack and the printers. Confirm the old site’s internet stays live over the weekend.
Friday afternoon. Decommission the old comms room. Rack equipment out, patch leads bagged and labelled, switches boxed. Anything not moving goes into a separate, clearly marked pile for disposal, not into the skip.
Friday evening to Saturday morning. Physical transport. The server, if it is moving, travels separately and carefully, not on a pallet with the desks.
Saturday. Rack and cable the new comms room. Patch and test every desk outlet, port by port, against the labelling scheme. This is slow and it is the reason you did the labelling properly. Bring up the server if there is one and verify services before anyone touches a desk.
Saturday afternoon to Sunday. Deploy desk equipment. Every workstation, monitor, dock and phone placed, connected and powered on. Test each desk with a real login, not a link light. Install and test printers, including scan destinations. Test the meeting rooms with a real call on each platform you use.
Sunday. Full walk-through with a checklist. Wireless coverage tested in every corner, including stairwells and the kitchen. Door access and cameras tested. Alarm tested. Sign off, or list what is outstanding and who is fixing it Monday morning.
The first Monday
Have people on site, physically, from before the first staff member arrives. Not on a phone queue. On the floor.
The Monday problems are predictable: a desk that was patched to the wrong port, a printer that will not scan, someone whose docking station did not come, a meeting room that will not connect, and a wireless dead spot behind a filing cabinet nobody surveyed. All small, all fast to fix, all catastrophic to a business’s confidence if the response is a ticket number.
Run a defect list for the whole first week rather than fixing things ad hoc. Everything gets logged, triaged and closed, and at the end of the week you have a record of what the fit-out got wrong, which is worth having when you talk to the builder.
The old site: decommissioning and make-good, which the landlord will invoice you for
This is the part businesses forget until the invoice arrives, and it is genuinely expensive.
Read your make-good clause before the move, not after it. Commercial leases commonly require the premises to be returned to their original condition, and in practice that means removing what you installed. For IT, that typically covers your data cabling, including cable in ceiling and floor spaces, your comms room fit-out including the rack and any cabinets, wall-mounted screens and their brackets, access control hardware on doors, camera mounts, and any penetrations made through walls, floors or ceilings, which have to be patched and made good. Some landlords require the cabling to be removed. Some require it to be left in place. Some require it to be left and certified. These are opposite obligations and only your lease tells you which one applies.
Budget for it and schedule it. Cable removal after the fit-out contractor has left, in an empty building, with a lift booking, is not a job you want to be arranging in the week the keys are due back.
Terminate the services, in the right order. Cancel the old site’s internet service only after the new site has been stable for a period and after any porting has fully completed. Cancel building access, alarm monitoring and any service tied to the old address. Then check the next invoice, because services keep billing long after they stop being used and nobody notices for months.
Deal with the equipment properly. Anything not moving falls into three categories: redeployed, sold or traded, or disposed of. Every device in the last two categories has data on it, including printers and multifunction devices, which hold scanned documents on internal drives, and cameras and access control controllers, which hold footage and personal information. Disposal without a certificate of data destruction is a Privacy Act problem waiting to become a notifiable data breach. The process is in secure device disposal.
Update the documentation. New addresses, new subnets, new device locations, new circuit IDs, new carrier account numbers. If the documentation still describes the old building in six months, the move is not finished.
If you are planning a move and want the carrier order placed before it is too late, that is the one call worth making early. Call TechAssist on 1300 028 324 or get in touch at https://techassist.au/contact/, and we will tell you what the realistic critical path looks like for your specific address and your specific numbers. If you are also fitting out the new space, start with the fit-out checklist for the new premises.