Separating POS and ERP Traffic Across a Multi-Branch Network
What is the first decision in a branch network?
The first decision is not bandwidth but segmentation: tills and POS, payment devices, staff, cameras and guest Wi-Fi belong in separate network segments. As long as a guest device can reach a till at network level, adding capacity solves neither the security nor the stability problem.
A typical five-segment store design
- Payment and POS: may reach only the central application server and the payment provider, not the wider internet.
- Staff / back office: ERP, e-mail, file sharing.
- Devices: handheld terminals, label printers, scales, with limited communication between them.
- Camera / security: continuously high load, isolated from other segments.
- Guest: internet only, no access to the internal network, with a bandwidth ceiling.
Permissions between segments follow a default-deny principle, and the rule list should state explicitly which segment may reach which destination on which port.
Prioritisation protects the critical transaction
If the link is saturated and a till transaction is waiting, sales stop. Give priority to payment authorisation and POS synchronisation traffic, and leave backups, update downloads and camera streams at low priority. The most common mistake is letting updates download automatically during business hours, filling the store link exactly when it is busiest.
Is the backup link really a backup?
If both links use the same physical infrastructure or the same provider backbone, a single outage takes down both. A backup link should come from a different carrier or a different access technology, for example fibre plus mobile. It should also be exercised for real: shut the primary link down deliberately and check whether a till transaction still completes.
Offline capability is part of network design
If the store application can keep selling when the link drops, an outage is a disruption; if it cannot, it is a stoppage. Network design and application design therefore belong together: a local cache, an offline queue and conflict-free synchronisation when the link returns. The application side of this is covered in our [retail POS guide](/en/blog/retail-pos-guide).
Three values worth measuring
- Round-trip latency to the central application server, measured from inside the store rather than from the provider dashboard
- Link utilisation at peak hour
- Number of outages and mean outage duration per month
Without these three, a "the network is slow" complaint cannot be separated from an "the application is slow" complaint.
Frequently asked questions
VPN or SD-WAN between stores?
With few branches and traffic going to a single centre, point-to-point VPN is enough. As branch count grows and traffic splits between the data centre and cloud services, a structure that can choose the path per application reduces management effort.
Why should camera traffic be kept separate?
Camera streams are continuous and high volume, and they crowd out other traffic in a shared segment. Security updates for camera devices are also often delayed, which makes isolation necessary in its own right.
What should be logged on guest Wi-Fi?
Providing public internet access carries record-keeping and retention obligations that vary with the nature of the service. Rely on the current text of the relevant regulation and your legal adviser.