Environment
Control centers, regional offices, substations, cloud, data centers, and field operations.
Contact UsEuropean Utility Case Study
From MPLS constraints to a quantum-safe, 100Gbps network fabric.
An anonymized European utility replaced carrier-defined network constraints with identity-bound security, adaptive transport, and an ISP-agnostic 100Gbps core network backbone.
Deployment profile
Critical infrastructure across Europe.
Transport
Diverse approved underlays beneath one governed software-defined fabric.
Security
Cryptographic identity, machine validation, and least-privilege segmentation.
Case study
Executive summary
A European utility operator depended on a legacy MPLS estate to connect control centers, regional offices, substations, cloud workloads, data centers, and field operations. The network offered predictable private connectivity, but its fixed carrier architecture had become a constraint. Provisioning new capacity took too long, international routes often followed inefficient carrier paths, bandwidth upgrades were expensive, and security policy varied across a growing mix of sites and environments.
The operator designed a migration to the 21Packets Quantum-Safe SASE Network Fabric: a software-defined, ISP-agnostic network architecture built to preserve protected service relationships across changing transport conditions. Instead of treating a carrier circuit as the network, the organization used diverse internet, private, cloud, and approved edge connections as underlay transport beneath a governed fabric.
The deployment centered on three objectives:
- Improve application performance globally by continuously evaluating available paths instead of accepting static carrier routing.
- Apply Zero Trust controls consistently through cryptographic node identity, machine validation, least-privilege policy, and identity-centric segmentation.
- Migrate high-capacity locations to a 100Gbps-capable, ISP-agnostic architecture without tying the operating model to one carrier, proprietary appliance family, or fixed physical topology.
Case study
The client
The customer is an anonymized European critical infrastructure utility with operations distributed across multiple locations. Its environment includes:
- Primary and secondary control centers
- Regional operations facilities
- Substations and remote industrial sites
- Corporate offices and engineering teams
- Public-cloud and private-cloud workloads
- Central and regional data centers
- Third-party maintenance and technology partners
- Field users connecting through varied access networks
Availability and security were inseparable requirements. A network interruption could affect operational visibility, engineering coordination, maintenance workflows, and access to systems supporting grid reliability. At the same time, the organization needed to reduce the exposure created by broad network trust and prepare long-lived infrastructure for post-quantum security requirements.
Case study
The challenge: MPLS delivered private circuits, not an adaptive operating model
The utility’s MPLS network had been built for a more centralized era. Sites connected to a limited number of data centers, applications lived in predictable locations, and carrier-managed routing was accepted as the price of dependable wide-area connectivity.
That model became less effective as the operating environment changed.
Static paths increased distance and delay
Traffic between a regional site and a cloud workload could be backhauled through a distant provider location or data center even when a healthier, shorter path was available. The utility could monitor the application impact, but it had limited control over the carrier’s route selection inside the MPLS service.
For latency-sensitive operational workflows, the issue was not only average latency. Congestion, jitter, packet loss, and route changes created inconsistent performance. A path could remain technically “up” while application experience deteriorated.
Capacity was bound to carrier timelines
Bandwidth upgrades required coordination with specific providers, commercial changes, new circuit delivery, and—in some locations—specialized edge hardware. This slowed site expansion and made rapid capacity changes difficult.
The planned move toward 100Gbps connectivity exposed the limitation clearly: the organization did not want its next generation of high-capacity networking to recreate the same dependence at a larger scale.
Security inherited the network’s physical assumptions
MPLS separated traffic from the public internet, but private transport alone did not establish Zero Trust. Access decisions still relied heavily on network location, address ranges, and manually maintained segmentation. Once a system gained broad network reachability, limiting lateral movement required additional controls that were difficult to operate consistently across branches, industrial sites, clouds, and partner environments.
Resilience required more than a backup circuit
Secondary links existed at priority sites, but failover behavior depended on local appliances, routing timers, carrier conditions, and the health of the backup path. A backup circuit did not guarantee an optimal path, consistent policy, or preservation of the active service relationship during degradation.
Case study
The decision: separate the network fabric from the underlying carrier
The utility selected a software-defined architecture based on a simple principle: the transport provider should supply reachability, but it should not define the security, routing intelligence, or operating model of the network.
21Packets provided a governed network fabric above approved underlay connections. Software Endlets could be deployed across virtual machines, containers, Kubernetes environments, bare metal, cloud infrastructure, and approved edge hardware. This allowed the client to place fabric participation close to applications, users, control environments, and data without requiring a proprietary appliance at every location.
The architecture combined:
- Route Ledger for authoritative path and policy context
- Slip-Routing to evaluate latency, jitter, packet loss, congestion, and transport health across available paths
- DEFT to transition protected traffic while preserving the logical service relationship
- NOAN optimization to support path selection and adaptation
- Cryptographic Endlet identity for identity-bound participation
- Machine-validated state and Zero Trust admission before an Endlet joined the fabric
- Granular microsegmentation to enforce least-privilege connectivity independent of physical location
- Crypto-agile, post-quantum protection across fabric identity, control, policy, session, and transport functions
- WanAware and Endlet telemetry for performance, availability, security, and asset context
Case study
Architecture contrast: legacy MPLS vs. 21Packets
| Requirement | Legacy MPLS approach | 21Packets software-defined approach |
|---|---|---|
| Network boundary | Defined primarily by carrier circuits and routed locations | Defined by cryptographic identity, policy, and admitted software endpoints |
| Path selection | Predominantly carrier-controlled and route-based | Continuously informed by latency, jitter, loss, congestion, health, and policy |
| Failure response | Circuit failover and routing convergence | Transition across healthy, policy-approved paths while preserving protected service relationships |
| Capacity model | Ordered per circuit and provider | Uses approved internet, private, cloud, and edge transport beneath the fabric |
| Site hardware | Often tied to carrier or appliance architecture | Endlets deploy across approved commodity compute and varied runtime environments |
| Segmentation | Network-centric zones, VLANs, ACLs, and physical topology | Identity-centric, least-privilege policy and granular microsegmentation |
| Cloud connectivity | Frequently backhauled or added through separate services | Fabric participation can be placed directly near cloud workloads and services |
| Cryptographic posture | Encryption layered onto private transport, often with long hardware cycles | Crypto-agile post-quantum model across fabric functions |
| Provider dependence | Architecture and changes constrained by the MPLS carrier | ISP-agnostic underlay abstraction with policy-approved provider diversity |
| High-capacity expansion | New carrier service and hardware cycle | 100Gbps-capable design at approved core and high-throughput locations, subject to deployment validation |
Migration sequence
The deployment
Phase 1: map applications, dependencies, and policy
Before migration, the team documented priority applications, service dependencies, existing carrier paths, failure domains, access rules, and lateral reachability. This discovery prevented the project from being reduced to a raw bandwidth upgrade. It established which service relationships had to remain available, which paths could be diversified, and where identity-bound policy should replace network-location trust.
Phase 2: deploy Endlets beside existing infrastructure
The team introduced 21Packets Endlets at selected data centers, cloud environments, operational hubs, and pilot sites. MPLS remained active during the pilot, allowing the organization to compare paths and move workloads in controlled stages.
Initial policies limited the fabric to approved application flows. Each participating Endlet had to establish cryptographic identity and satisfy authorization and machine-validation requirements before admission.
Phase 3: implement Zero Trust segmentation
The utility replaced assumptions based on “inside the network” with explicit service relationships.
Policies were organized around identities and operational roles, including:
- Control-center applications to approved substation services
- Engineering teams to designated management interfaces
- Cloud analytics workloads to specific telemetry sources
- Third-party maintainers to time-bound, approved services
- Administrative tools to governed jump or proxy services
- Monitoring systems to defined telemetry endpoints
This model reduced unnecessary reachability. A workload’s physical location or IP address no longer granted broad access by default; its identity, validation state, policy, and authorized relationship determined participation.
Phase 4: activate adaptive transport
With multiple approved paths available, Slip-Routing continuously evaluated transport quality using latency, jitter, packet loss, congestion, and path-health signals. When an underlay path degraded, the fabric could select a healthier policy-approved alternative. DEFT preserved the active logical service relationship as protected traffic transitioned.
The operations team tested the design through controlled impairments, including:
- Increased latency on a primary path
- Packet loss below the threshold of a hard circuit failure
- Complete carrier interruption
- Regional congestion
- Loss of a cloud or data-center path
- Recovery and restoration to the preferred route
The acceptance criterion was application continuity—not simply whether a backup link became active.
Phase 5: migrate high-capacity sites to an ISP-agnostic 100Gbps design
At core and high-throughput locations, the utility migrated its core network backbone to 100Gbps connectivity using approved provider and data-center infrastructure.
The key change was architectural: the 100Gbps backbone became transport beneath the fabric rather than a new provider-defined network boundary.
This gave the utility the option to:
- Use multiple approved ISPs or carriers where available
- Introduce cloud, private, internet, metro, or data-center transport without rebuilding security policy
- Increase capacity independently from the logical service topology
- Preserve a consistent identity and policy model across low-bandwidth remote sites and high-throughput core locations
- Avoid tying future bandwidth growth to one proprietary edge platform
Phase 6: retire MPLS selectively
The team did not remove MPLS in one event. It migrated application groups and sites after performance, security, operational, and rollback criteria were met. MPLS could remain temporarily as one approved underlay path during transition rather than continuing to define the network itself.
Circuit retirement decisions were based on:
- Proven application performance over the fabric
- Provider diversity at the location
- Successful degradation and recovery tests
- Confirmed Zero Trust policy coverage
- Operational readiness and monitoring
- Contract and cost timing
Case study
Zero Trust in operation
The deployment treated Zero Trust as an enforcement model, not a marketing label.
Identity before connectivity
Every participating Endlet required a cryptographic identity. A new node could not join solely because it appeared on an approved subnet or carrier circuit.
Machine validation before admission
The fabric evaluated machine state and authorization requirements before admitting participation. Lifecycle actions—including re-attestation, replacement, retirement, and revocation—could be governed centrally.
Least privilege between services
Policies allowed only required relationships between applications, workloads, users, and network segments. This reduced lateral reachability across corporate, cloud, data-center, and operational environments.
Segmentation independent of location
Identity-centric boundaries followed workloads and Endlets across approved environments. Policy did not need to be reinvented whenever an application moved to another cloud region, data center, or edge location.
Cryptographic agility for long-lived infrastructure
Critical infrastructure investments often remain in service for years or decades. The 21Packets crypto-agile, post-quantum model was designed to reduce long-term Harvest Now, Decrypt Later exposure and avoid making the network dependent on one static cryptographic choice.
Case study
Business and operational impact
Faster, more consistent global application delivery
The utility gained control over how protected traffic moved across available providers and environments. Instead of waiting for a hard outage, the fabric could respond to degrading conditions that were already affecting applications.
A practical path away from MPLS dependency
The organization could retire expensive or inflexible circuits according to operational readiness rather than replacing every location at once. MPLS became an optional transport during migration—not the permanent control plane for the enterprise network.
One security model across IT, cloud, and the operational edge
Cryptographic identity, machine validation, policy, and segmentation created a consistent control model across environments that previously relied on separate appliances and network-specific rules.
High-capacity growth without recreating carrier lock-in
The 100Gbps-capable architecture gave high-throughput sites room to grow while maintaining ISP independence at the fabric layer. Capacity planning could focus on application demand and provider diversity rather than one carrier’s topology.
Stronger resilience testing and operational evidence
WanAware and Endlet telemetry gave the operations team context across path state, availability, bandwidth, events, and fabric-connected assets. This supported more rigorous testing, incident review, and capacity decisions.
Case study
Why the client chose 21Packets
The utility was not looking for another overlay appliance attached to the same carrier assumptions. It needed a network architecture that could unify resilience, security, and deployment flexibility.
21Packets aligned to that requirement by providing:
- Software-defined fabric deployment across approved commodity and cloud environments
- Adaptive transport across multiple providers and access types
- Identity-bound Zero Trust admission and segmentation
- Crypto-agile post-quantum protection
- Preservation of protected service relationships through changing path conditions
- An operating model that spans remote sites, data centers, cloud workloads, and edge environments
- A path to high-capacity connectivity without allowing the ISP to define the logical network
Customer perspective
“Our MPLS network gave us private circuits, but it could not give us the adaptability, security consistency, or capacity model our operations now require. With 21Packets, we can treat providers as transport, enforce access through identity and policy, and preserve critical service relationships as network conditions change.”
Case study
Conclusion
For critical infrastructure operators, replacing MPLS is not simply a circuit-sourcing exercise. The larger opportunity is to replace a carrier-defined network with a software-defined operating model built around identity, policy, path intelligence, and cryptographic agility.
The 21Packets Quantum-Safe SASE Network Fabric gave the utility a foundation for that transition: preserve operations through underlay disruption, reduce avoidable global latency, enforce Zero Trust across distributed environments, and scale toward ISP-agnostic 100Gbps connectivity without recreating legacy dependencies.
Explore the underlying cryptographic architecture.
Quantum-Safe EncryptionDesign your fabric
Start with the operating constraint you cannot compromise.
Bring your current topology, providers, workloads and continuity requirements. We’ll map the 21Packets capabilities that fit.
Book a working session
