Network integration is where two estates physically become one, or at least learn to talk to each other safely. It sits underneath almost everything else in the integration: identity, email, shared applications and consolidated support all depend on traffic flowing where it should, and nowhere else.
Mistakes here are visible and costly. An outage can take down both businesses at once. A flat interconnect gives anyone inside the acquired network a path into yours. Overlapping address ranges break routing in ways that look like application faults. And a careless scan can disturb a plant controller or a medical device that was never meant to be touched.
When it happens
Discovery starts on day one, or earlier if the target grants read-only access before closing. The interconnect comes only after the connectivity gate set during security due diligence is passed. Consolidation of sites, carriers and remote access runs over the following months, often paced by carrier contract dates and circuit lead times.
Who is involved
- The buyer's network lead, who owns the design and the cut-over plan.
- The target's network engineers or managed service provider, who know the estate and its history.
- The security lead, for the gate, segmentation and firewall policy.
- The identity and directory team, for name resolution and authentication traffic.
- Application owners, who know which flows their systems need.
- Procurement and the carriers, for circuits and contracts.
- Site contacts and operational technology owners, for plant, laboratory or medical networks.
- Change management, for approval and scheduling.
The steps
1. Agree the scope, including what never to touch
Before anything sends a packet, agree which ranges are in scope and which must be left alone. Plant and process control networks, medical devices, laboratory equipment, partner links and payment environments can be fragile or contractually off limits.
- In-scope ranges, by site and owner
- A do-not-touch register: ranges, owners and the reason for each
- Read-only credentials for discovery, agreed with the target's team
- Change windows and freeze periods, such as quarter-end
2. Discover and document
Document the network as it is, not as the last diagram says it is. Then compare the two, because the differences are where the surprises live.
- Device inventory: firewalls, routers, switches, wireless and load balancers, with model, software version and support status
- Physical and logical topology
- Addressing: every subnet, VLAN, NAT rule and public range
- Routing: protocols, default routes, where internet traffic leaves
- DNS and DHCP: servers, zones, forwarders, scopes and reservations
- Firewall rule bases and remote access
- WAN circuits and carrier contracts: bandwidth, term, notice period, termination charges
3. Resolve overlapping address space
Two organisations using the same private ranges is common. You have three broad options, and the choice shapes the whole programme. Whichever you pick, design the target addressing plan for the combined estate first.
- Renumber: the cleanest end state, but it touches every static address, firewall rule and hard-coded application setting, and carries the most short-term risk.
- NAT at the interconnect: fast, but it breaks some protocols, complicates logging and troubleshooting, needs DNS answers that differ by side, and tends to become permanent.
- Phased re-addressing: translate the overlapping ranges now and renumber site by site, ideally alongside hardware refreshes. A sound compromise, provided it has an end date.
4. Design the interconnect behind the gate
Connect through as few points as possible, each one through a firewall, with everything denied unless there is a documented reason to allow it. Treat the acquired network as a separate security zone until integration is complete.
- One or two controlled interconnect points
- Default deny, with each permitted flow recorded: source, destination, port, business owner and review date
- Logging at the interconnect, sent to a monitored service
- The connectivity gate signed off before the link carries any traffic
- No broad "temporary" rules
5. Make names resolve, and plan around the directory
Users notice name resolution first. Set up conditional forwarding between the two DNS estates and check for internal zone names used on both sides. Directory traffic needs specific flows; whether to trust or migrate is a security and identity decision, covered in identity and email integration.
- Conditional forwarders for each side's internal zones
- Conflicting internal zone names found and resolved
- A decision on which side is authoritative for shared names
- DHCP options updated as sites move
- Directory and authentication flows limited to the servers that need them
6. Consolidate the WAN and carriers
Carrier contracts set the pace. Long notice periods, termination charges and long lead times for new circuits mean you should start this early and plan for a period of running both.
- Every circuit with its contract end, notice period and termination charge
- Order lead times for new circuits and equipment
- Internet breakout and remote access consolidated to the target design
- Ownership of public address space and its registration checked
- An overlap period with both circuits live, for rollback
7. Cut over in waves, with rollback
Group sites into waves, starting with a pilot that is representative but not critical. Each wave follows the same runbook and has a firm rollback point.
- Pre-checks, a timed runbook and post-checks for each wave
- Application tests carried out by business users, not only by the network team
- A rollback trigger and a time limit for deciding
- A short review after each wave, with lessons carried into the next
8. Document the result
Integration is not finished until the documentation matches the network. Hand the operations team an accurate picture, not a project archive.
- As-built inventory, topology and addressing plan
- The firewall flow register, with owners and review dates
- Updated diagrams, runbooks and support contacts
- Retired circuits, devices and ranges removed from every record
Common traps
- Scanning before the scope is agreed, and disturbing a fragile device
- Treating the target's diagram as accurate
- Using NAT as a permanent answer to overlapping addresses
- An "any to any" rule at the interconnect that was meant to be temporary
- Finding the address overlap during a cut-over instead of before it
- The same internal DNS zone name on both sides
- Missing a carrier notice date and paying for two networks for another term
- Public address space or domains still registered to the seller
- Cutting over during a quarter-end or peak trading period
- A rollback plan with no time limit, so nobody makes the call
What you hand over
- Inventory and topology, as found and as built
- The combined addressing plan and the overlap decisions
- The interconnect design and the approved flow register
- The DNS design for both estates
- The WAN and carrier plan, with contract dates
- Wave plans, runbooks and post-change reviews
- The do-not-touch register, with owners
- Current documentation for the team that runs the network next
Where MNA Tools helps
- SubnetSleuth inventories and maps the network you inherit, read-only and only inside the ranges you agree, with do-not-touch ranges excluded. Use its subnet list to check for overlaps with your addressing plan before the networks are joined, and scan again after each wave so the documentation matches the network.
- HouseGRC records exceptions to the gate, and risks such as unsupported devices found during discovery, as owned, dated risks.
A general guide to the technology side of a deal, not legal, tax or financial advice. Adapt it to the deal in front of you, and take advice where the stakes call for it.