Use every link you pay for — and keep calls clear when one fails

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

LinkFabric builds encrypted tunnels over every internet link of every office, measures each link every two seconds and steers each application over the link that meets its needs, with error correction and copies for the links that lose packets.

2The challenge

Offices have two or three internet links and use one: the backup sits idle until the main link fails and calls freeze while someone notices. MPLS between sites is expensive, and a lossy broadband link makes video calls unusable even when it is up.

The TotalHeal approach. LinkFabric runs on the same BranchEdge appliances as FireWarden. Each appliance builds an encrypted WireGuard tunnel over every internet link to the other sites, measures every link every two seconds, and sends each application over the link that meets its needs — moving it within seconds when a link degrades, and back when it recovers.

3Architecture

4How it works

1. ConnectEach appliance builds a WireGuard tunnel per link to the other sites.
2. MeasureLatency, jitter and loss on every link, every two seconds.
3. SteerEach application goes over the best link for its SLA class.
4. RepairError correction and copies make lossy links usable (Professional).
5. RecoverTraffic moves within seconds when a link fails, and back when it heals.

5Capabilities in detail

• Tunnels over every linkOne WireGuard tunnel per internet link to the other sites, hub-and-spoke (branches reach each other through a hub) or full mesh; branches behind NAT dial the hub.
• Measured, not assumedLatency, jitter and loss on each link every two seconds, measured over the link itself; a link with five failed probes in a row is down and its traffic moves at once.
• Each application where it belongsSteering rules by application or destination with an SLA class — calls and meetings, business SaaS, bulk; the best link that meets the class, in your order of preference, with LTE and 5G only as a last resort. Flows stay on their link while it is healthy.
• Lossy links made usableOn the Professional tier: forward error correction (one parity packet per 2–16) rebuilds lost packets; calls can be copied over a second link; traffic between offices can be spread packet by packet over every link; flows can be balanced by bandwidth.
• Call qualityOn the Professional tier, a MOS score per link, estimated from latency, jitter and loss.
• QoS and routingUpload shaping on every link with classes and DSCP marking; static routes, BGP and OSPF; DHCP and the office resolver.
• Zero-touchRegister an appliance’s serial number with its site and template before it ships; on first contact it sets itself up.

6Security and data handling

• Measured over the linkEach link is probed through itself, so a dead link is never reported healthy.
• Backup stays backupMetered links carry traffic only when nothing else meets the need.
• Encrypted between sitesOffice-to-office traffic always travels inside WireGuard.
• No loopsThe tunnels’ own packets always leave through their own link.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• A BranchEdge appliance at each site
• A public address at the hub (or at each site for full mesh)

Start a 30 days, up to 2 appliances trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.