A bank branch needs its core banking LAN, ATMs, CCTV and customer Wi-Fi kept apart, each with bandwidth it can count on. Here is how ISPs running Hexium vBNG deliver that over a single broadband connection, and where else the same approach pays off.
The request every regional ISP eventually gets
A bank’s IT head calls with a rollout plan: sixty branches across the district, live within a quarter. Each branch runs four networks that must never mix.
The branch LAN carries core banking, and it cannot feel slow at 10 a.m. when the queue is longest. The ATMs move little traffic, but every transaction has to go through. The CCTV system uploads footage around the clock and will take whatever bandwidth it is given. And the guest Wi-Fi in the waiting area has to be fenced off from all of it.
The ISP has two familiar answers, and neither is good.
The first is a separate circuit for each network. It is clean, but four circuits per branch multiplies the last-mile build, the CPE count, the provisioning work and the monthly bill. Most branches cannot justify it, and the bank knows that.
The second is one broadband line, with the bank’s own router left to sort out the traffic. That is cheap until the CCTV system starts a large upload and ATM transactions begin to time out. The bank calls the ISP. The ISP sees one subscriber, one traffic counter and a link running within its plan, and has nothing useful to tell them.
What the bank actually wants sits between the two: the economics of one connection, with the separation and predictability of several.
One subscriber, several networks
Hexium vBNG from Mettle Networks treats the branch as a single subscriber with several networks inside it.
Each branch is one account, identified at the BNG by its outer VLAN tag. Within that account, every network the branch runs (LAN, ATM, CCTV, guest Wi-Fi) gets its own inner VLAN. This is the standard QinQ (IEEE 802.1ad) model that broadband access networks already use, so it fits existing OLT and aggregation designs instead of demanding a new one. At the branch, the CPE stays in plain bridge mode, and the networks arrive at the bank’s switch already separated.
For each of those networks, Hexium then provides:
- Its own bandwidth allocation, upstream and downstream. Allocations are set as shares of the branch’s plan. CCTV can be held to its share so it never crowds out the ATMs, and core banking keeps its headroom at peak hours. When the bank upgrades a branch’s plan, every network scales with it: one change, not four.
- Its own addressing. Hexium serves DHCP for each network directly, and on IPv6 each network gets its own delegated prefix. The bank’s firewall gets clean boundaries to work with, and the ISP gets a dual-stack service that goes all the way down to each segment.
- The right records. Authentication and usage records (IPDR) are anchored where the operator needs them, which keeps the regulatory trail straightforward.
Hexium never routes traffic between a branch’s networks internally, so the guest Wi-Fi has no path to the ATMs through the BNG. The bank’s own VPN or SD-WAN runs on top as usual. Hexium makes sure each network underneath it has the bandwidth, addressing and isolation it needs.
None of this needs a different box at the branch or a separate team to run it. It is provisioned and changed in the BNG the ISP already operates.
What changes for the ISP
The ISP stops selling a commodity line and starts selling a structured branch service: four networks, defined allocations, one installation. That is a different price conversation from “100 Mbps broadband”. It is also sticky, because the bank’s branch network is now designed around it.
Support changes too. Hexium keeps traffic counters for every network, so when the bank calls about slow ATMs, the ISP looks at the ATM network itself rather than one subscriber total. Was the ATM network at its allocation, or was the problem elsewhere? The call becomes a conversation about data instead of finger-pointing.
And the work scales. Sixty branches are sixty accounts with the same structure, not 240 circuits.
The same pattern, other customers
Once an operator can carry several protected networks inside one subscriber, the bank branch turns out to be one instance of a broader pattern.
- Voice and data for small businesses. A SIP trunk and the office internet run on separate networks, with voice given its own allocation so a large download never breaks a call. For ISPs that also sell voice, it is a natural bundle.
- Multi-service homes. Internet, IPTV and VoIP travel on separate VLANs over the same FTTH line, each with treatment suited to it. This is the multi-VLAN service model defined in the Broadband Forum’s TR-101.
- Hospitals, campuses, retail chains and factories. Clinical or plant systems, administration, CCTV and visitor access stay apart on one connection per site, with predictable bandwidth for the systems that matter most.
- Managed-CPE services. Device management gets its own network, kept separate from customer traffic.
Operators serving apartment buildings, or reaching customers through franchise partners, have different needs again, because every end user there is a customer in their own right. Hexium has an approach for those models too, and it deserves its own conversation.
Every network is different
How this lands in a particular network depends on its details. Which OLTs and ONTs are in the field, and how do they handle tagged traffic? How many networks does a typical customer need, and how should the bandwidth be split between them? How do plans flow from the ISP’s RADIUS and billing systems?
Our engineers can work through these questions with you against your own access network.
If you are pursuing bank, enterprise or multi-service deals and want to see how Hexium vBNG would handle your scenario, talk to the Mettle Networks team.