One path across many transports: simplifying modern site-to-cloud connectivity

Legacy networking treats every transport and every destination as its own project. You buy LEO (such as Starlink) for one site, 5G for another, MPLS or metro Ethernet on the campuses, and public internet wherever a circuit is missing. Cloud sits behind Direct Connect, Transit Gateway, or a VPN left over from the last migration. Each piece can work. The complexity is making them behave as one network, and owning the result when they do not.

Ground Orbit Networks streamlines that into one managed path. You connect your LAN into Ground Orbit–provided routers. One operator runs first mile through last mile for modern site-to-cloud connectivity.

The problem: legacy complexity

Many transports, many projects

On a real network environment, you usually already have some combination of:

• LEO satellite where fiber or microwave is not available
• 5G / cellular for fast stand-up or backup
• MPLS and private WAN for campuses and long-lived branches
• Metro Ethernet and colo cross-connects where carrier Ethernet exists
• Public internet as reachability that still needs encryption, segmentation, and someone on call

In the legacy model, latency, loss, failover, and procurement all differ by transport. Buy each one as a separate project and you end up with separate routers, separate tunnels, and separate monitoring. Ops owns five networks that were supposed to be one.

Many destinations, more stitching

Legacy design often targets “internet access.” Real environments need reachability to all of these at once:

• Remote and field locations
• Branches
• Headquarters
• AWS (private access over Direct Connect as the primary path)
• On-prem data centers and partner sites

Without a shared path, you stitch site-to-site VPNs, carrier handoffs, and cloud attachments one pair at a time. The next site reopens routing, path identity, and who owns the incident.

What breaks when complexity stacks

When every hop is a different vendor and a different skill set, failure domains stack. Cellular drops. Satellite weather hits. One CPE dies. If bonding and failover were never designed as one service, the site is down even when another transport is still up. That is the cost of running modern transports with a legacy operating model.

Solution overview: one managed path

Ground Orbit replaces that stack of projects with one managed service from first mile through last mile.

Default: put every site on the same path model. Field sites join over 5G, LEO satellite, or a private circuit, often more than one at once. Traffic enters the managed core and reaches headquarters and AWS on that same operated path. Ground Orbit picks the transport for the site, supplies and manages the routers, runs the middle mile, and provisions cloud access.

You do not rebuild the WAN yourself. You connect your LAN into the Ground Orbit–provided routers. Ground Orbit owns transport selection, bonding, encryption, the middle mile, Direct Connect, and day-two operations, so the infrastructure gets modern multi-transport reachability without legacy integration overhead.

Security, segmentation, monitoring, and service-desk coverage are part of the path from day one. Private WAN you already run (including MPLS-style constructs) attaches as last mile. Colo cross-connect and Direct Connect stay in the middle mile. MPLS, metro Ethernet, and public internet remain part of the infrastructure mix. 5G and LEO carry the first mile; MPLS, metro Ethernet, and public internet keep their existing roles.

Walkthrough: join the managed path

Shopping carriers, designing tunnels, and assembling a middle-mile core yourself is the old stand-up path. With Ground Orbit, that work stays with the operator. You bring site requirements, connect into Ground Orbit–provided routers, and validate reachability. Ground Orbit runs the rest.

Step 1: Bring your site and destination inventory

Before kickoff, write down what each location needs so Ground Orbit can size the design once from a complete inventory:

1. Site type: field / remote, branch, headquarters, partner, or on-prem data center.
2. First-mile options available on the ground: 5G, LEO, private circuit, or more than one. Ground Orbit decides single-transport versus bonded based on that inventory and your resilience needs.
3. Destinations that must work on day one: HQ, partner network, AWS (account and region). Add other clouds only if they are already in scope.
4. Resilience needs: whether the site can live through a single first-mile outage. Default for mission and remote sites: multi-transport when a second transport is available.

Hand this inventory to Ground Orbit in the site and mission review. Do not shop carriers or design tunnels yourself as the primary path.

Step 2: Connect the field site into Ground Orbit routers

A router per transport and a VPN per destination is how field sites used to accumulate complexity. With Ground Orbit, your job is the LAN handoff into the managed CPE:

1. Ground Orbit supplies and manages a dual-router CPE pair at the site.
2. Connect your site LAN (and any on-site systems that must ride the path) into those routers.
3. Ground Orbit attaches first-mile transports (5G, LEO satellite, private circuit) and bonds more than one when the site cannot live through a single-carrier outage.
4. Traffic leaves the site inside the post-quantum cryptography VPN on the first hop over commercial cellular and satellite. That encryption is built into the managed design from the first hop.
5. Power and physical install follow Ground Orbit’s site instructions. Verify with Ground Orbit that the site has joined the overlay. Do not make a one-off site-to-site VPN the primary design.

[Field / remote site LAN]
           |
           v
  Ground Orbit CPE (dual routers)  <-- you connect here
           |
           +-- First mile A (e.g. LEO)     \
           +-- First mile B (e.g. 5G)       } Ground Orbit attaches / bonds
           +-- Optional private circuit    /
           |
           v
  PQC VPN --> Ground Orbit managed core

Step 3: Middle mile and private AWS path (operated for you)

Ground Orbit runs the middle mile. You do not design, monitor, or staff a parallel core beside it.

1. Site traffic enters the Ground Orbit managed core in colo points of presence.
2. Colo cross-connects feed that core.
3. AWS attaches over AWS Direct Connect from inside the managed network as the primary cloud path.
4. Cloud-bound traffic stays on AWS Direct Connect from inside the managed network.

Managed CPE sites --> Colo PoPs (dual paths) --> AWS Direct Connect (dual)
                                                      |
                                                      v
                                              Customer AWS workloads
                                              (private attachment)

Step 4: Connect HQ and branches on private WAN

At headquarters, corporate offices, and partner sites, use the same handoff pattern as the field, so you keep one WAN design across the footprint:

1. Ground Orbit places the same managed router design on the last mile over private WAN.
2. Connect those sites into the Ground Orbit–provided routers the same way you do in the field: LAN handoff into the managed CPE.
3. If you already run MPLS or similar private WAN, Ground Orbit attaches it as last mile into that enterprise network on the same managed path.
4. With Ground Orbit, verify the remote site appears in your Layer 2 or Layer 3 segments.
5. After cutover validation, remove the one-off site-to-site tunnels this path replaces.

Step 5: What you should expect from the service

When monitoring, failover, and tickets are split across carriers and cloud attachments, nobody owns the whole path. Require these outcomes from the managed service:

1. One service contract for the path end to end.
2. First-mile transport chosen per site (5G, LEO, private circuit, or bonded combination) under one security and operations model.
3. Multi-transport resilience on the first mile wherever Step 1 said you need it.
4. Private cloud reachability via Direct Connect from inside the managed network.
5. One operator for monitoring, failover, and the service desk (hours and tiers as written in the service agreement).

Architecture considerations

Security

1. Encrypt commercial cellular and satellite traffic from the first hop with the post-quantum cryptography VPN. Do not bolt encryption on after the fact.
2. On multi-tenant networks, Ground Orbit keeps strict, explicit isolation between customers. Choose a single-tenant design when your security requirements need that separation.
3. Reach AWS over Direct Connect from inside the managed network as the default path.

Resilience: two of everything

Build to the Ground Orbit reference design: two routers at each site, two switches and two routers in every point of presence, two cross-connects into AWS, and two private WAN circuits on the last-mile pattern. That replaces a spreadsheet of single points of failure across vendors.

Do not accept a design where one device, one circuit, or one carrier takes the site down. Failover belongs in the operated design Ground Orbit runs for you.

Cost and procurement

Buying Starlink, 5G, MPLS, and metro Ethernet as unrelated projects multiplies vendors, contracts, and invoices. Ground Orbit simplifies procurement: one managed path, one service, and one bill.

Who this pattern fits

Forward-deployed and remote sites on 5G or satellite need a fast way onto the enterprise network without assembling a WAN per site. Disaster and emergency response still need connectivity after terrestrial infrastructure fails, with LEO carrying the first mile and one operator behind it. Distributed branches need cloud and headquarters reachability without a full WAN engineering team at every site.

Energy, industrial, and other remote operations hit the same multi-transport problem. The same managed path covers that design shape: modern networking without the legacy integration stack.

Conclusion and next steps

Legacy WAN design leaves you with many transports, many destinations, and many operators. Modern connectivity still needs all of those destinations. Ground Orbit Networks collapses the complexity into a single managed path: first mile over 5G, LEO, or private circuit (bonded when needed), middle mile through a managed core with private AWS access, and last mile into headquarters and partner sites on private WAN, under one operator.

Your side of the work is the handoff: inventory the sites, connect into the Ground Orbit–provided routers, validate reachability, and cut over. Ground Orbit owns the path.

Do this next:

1. Complete the site inventory in Step 1 for every location in scope.
2. Mark each field site’s resilience need (single first-mile or multi-transport; default multi-transport when a second transport is available).
3. Run a site and mission review with Ground Orbit, lock a reference design, then pilot one site before environment-wide rollout.
4. Contact Ground Orbit to discuss your use case: brianlauer@groundorbitnetworks.com · groundorbitnetworks.com