Core Router for each location:

Cisco 2811:

* Provides access to high speed internet (T1/T3) * Provides security features that usually come with the PIX IOS (hence MPLS/Site to Site) * Allows VLAN's at each location.

Core switches for each location:

Cisco Catalyst 3950:

* Has x2 gigabite uplink ports for a fiber connection to the Cisco core router. * Allows VLAN's, and trunking to other Cisco compatible devices.
Lines for each location:

This depends on what your needs are. They can be a normal T1, bonded T1's or a T3 line for increased bandwidth. You may also want to have a fail over ISDN line for redundancy reasons, and depending if you have a sever farm of not, you may need additional bandwidth.

* Connection should be fiber (copper lines are more stable, but slower. Satellite is way to slow). * Connections should be T1/T3 lines, with a failover T1/T3 or ISDN line.
Heres how the whole thing would play out (in a Cisco world at least):

Global Network:

* Each network should have a Cisco 2811, which will be the CPE of the network. * Each network should have a high speed fiber connection (type of connection will be determined on bandwidth consumption, along with need for VoIP). * Each network should have a failover line (T1/T3 or ISDN). Best practice is that both lines should be the same as the primary line. * MPLS should be used to connect all networks together, hence a third T1/T3 connection. If MPLS is not an option due to budgeting, site2site should then be used to unify file sharing between the networks.
Internal network (at each location):

* Cisco Catalyst switch should be used as the core switch. * There should be a gigabite uplink from the core switch to the core router (fiber) * VLANS should be used in each department to properly divide them. Each department will have there own subnet, and there own catalyst switch (lower model) that supports VLAN trunking (so all departments will trunk to the core switch, that will then be pushed upwards to the core router). * A backend gigabyte connection should exist for maintenance purposes (backup's and such), along with a front end VLAN for the server farms at each location.