A software-defined wide area network (SD-WAN) is a technology that manages a business’s WAN connections, such as broadband, dedicated internet access, MPLS and cellular, as one network controlled by central policy. Each site has an SD-WAN device that measures how every link is performing and sends each application’s traffic over the path that best suits it. SD-WAN improves how existing circuits are used; it doesn’t replace the circuits themselves.
At a glance
- SD-WAN is an overlay: it runs on top of whatever circuits a site has and can’t fix a poor or undersized underlay.
- It steers traffic by application, for example voice over the cleanest link and bulk transfers over the cheapest.
- It can reduce reliance on MPLS by moving less sensitive traffic to broadband or DIA, but savings depend on restructuring circuits.
- It usually encrypts traffic between sites and often includes basic firewalling, but it is not a complete security stack.
- SD-WAN is the networking part of SASE; the two are not the same thing.
What problem it solves
A common scenario: a company has MPLS at headquarters, broadband at branches and a cloud-heavy application stack such as Microsoft 365, video meetings and CRM. Branch users report dropped calls and slow SaaS apps, failover between circuits is unreliable, and IT manages a different setup at every site with no clear view of what is performing.
The underlying issue is usually static routing. Every application takes the same path regardless of how that path is performing, and cloud traffic is often backhauled through a data center it doesn’t need to touch. When a link degrades, failover is slow or manual.
SD-WAN treats a site’s connections as one managed pool. Traffic is matched to a path based on what the application needs, cloud traffic can break out locally to the internet, and one policy is pushed to every site from a central console.
How it works
Edge devices. Each site gets an SD-WAN appliance or virtual instance connected to two or more circuits. The devices build encrypted tunnels to each other, to data centers and, in many designs, to cloud providers or security services.
Path measurement. The devices continuously measure latency, jitter and packet loss on every link.
Application-aware policy. Administrators define policies by application or traffic class: which links voice may use, what happens when loss rises, which traffic goes direct to the internet and which goes through a data center or security service. When a link degrades or fails, traffic moves to another path, typically within seconds, depending on the product and settings.
Central management. A cloud or on-premises controller holds the policies, pushes configuration to all sites, and reports on link and application performance. Many products also support zero-touch provisioning, where a new site’s device downloads its configuration once it is connected.
What SD-WAN doesn’t do matters as much. It can’t manufacture bandwidth or resolve carrier problems, and if every link at a site is poor, it can only choose the least bad one. A poorly designed policy will send traffic down the wrong path just as consistently as static routing would.
When it matters for buyers
- When MPLS contracts come up for renewal. SD-WAN over broadband or DIA is the usual alternative to compare against, but model costs with the new circuits included.
- When opening or acquiring sites. Central policy and templated deployment make new locations faster to bring online.
- When cloud apps and voice suffer at branches. Per-application steering and local breakout often help, provided the circuits are adequate.
- When you’re also evaluating security. Many SD-WAN vendors now sell SASE. Find out which components are native, which are partnered, and how hard it would be to change one part later.
- When deciding who runs it. Self-managed, co-managed and fully managed SD-WAN place very different loads on your team; the demo rarely makes the operating model clear.
Questions to ask vendors
- Which circuits do you supply, and which must we source? Who troubleshoots the underlay when a circuit misbehaves?
- How fast does traffic fail over between links, and what happens to active calls during failover?
- What security is included (encryption, firewall, segmentation), and what requires a separate license or service?
- Is management done by us, by you, or shared? Which changes can we make ourselves, and what are the change turnaround times?
- What does the hardware or license cost over the term, and what happens to the devices if we leave?
- If we later move to SASE, can we use your SD-WAN with another provider’s security services?
How it differs from MPLS
MPLS is a private carrier network service: your traffic runs across the carrier’s network, separate from the public internet, with performance commitments in the contract. SD-WAN is not a network service at all; it is an overlay that manages traffic across whatever circuits you have, which can include MPLS. The useful question is not “SD-WAN or MPLS” but which mix of circuits suits your traffic and locations, and how SD-WAN should manage across them. SD-Branch goes a step further, extending the same central management to a branch’s switches, Wi-Fi and firewall. For provider types and how to compare them, see our SD-WAN overview and four questions to ask a potential SD-WAN provider.
Problems this helps with
- MPLS costs keep rising while most traffic now goes to the cloud
- Calls and SaaS apps are slow or drop at branch offices
- Failover between circuits is manual or doesn't work
- Every site's network is configured and managed differently
