Traditional wide area networks backhauled branch traffic to a central data centre over private circuits. With applications now in the cloud, that design adds cost and latency. Software-defined WAN (SD-WAN) offers a more flexible approach.
How SD-WAN works
SD-WAN devices at each site connect over several transport types — broadband, fibre, 4G/5G and MPLS — and a central controller applies policies across all of them. Traffic is steered over the best available path for each application, based on measured performance.
Benefits
- Better cloud performance: sites can reach SaaS and cloud services directly.
- Resilience: traffic fails over automatically between links.
- Lower cost: broadband can supplement or replace expensive private circuits.
- Central management: zero-touch deployment and consistent policies.
Planning considerations
- Application priorities and performance requirements.
- Security for local internet breakout — firewalling, web filtering and threat protection.
- Managed service or in-house operation.
- Integration with existing routing and data centre networks.
SD-WAN and SASE
Many organisations now combine SD-WAN with cloud-delivered security services in a secure access service edge (SASE) architecture — see SASE Explained.
5 proven benefits of SD-WAN
- Better cloud and SaaS performance. Local internet breakout lets branch users reach cloud applications directly instead of backhauling through a data centre.
- Improved resilience. Traffic can fail over automatically between broadband, fibre, MPLS and 4G or 5G links.
- Application-aware routing. Critical applications such as voice and video are steered over the best-performing path in real time.
- Centralised management. Policies are defined once and pushed to every site, simplifying changes and reducing configuration errors.
- Faster site deployment. Zero-touch provisioning allows new branches to come online quickly without specialist engineers on site.
Best practices for a smooth rollout
- Audit current circuits, applications and traffic patterns before design.
- Define application priorities and quality-of-service policies with business input.
- Pilot at a few representative sites before a wider rollout.
- Integrate security from the start, either with built-in firewalls or a cloud security service.
- Plan for monitoring of both underlay circuits and overlay performance.
Common mistakes to avoid
- Removing MPLS too quickly before validating internet circuit quality.
- Treating SD-WAN as only a cost-saving exercise.
- Overlooking security when enabling direct internet access.
Frequently asked questions
Does SD-WAN replace MPLS?
It can, but many organisations keep MPLS at critical sites and add internet links for capacity and resilience.
How does SD-WAN relate to SASE?
SD-WAN provides the networking foundation; SASE adds cloud-delivered security services.
A 90-day action plan
Days 1 to 30: document every site’s circuits, contracts and bandwidth use, list critical applications and define performance targets for voice, video and business systems.
Days 31 to 60: select a solution, design policies and security integration, and deploy at three pilot sites with different profiles.
Days 61 to 90: compare pilot performance with the old network, refine policies and create a rollout schedule aligned with circuit contract end dates.
Questions to ask providers
- How are application performance issues detected and reported?
- Which security functions are built in, and which require other services?
- Is the solution available as a managed service, and what are the service levels?
- How does licensing scale with bandwidth and site count?
- Which cloud providers and SaaS applications have optimised connectivity?
Key terms explained
- Underlay: the physical circuits, such as broadband, fibre or MPLS.
- Overlay: the virtual network built on top of the circuits.
- Local breakout: sending internet-bound traffic directly from a branch.
- Jitter: variation in packet delay that affects voice and video quality.
- Orchestrator: the central console used to define and push policies.
The bottom line
Software-defined wide area networking has become a mainstream way to connect branches, improve cloud application performance and add resilience. The organisations that benefit most audit their sites and applications first, define clear performance policies, pilot carefully and integrate security from day one. Treat the project as a foundation for wider network and security modernisation rather than a simple circuit replacement, and you will be well placed to adopt cloud-delivered security services in the future.
Further reading on SD-WAN
For authoritative, vendor-neutral guidance on SD-WAN, see MEF. You can also browse our free whitepapers.
