Classic wide area networks connect sites via dedicated provider lines, often based on MPLS. All traffic often runs through headquarters, even if it is actually bound for the internet. Since many applications now come from the cloud, this detour is inefficient. SD-WAN instead uses several internet links in parallel, including cheaper ones, and continuously decides which traffic takes which path.
How does SD-WAN work?
- Edge devices and controller: Each site has an SD-WAN device. A central controller, often provided as a cloud service, distributes configuration and policies to all sites.
- Overlay across any links: Encrypted tunnels, usually with IPsec, are established between the sites, regardless of which link lies underneath.
- Application-aware routing: The system recognizes applications and, for example, routes telephony over the link with the lowest latency, while large data transfers use the cheaper link.
- Continuous measurement: Latency, jitter, and packet loss are measured constantly. If a link fails or degrades, the system switches over automatically.
- Local internet breakout: Cloud traffic goes directly from the site to the internet instead of taking the detour via headquarters.
- Zero-touch provisioning: New devices retrieve their configuration themselves after being connected.
Typical examples
- A retail company connects its branches via fiber and uses a mobile network as a backup link.
- At a production site, telephony is prioritized over data backups.
- A new branch office is connected to the corporate network within a short time.
What companies should keep in mind
- Create real redundancy: Choose links from different providers and technologies. Two links in the same cable route often fail together.
- Security at the site: A local internet breakout needs on-site protection, such as a firewall, or a security service from the cloud.
- Define the operating model: Clarify whether the company operates SD-WAN itself or obtains it as a service.
- Consider dependencies: Controllers and devices usually come from the same vendor, and switching later is costly.
- Monitor quality: Integrate link metrics and failovers into IT monitoring.
How it differs
SD-WAN uses encrypted tunnels like a VPN but adds central control, multiple links, and per-application rules. When SD-WAN is combined with security functions from the cloud, this is often referred to as SASE (Secure Access Service Edge).
View network expertise