What Is SD-WAN?

Learn what SD-WAN is, how it works, and why it's a smarter, more flexible alternative to traditional WAN for modern businesses.

What Is SD-WAN?

  • Software-defined WAN (SD-WAN) is an emerging networking technology that enables IT engineers to centrally and intelligently manage or orchestrate WANs using applications such as SD-WAN controllers. This approach streamlines the configuration and monitoring of network connections across multiple locations, improving network performance, reliability, and security. By leveraging SD-WAN, organizations can reduce costs associated with traditional WAN infrastructure and more easily adapt to changing business needs.

  • In contrast to traditional router-based models that prefer TCP/IP addresses and access control list tables for traffic routing, SD-WAN uses software and network virtualization for intelligent, application-aware traffic management. It dynamically chooses from hybrid WAN connections, including long-term evolution (LTE), multi-protocol label switching (MPLS), and broadband internet, to identify the best path for traffic delivery across the network. Dynamic, policy-based traffic management in the WAN minimizes packet loss or jitter, which improves the end-user experience while accessing on-premises, cloud, or hybrid enterprise apps. This also eliminates the network latency, bandwidth, and application performance issues evident in conventional WAN networks.

    SD-WAN technology uses various off-the-shelf SD-WAN devices to operate the network. These appliances are centrally managed, interconnected via encrypted tunnels, and installed across every remote site or branch of an organization. They handle traffic routing and monitoring based on application-based policies and real-time traffic conditions. For instance, if a particular network link fails, such appliances automatically divert the traffic to an alternative connection to ensure connectivity. Businesses can create multiple traffic policies to meet the quality of service (QoS) requirements of mission-critical business applications, such as enabling priority queuing for interactive apps to improve performance.

    With centralized orchestration and zero-touch provisioning, these policies can be instantly deployed to thousands of appliances across branches, eliminating the need for operators to configure them individually. While policy-based routing isn’t a new technology, SD-WAN can be seen as an evolution, opening the door for more advanced technologies that embrace the use of machine learning to find the best possible connection for each use case without requiring manual, administrative input.

  • Abstraction and virtualization are critical aspects of an SD-WAN architecture. It can support on-premises and cloud apps with the highest level of app performance compared to conventional WAN based on MPLS circuits. This architecture separates the control plane, data forwarding plane, and applications to simplify network management. Below are the three vital components of this virtualized architecture:

    • SD-WAN edge: The endpoints of this abstracted network are located at the WAN edges. Examples include branch offices, remote data centers, and cloud platforms.
    • SD-WAN controller: This software as a service (SaaS) application centrally manages all the network nodes, retrieves QoS performance metrics of encrypted tunnels, and defines policies.
    • SD-WAN orchestrator: The orchestrator operates like a virtualized administrator to perform real-time traffic monitoring and instruct other network devices to follow operational rules or policies.

    These basic components are ubiquitous in commercially available SD-WAN solutions, such as VMware SD-WAN (VeloCloud), Cisco SD-WAN (Viptela), and Meraki SD-WAN. There are three types of network architecture, which are outlined below:

    • On-premises SD-WAN includes a plug-and-play router that connects with network devices at remote sites only. Cloud gateway connectivity is restricted, as all business apps are hosted on-premises in this setup.
    • Cloud-enabled SD-WAN features virtual cloud gateway connectivity to host SaaS apps without any latency or performance issues. Cloud-enabled SD-WAN with a backbone makes switching from a less secure public internet to a private, MPLS-based connection easier, owing to the availability of an additional backup in the form of the service provider's nearby network point of presence.

  • Cost efficiency: SD-WANs offer multiple transport options, such as MPLS, LTE, and broadband internet, which can be used in different combinations to fully use network bandwidth and lower operational costs. For instance, network operators can shift non-critical WAN traffic from expensive, private MPLS links to broadband internet to reduce transport costs. Centralized network control and zero-touch provisioning eliminate frequent onsite visits by IT for WAN deployments, minimizing administrative costs.

    Agility: Network engineers face constant pressure to identify new ways to rapidly connect multiple remote sites or users to enterprise cloud and SaaS solutions without compromising on cost, security, and performance. Fortunately, the software-based approach to managing WAN allows global businesses to build a unified WAN architecture with the flexibility to add new links or optimize existing WAN services. Unlike traditional WAN, IT staff can complete these tasks in a few hours with software-based network administration.

    Simplified management: Provisioning and management of a WAN become more straightforward with software. Unlike MPLS, IT staff don't need to configure network devices individually in a virtualized WAN architecture. The staff can rely on a single, centralized software-based controller to manage appliances across multiple locations using template-based provisioning.

    Improved application performance: Policy-based traffic management and utilization of multiple transport mechanisms in programmatically managed WANs can enhance the availability of mission-critical business apps. SD-WANs, such as Cisco SD-WAN, VMware SD-WAN, and Meraki SD-WAN, prevent traffic backhauling to improve cloud apps' performance and user experience.

  • When you begin exploring SD-WAN solutions for your business, you'll encounter several options:

    • Do-it-yourself SD-WAN: Ideal for IT professionals seeking full control, this approach requires you to purchase the SD-WAN appliance or multiple virtual appliances. Your team is responsible for everything, from setup to ongoing maintenance. This is best suited for organizations with a large, skilled IT department.
    • Fully managed SD-WAN: This option is completely hands-off. A managed service provider handles deployment, management, and monitoring, allowing your team to focus on other key initiatives.
    • Co-managed SD-WAN: Many IT teams find this arrangement to be the ideal balance. Responsibilities are shared between you and the provider; the provider may oversee the core network while you retain control over application policies and daily operations. This model offers flexibility and collaboration.

    You'll also come across different terms describing how SD-WAN is delivered:

    • On-premises SD-WAN: This traditional model involves installing a physical SD-WAN appliance at each branch location.
    • Cloud-based SD-WAN: In this setup, the cloud hosts the SD-WAN control plane and is often provided as SD-WAN as a service. It's easier to manage and well-suited for businesses already leveraging cloud technology.
    • Hybrid SD-WAN: This approach merges on-premises hardware and cloud-based management, offering the benefits of both.
  • As every network is unique, SD-WAN can be tailored to your individual requirements. The two most prevalent architectures are:

    • Hub-and-spoke: This straightforward, classic setup has your branch offices or "spokes" all connecting to a central "hub," such as your primary data center. It's simple to oversee but may be less optimal for direct communication between branches.
    • Mesh: In a mesh topology, each site can communicate directly with every other site. A hybrid mesh model is more widespread, offering direct links for essential sites, while others rely on the hub-and-spoke approach.

    When Should You Use SD-WAN?

    One excellent scenario is enhancing performance for cloud-based applications. Instead of routing all application traffic through a central data center, SD-WAN enables direct internet access, speeding up cloud apps for remote users.

    Another popular scenario is improving connectivity in a hybrid SD-WAN environment, allowing you to combine MPLS with more affordable internet connections to satisfy your business needs. SD-WAN can facilitate the rapid setup of a new branch office by using on-premises or virtual appliances for quick deployment, making it easy to add network connectivity with minimal hassle.

  • When considering SD-WAN, it’s essential to address security. While traditional firewalls and VPNs provided an initial layer of protection, today’s networks require a more comprehensive solution. SD-WAN offers a strong foundation, incorporating security features to protect against evolving threats.

    Traffic segmentation is a fundamental element that separates various types of network traffic, making it more difficult for malicious actors to move laterally within your network. Traffic segmentation is vital for implementing a zero-trust approach, where no user, device, or application is trusted by default, regardless of location. This is an important aspect of zero-trust network access, ensuring users are granted secure, least-privilege access.

    Many security features previously exclusive to your data center are now migrating to the cloud. This is where the secure access service edge model becomes important, as it integrates SD-WAN with key cloud-based security tools, such as a cloud access security broker for managing cloud applications, a secure web gateway for safeguarding web traffic, and domain name system security. Most modern SD-WAN solutions include these features or can connect with your current security infrastructure.

    It’s also important to manage who and what can access your network. Advanced tools, such as next-generation firewalls, intrusion prevention, and SSL inspection, provide detailed insight into network activity. By implementing real-time access control and robust role-based policies, you can ensure only authorized users and devices reach the appropriate resources when needed.

  • One of the greatest advantages of SD-WAN is its compatibility with other technologies. Instead of operating in isolation, SD-WAN can be a core element of your modern IT environment, seamlessly integrating with different solutions to enhance your network’s intelligence, speed, and security.

    The Value of Integration

    Your current infrastructure remains important, and SD-WAN can enhance its capabilities. For example, you can directly integrate a next-generation firewall with an SD-WAN appliance to deliver robust branch-level security, protecting against internet-based threats. This approach is a significant improvement over the traditional method of routing all traffic through a central data center for inspection.

    SD-WAN can work with MPLS technology. Many clients choose a hybrid model, retaining MPLS for critical applications while leveraging cost-effective broadband for non-critical traffic. SD-WAN automatically manages traffic steering, ensuring your vital data receives top priority.

    SD-WAN and the Cloud

    As organizations move to the cloud, networks must adapt. SD-WAN is essential for multi-cloud networking, enabling direct, optimized connections to Amazon Web Services, Azure, and Google Cloud. Instead of being hindered by network congestion, SD-WAN applies application-aware policies to guarantee an excellent user experience for cloud-based services.

    This functionality aligns with intent-based networking, which automates network management. You define your network objectives (e.g., prioritizing video conferencing), and the SD-WAN-powered system handles configuration and ongoing optimization. SD-WAN can serve as your gateway to 5G networking, supporting high-speed cellular connections as either a primary or backup link, increasing your network’s resilience.

  • Entering the world of SD-WAN is exciting, but it doesn’t always go smoothly. Many people encounter similar challenges along the way, and being aware of these can help you prepare better.

    Initially, transitioning from your existing setup to SD-WAN can be tricky, with numerous challenges in migrating from MPLS to SD-WAN. It’s not about simply switching equipment but requires thoughtful planning to prevent downtime. Additionally, using the public internet introduces application-performance unpredictability. Despite prioritizing your critical applications, you can’t control internet conditions, which may cause unexpected jitter or delays.

    Security is another crucial factor. SD-WAN can create new branches of security challenges, as it often sends traffic directly to the internet, bypassing your central data center’s security measures. This can result in data vulnerability and introduce new security and visibility limitations that must be addressed. Managing threat and compliance issues across all locations is essential.

    Last, although SD-WAN aims to simplify operations, it can occasionally add new layers of complexity. Management complexity can arise if you need to use multiple dashboards or work with several vendors. Additionally, vendor complexity can become problematic if your solution isn’t compatible with others, making cost reduction quantification and demonstrating return on investment more difficult. Troubleshooting can be more challenging when managing several connections and underlay dependence on various ISPs. Remote workers may have limited support compared to dedicated office connections.

  • Traditional WAN uses older MPLS circuits to connect remote users to applications hosted in on-premises data centers. This hardware-based approach to WAN administration guarantees reliable connectivity and security. Private MPLS lines serve as the main transport option, with broadband internet as the backup if the primary path fails. Although traditional WAN architecture is ideal for businesses operating in a specific geographic region with special connectivity requirements, it is cloud resistant. Due to traffic backhauling and bandwidth constraints, enterprises face increased latency and poor application performance while steering cloud app traffic through a conventional WAN.

    In contrast, SD-WAN is a modern, cloud-first approach that simplifies WAN administration. It provides more flexibility and agility than traditional WANs by programming the network behavior centrally using software such as the software-based WAN controller. SD-WAN can easily support bandwidth-intensive cloud apps by distributing traffic smartly across high-speed, low-cost connectivity options, such as LTE and broadband internet, along with conventional MPLS lines. SD-WAN offers real-time traffic monitoring and network segmentation capabilities, making it safer and more reliable than traditional WAN.

  • Both SD-WAN and software-defined networking (SDN) have common functions and a similar underlying infrastructure, where the data plane and control plane are decoupled to enforce centralized network control. However, they differ significantly.

    SDN addresses the modern computing needs of LANs or service provider networks by making them agile, scalable, and programmable. It’s mainly used in data centers to provide on-demand services, simplify network management, and reduce operational costs. Network administrators or end users can configure and manage network resources quickly with the help of automated SDN programs or policies through a centralized console. Commodity and specialized switching hardware help establish such networks.

    SD-WAN is the logical application of SDN in WANs. In contrast to SDN, which solely focuses on the internal network or LAN, SD-WAN connects an organization’s geographically dispersed branch offices, data centers, and remote users over a unified, high-performance WAN. Instead of end users, vendors configure the appliances in this network. SD-WAN uses off-the-shelf x86 network appliances and reduces operational and capital expenditures compared to SDN.

Featured in this Resource
Like what you see? Try out the products.
SolarWinds Observability SaaS

Unify and extend visibility across the entire SaaS technology stack supporting your modern and custom web applications.

Start Free TrialFully functional for 30 days
SolarWinds Observability Self-Hosted

Visualize, observe, remediate, and automate your environment with a solution built to ensure availability and drive actionable insights.

Email Link To TrialFully functional for 30 days
Network Performance Monitor

Multi-vendor network monitoring that scales and expands with the needs of your network.

Email Link To TrialFully functional for 30 days

View More Resources

What Is Observability (o11y)?

Observability is the measurement of a system's internal state determined from its external outputs.

View IT Glossary

What Is an Observability Pipeline?

An observability pipeline, or a telemetry pipeline, is a system that helps gather, process, and send data from various sources to the right tools.

View IT Glossary

What Is Network Visualization?

Network visualization allows you to pictographically showcase the network architecture, including device arrangement and data flows.

View IT Glossary

What is Network Topology?

Network topology offers a diagrammatic explanation of the logical and physical setup of different components, such as routers and switches, in a network.

View IT Glossary

What is Network Discovery?

Network discovery is a process of finding devices that also allows systems and nodes to connect and communicate on the same network. This helps network administrators locate devices, create network maps, organize device inventories, enforce accurate device access policies, and gain better control of the infrastructure. Network discovery also helps to find static, dynamic, reserved, and abandoned IP addresses.

View IT Glossary

What Is Network Monitoring?

Network monitoring is a critical IT process to discover, map, and monitor computer networks and network components, including routers, switches, servers, firewalls, and more.

View IT Glossary