SD-WAN and Managed WAN, Without a Product to Push
SD-WAN puts one policy layer over every circuit at every site and sends each application down the path that suits it. TREU competes the carriers, managed providers and vendors, then manages the terms for as long as they run.
Book a conversationWhat SD-WAN Is, and When It Earns Its Place
SD-WAN is an overlay. An edge device at each site sorts traffic into application flows, applies your policies and picks a tunnel across whatever circuits the site has: MPLS, dedicated internet, broadband or cellular. Policy is set centrally, so one change reaches every site. The circuits underneath remain separate services with their own agreements, bought from the SD-WAN provider or from anyone else. The hard choices sit underneath: which circuits, who runs the devices, and how the security purchase ties in.
When it makes sense
- Many sites, each with more than one circuit, running applications that need different treatment, such as voice and point of sale next to bulk file transfer.
- An MPLS network nearing renewal, where internet circuits could carry some or all of the traffic.
- Branches that send most of their traffic to cloud and SaaS applications and would do better breaking out to the internet locally.
- A security refresh that will bring networking and security under one policy model.
When it does not
In our judgment, SD-WAN can wait when:
- A site has one circuit and no second path, so it gains little.
- Traffic goes almost entirely to a few SaaS applications, with little between sites. A good internet circuit and a security service may matter more than a new WAN.
- You are midway through an MPLS term and the exit terms do not allow an early move. Buying now can mean paying for both networks at once.
Sometimes a better internet circuit beats a new network, and that is what we will recommend when it does.
SD-WAN, MPLS or single-provider SASE
| SD-WAN over mixed circuits | MPLS on its own | Single-provider SASE | |
|---|---|---|---|
| What you buy | Edge devices and an overlay, over circuits from any provider | A private network from one carrier | SD-WAN and cloud-delivered security from one provider |
| How traffic picks a path | Your policy, per application, across every circuit | The carrier's network and class of service | One policy model for networking and security |
| Internet access at the branch | Local breakout, set by policy | Not provided by MPLS itself | Through the provider's security cloud |
| The trade-off | More circuits and more design choices to manage | Predictable performance, at a price premium | The security choice also fixes the network choice |
| Best fit | Many sites with mixed circuits and varied applications | Applications that need the carrier's class of service at every site | A network and security refresh due at the same time |
Technical Considerations
SD-WAN moves the decisions from the carrier's network into your policies. These are the ones that decide whether failover works on the day you need it.
Circuits that fail together
Path choice only helps if the circuits fail independently. Two circuits through the same conduit or building entrance go down together, and a second carrier is not a second path until the routes are checked. We check the physical routes before we count a circuit as diverse.
Broadband and cellular underneath
Mass-market business broadband is labeled with typical speeds, not committed ones. Cellular depends on signal at the device, which building construction, terrain and weather all affect, and at least one managed service monitors cellular links less closely to save capacity. The SD-WAN standard from MEF (now Mplify) lets a policy keep named flows off usage-billed links or hold them to private circuits.
Who runs it
Managed services come in levels, and the level decides who controls what. Under one provider's co-management terms, you change some policies through a portal or API, the provider may keep others you cannot see, and you carry the result of your own changes. Under full management, one provider's terms give the customer read-only portal access on some device options. Done yourself, the orchestration, availability and routing are yours.
Encryption is licensed by throughput
In at least one major vendor's licensing, encrypted traffic above a set rate needs an additional license, separate from the bandwidth tier. Size the license to the encrypted traffic you expect, not to the port speed.
Reaching the cloud
Branches can reach cloud workloads over internet tunnels to the cloud provider's VPN gateway, or through SD-WAN appliances running inside the cloud network. Each cloud side has its own routing and tunnel limits, and some vendor path optimization may not work when a tunnel ends on a cloud VPN gateway. A private connection into the cloud is a separate design.
Out-of-band access
When a device loses its links, someone still has to reach it. At least one managed service requires a separate out-of-band path, such as a cellular modem or a second circuit, and voids its service levels if that path is removed.
Software releases
Managed terms can include security patches and forced upgrades while billing other releases as paid changes, and the device maker's rules can limit when new code goes in. Ask how a release is tested before it reaches your sites, and what that testing costs.
Security inspection
When traffic passes through a cloud security service, the WAN provider may watch only whether the tunnel to it is up. An outage or maintenance on the security side can affect your traffic without the WAN provider being told.
Cutover
Confirm each new site is live before its MPLS circuit is disconnected. A federal audit of a network transition found the agency could not tell whether service had been disrupted, in part because it was not told whether new service was active before old circuits came off. We have the provider commit to a site-by-site cutover plan in writing.
What It Changes for IT and Finance
For IT and network leaders: one network, under your policy
- One policy across every site, changed once instead of router by router.
- Each application on the path that suits it, with private circuits kept where they matter.
- Written lines on who changes what, agreed before a managed provider holds the keys to your network.
- Suppliers handled by TREU, not your team, for as long as the agreements run.
For finance: terms that line up
- Every end date on one calendar: the software subscription, hardware support, the managed service and each circuit.
- MPLS exit terms negotiated before migration, so you are not paying for two networks at once.
- Rate cards for changes, site visits and moves agreed before signature, not found on the first invoice.
SD-WAN in Four Stages, With TREU in Each
See how we work-
Supplier identification
We map your sites, circuits, contracts and the applications that matter at each site, then find the carriers, managed providers and vendors that can serve them, wherever your sites are. That includes regional networks that national carriers may not show you.
-
Buying cycle
We decide with you how much to manage yourselves, which traffic stays on private circuits, and whether the security purchase should shape the network choice. We compare designs and terms side by side and negotiate with your legal team, including the exit terms on the network you are leaving.
-
Implementation oversight and accountability
We hold providers to their dates site by site and have them confirm each site is live before old circuits come off. Then we check the first invoice against the contract.
-
Client and supplier lifecycle management
We track the subscription, support, managed service and circuit terms, join your business reviews and start renegotiating early, for as long as the agreements run. We do not monitor the network. We source the providers who do.
What to Watch For in an SD-WAN Contract
An SD-WAN deal is several agreements under one name. These are the terms we negotiate hardest.
-
When the subscription ends.
In at least one vendor's licensing, SD-WAN features stop working when the subscription lapses, leaving only basic routing. Know what your devices will do the day after the term ends.
-
Hardware support and end of life.
The subscription's support may cover only its software features, with hardware support bought separately. Vendors also set end-of-sale and end-of-support dates for each device. A multi-year term should not outlive the support dates of the hardware it runs on.
-
Several end dates.
The software, the hardware support, the managed service and each circuit can end on different dates under different renewal rules, and at least one managed service continues after the commitment until someone gives written notice. In our experience, the work starts months before the notice date, not weeks.
-
Policy rights.
Which policies you can change, which the provider keeps, who carries the result of a change, and whether you get API access. Write it into the management level before you sign.
-
Changes and site visits.
Managed terms often separate included changes from paid ones, and at least one caps changes per month. Get the rate card for changes, dispatches and moves in the contract.
-
License tracking.
When licenses move between devices, agree who tracks them. Managed terms can leave that with you.
-
Service levels above and below.
Each circuit keeps its own service agreement. A service level on the SD-WAN does not replace the circuit service levels, and mass-market broadband is labeled with typical speeds, not committed ones.
-
The way out of MPLS.
Early termination charges on circuits can equal every remaining monthly charge. Portability clauses can waive them when you replace the service with a new term of equal or greater value. Negotiate them before migration starts.
-
Security tie-in.
When one provider supplies both the SD-WAN and the security service, choosing one can fix the other. Check that the two terms end together or can be separated.
This list is a starting point for your review. TREU is not a law firm. Your counsel gives the legal advice.
Questions Buyers Ask About SD-WAN
What is the difference between SD-WAN and MPLS?
MPLS is a transport: a private network a carrier runs, which keeps your routes separate from other customers' routes across its backbone. SD-WAN is an overlay. It runs across whatever transports a site has, MPLS included, and chooses a path for each application by policy. The two can run together.
Do we have to give up MPLS?
No. The MEF standard for SD-WAN lets a policy hold named applications to private circuits while other traffic uses the internet. Keeping some MPLS or Ethernet is a design choice, made application by application, where predictable performance is worth the price.
Is broadband good enough as an SD-WAN circuit?
In our judgment, often, as a second path or at a small site. Mass-market broadband is labeled with typical speeds, not committed ones, so match each site's circuits to the applications that run there, and check that two circuits do not share one route into the building.
Can 5G be our primary link?
In our judgment, cellular works well as a backup or as a fast first link at a new site. As the only link, it needs a signal survey at each site, an answer on usage billing, and a check on what the managed service can still monitor over cellular.
Should we choose managed, co-managed or run it ourselves?
In our judgment, full management fits a lean network team or a large branch estate. Co-management fits a team that wants to own policy without running devices around the clock. Running it yourself fits a strong team with its own operations center that wants direct control and vendor choice. Whichever you choose, the division of responsibility should be written into the contract.
What is MEF 70, and should we ask for it?
MEF 70 is the standards series that defines an SD-WAN service and what the buyer should see from it, published by MEF. The current version is MEF 70.2, published in October 2023. MEF also certifies SD-WAN services. Asking whether a service is certified gives you a common vocabulary for comparing providers, though certification does not prove the service fits your sites.
Do we need SASE now?
SASE combines SD-WAN and cloud-delivered security under one policy model, so the two purchases shape each other. In our judgment, it is worth deciding together when your network and security contracts come due around the same time. If they end years apart, buying both from one provider can lock in the earlier choice. The security services themselves are a separate purchase, covered under Cybersecurity.
Does TREU monitor our SD-WAN?
No. TREU sources the provider that runs and monitors your network, holds it to its commitments through installation, acceptance and the first invoice, then tracks every term, joins your business reviews and renegotiates renewals for the life of the agreement. Service issues go to the provider first, and we can help in certain cases.