What is SD-WAN?

Software-Defined WAN (SD-WAN) decouples network control from the underlying physical transport, using centralized policy and application-aware routing to steer traffic dynamically across internet, MPLS, and LTE links through an encrypted virtual overlay – replacing rigid, manually provisioned WAN circuits with software-defined paths chosen in real time.

Key takeaways

• SD-WAN steers traffic across links based on real-time performance.
• Centralized policy replaces box-by-box router configuration.
• Traffic rides an encrypted overlay independent of the underlying transport.
• Application-aware routing picks the best path per app, not per link.
• Direct internet access lets branches break out locally instead of backhauling.

On this page: Why it matters · How it works · Types · SD-WAN & Versa · FAQ

Why is SD-WAN important?

Applications moved to the cloud and traffic shifted from data-center-bound to internet-bound, but most WANs were still built around expensive, statically provisioned MPLS circuits with box-by-box CLI configuration. SD-WAN matters because it decouples routing intelligence from the transport: a central controller pushes policy to every site, and each site steers traffic dynamically across whatever links it has based on real-time path quality, not a fixed routing table.

The payoff is flexibility and cost. Instead of provisioning an expensive MPLS circuit per site, teams mix cheaper broadband links with SD-WAN policy that guarantees application performance through SLA-based path selection. That same abstraction enables direct internet access at the branch and application-aware routing for latency-sensitive traffic – and it is the foundation SASE has since built on top of.

What is SD-WAN?

SD-WAN builds an encrypted virtual overlay across one or more physical WAN transports, so applications see a stable, policy-controlled network regardless of which underlay link carries the traffic at any moment. Two things make this possible: overlay tunnels – typically IPsec, sometimes a clear-text tunnel for already-trusted transports – connect every site to every other site or hub it needs to reach; and a centralized orchestration layer defines policy once and pushes it everywhere, instead of configuring each router by hand.

SD-WAN also measures each path’s latency, jitter, loss, and availability, then steers traffic per application: a voice call takes the lowest-latency path while a bulk backup takes the cheapest, rerouting automatically once a path falls out of SLA compliance. This is what lets an SD-WAN network span internet, MPLS, and LTE links interchangeably.

Types of SD-WAN

SD-WAN deployments settle into a handful of overlay topologies, chosen per site based on how much those sites need to talk to each other. Hub-and-spoke routes branch-to-branch traffic through a central hub – simplest to secure and inspect, at the cost of extra latency between branches. Full mesh builds direct tunnels between every branch, minimizing latency but multiplying tunnels as the network grows. Regional mesh is a middle ground: full mesh within a region, hub-and-spoke between regions. Multi-VRF (multitenant) deployments layer several isolated routing domains – one per tenant – onto the same edge devices and overlay, each with its own topology and policy. Most production networks combine these patterns rather than picking just one.

SD-WAN & Versa

Versa Secure SD-WAN implements SD-WAN as a converged software function on the Versa Operating System (VOS), not as a single-purpose appliance. Each VOS edge device builds encrypted overlay tunnels – by default IPsec, with a clear-text tunnel where the underlay is already trusted – to Controller nodes and other branches, forming full-mesh, hub-and-spoke, regional-mesh, or multi-VRF topologies. Traffic steering runs on SD-WAN policies bound to forwarding profiles: each profile ranks circuits by priority and SLA compliance, so a voice call and a bulk transfer can take different paths across the same links.

The headend – Director for orchestration, Controllers for control-plane relay, Analytics for telemetry – pushes and monitors this policy centrally, while branches react to path degradation locally. Branches also support direct internet access for local SaaS breakout, and LTE links can run hot- or cold-standby as a cost-controlled backup. See the Consolidated SD-WAN Design Guide for the full reference architecture.

Frequently asked questions

What is the difference between SD-WAN and traditional WAN?

Traditional WAN routes traffic over statically configured, often single-transport links – typically MPLS – with manual, box-by-box configuration. SD-WAN abstracts multiple transports into a centrally managed overlay that steers traffic dynamically per application, based on each link’s real-time measured performance.

What is the difference between SD-WAN and SASE?

SD-WAN is the networking layer: encrypted overlays and application-aware traffic steering across WAN links. SASE adds cloud-delivered security – SWG, CASB, ZTNA, DLP – converged with that layer, so SD-WAN is one half of a SASE architecture, not a replacement for it.

Does SD-WAN replace MPLS entirely?

Not necessarily. SD-WAN can run over MPLS as one of several transports, or replace it outright with broadband internet. Many enterprises keep MPLS for latency-sensitive traffic while adding internet and LTE circuits under SD-WAN control, migrating away from MPLS as broadband SLA confidence grows.

How does SD-WAN choose which path traffic takes?

SD-WAN measures each path’s latency, jitter, packet loss, and availability through SLA probes, then matches traffic to a path using policy – by application, user, or destination – defined in a forwarding profile. A path that falls out of SLA compliance is dropped for the next-priority one automatically.

Is SD-WAN secure by default?

Traffic on an SD-WAN overlay is typically encrypted end-to-end via IPsec, so the transport itself is secure. But SD-WAN alone does not include threat inspection, web filtering, or access control – those need an integrated firewall or a broader SASE architecture layered on top.

More on SD-WAN

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about SD-WAN, these are worth looking at next.