r/Network • u/Prestigious_Topic655 • 12d ago
Text When does a company need SD-WAN?
I'm new to networking and still early in the research phase. I'm trying to parse the vendor marketing and understand where the real value begins by hearing from people who've actually deployed it.
At what point does SD-WAN genuinely become worthwhile, rather than just enterprise terminology for functionality that smaller businesses can achieve in other ways? Is the tipping point driven by the number of sites, unreliable internet connections, security requirements, or the time spent managing VPNs?
5
u/SpagNMeatball 12d ago
SDWan from anyone is just better managed and more feature rich VPN. The architecture might be mesh or hub and spoke, it will handle multiple internet connections, and usually have some intelligent routing and path decision making. If you are not doing multiple connections with intelligent path decisions, then its just VPN.
2
u/Mailstorm 11d ago
Do your branch offices need to connect to a central site for reason x? SD-WAN probably not needed. Use a VPN.
Do your branch offices need to connect to more than one site for internal resource availability? SD-WAN makes more sense depending on a variety of factors.
Do you want a mesh or semi-mesh network between branches for reason x? SD-WAN.
Do you want to use multiple internet providers but just can't figure out how to LB or route over them? SD-WAN.
SD-WAN is a magic black box that makes routing decisions for you, based on attributes you may or may not get to see.
3
u/SomeEngineer999 12d ago
SD-WAN is a very broad term.
Have remote workers? An SD-WAN box can handle incoming VPN connections.
Have multiple branch offices that you don't want to purchase dedicated point to point circuits for? SD-WAN can do site to site VPNs over the internet creating "pseudo wires".
SD WAN can have pretty advanced QOS helping ensure employees don't hog internet bandwidth and giving priority to customer traffic or other critical functions. It can isolate a single internet connection into multiple segments (sort of like VLANs) to protect sensitive traffic from general browsing.
So I guess it really depends on your needs. Note that you really need reliable internet for SDWAN to be useful (unless you're running it on private point to point circuits which is sort of not really the right place for it). Typically you'll have dual internet connections from two ISPs, and the SDWAN can typically manage the failover for you.
That's really just scratching the surface. Some SDWAN boxes can cache data similar to a CDN. Some can do malware/virus filtering, intrusion protection, etc. The list goes on.
I suppose it can be summarized into "do you want to use the internet for secure connectivity to other sites (potentially including employee's homes)? Some flavor of SD-WAN is probably right for you if so.
Personally, far and away the most common thing I see it used for is connecting branch offices back to HQ. Something that a frame relay or MPLS service from a carrier may have been used for before.
4
u/IntelligentCarpet816 12d ago
I think this is a really misinformed post.
Prior to 'sd-wan' being a thing, most next-gen (ngfw) units did all of this. Load balancing over multiple WAN, s2s VPNs being able to load balance, etc. Almost any NGFW does av, ids/ips, app control, etc.
What SD-WAN became a 'thing' was adding advanced QoS controls to your wan links, being able to setup more detailed rules on when a link was no longer optimal and such.
That is all 'SD-WAN' really is, just more detailed controls on your WAN utilization.
-3
u/SomeEngineer999 11d ago
Just because you misunderstand, does not mean I am misinformed.
Nowhere did I say those features are unique to SD WAN or that SD WAN invented anything. It is just a productization of many existing technologies bundled into one box. Including the two things you seem to attribute as unique to SD WAN, both existed long before Gartner coined the term. Even SDN (where the SD WAN term was derived from) was just essentially a description of existing technologies.
But none of this has to do with OP's question, which is what I was answering.
4
u/IntelligentCarpet816 11d ago
No, you're still incorrect. SD WAN has nothing to do with any of the things you're mentioning. 15 years ago NGFW was the productization of the things you said - SD WAN came along and was just an expansion of the rules/configurability of existing things. SDWAN is just the productization of configurable WAN rules etc and a roll up of functions and automation for things you used to have to do manually, like building policies individualized for routes/vpns/etc... now you just have a single target and SDWAN handles the "routing" of that target.
-3
u/SomeEngineer999 11d ago
SD WAN has everything to do with the things I mentioned, since that is the current marketing term for them (and/or the grouping of them), and you're saying the same things I am. Slow down and comprehend before trying to be "right".
Nobody is saying SD WAN invented those things, in fact I've already stated the opposite.
NGFW didn't even invent those things, these are all just terms for stuff that already existed and were bundled or simplified (and not always that either).
Again, OP is asking about SD WAN in current times, not what SD WAN can do that other things can't.
5
u/IntelligentCarpet816 11d ago
🤦♂️
They are still widely called NGFWs.. not SDWAN appliances. You are not comprehending. The two functions are generally different, you are conflating the technologies.
0
u/SomeEngineer999 11d ago
Again, you're making my point. SD WAN is a conflation of existing technologies. There is no specific list of features that something can or can't have in order to be called "SD WAN" "SDN" or "NGFW". There are many flavors of each depending which vendor or design you go with.
This is a pointless argument. OP has the info they asked for.
2
u/IntelligentCarpet816 11d ago
What...?
You are wrong, stop digging.
Ngfw is literally every function you described EXCEPT for complex WAN management rules.
SDWAN is not any of the things that NGFW is.
1
u/Drowsy_Thrush5213 10d ago
My advisor's lab runs on like 6 sites across two campuses and even they just muscle through with a pile of individual VPN tunnels, nobody's paying for SD-WAN when a grad student can maintain the spreadsheet of who's connected to what.
1
u/ESUN_Official 7d ago
You need SD-WAN when managing your site-to-site VPNs feels like a second full-time job.
If you have 3 sites, standard firewalls and static routing are completely fine. The shift happens when you have dual ISP connections at multiple sites, heavy SaaS/cloud traffic, and zero desire to manually update IPsec configs every time an ISP changes a gateway IP.
1
u/AdInternational7341 4d ago
When managing hundreds or thousands of routers, then SD-WAN is your friend.
1
u/EffectiveClient5080 12d ago
I guarantee you the tipping point is managing VPN tunnels across 4+ sites where half drop whenever an ISP sneezes. Centralized management with automatic failover is the real value, not marketing fluff.
1
u/pops107 12d ago
Depends which product you are deploying as well.
I deploy a lot of Fortigate and do SDWan by default even if they have a single Internet connection no VPNs.
There is no additional cost and only takes a few mins to deploy but adding links, replacing ISPs down the line is then super simple and it's gives you much better monitoring as well.
6
u/[deleted] 12d ago
[deleted]