Jump to section

What is SD-WAN?

Copy URL

SD-WAN is an acronym for software-defined wide area network. It typically replaces the connectivity of traditional branch routers with virtualized or appliance-based software that routes traffic to/from remote locations in a seamless, secure and efficient manner, using centralized policy control and management.

Virtualization decouples the networking and control functions from the physical hardware device. The control layer, i.e. network and security monitoring and management, moves to a virtualized central controller—allowing network managers to configure services and control traffic based on centralized policies and rules.

SD-WAN does not replace physical WAN connectivity. It creates an intelligent, end-to-end network fabric that connects session communications in a more logical, granular, and cost-effective way across all parts of the network. SD-WAN can be deployed in a number of configurations that make it highly adaptable and cost-effective. It allows companies to build higher-performance WANs using lower-cost and commercially available hardware (COTS) and internet access. This is because SD-WAN:

  • Does not require proprietary hardware to deliver communications network functions.

  • Is software-based and managed directly by in-house staff or consumed in a managed service offering.

  • Is highly elastic because it uses cloud-native software and internet connections that can be spun up and down based on demand.

With today’s bandwidth-consuming, distributed, cloud-based  applications, sometimes you might need a combination of both highly reliable but expensive multiprotocol label switching (MPLS) and lower cost but best-effort internet connections to maintain service levels and stay flexible. SD-WAN makes it possible to leverage the benefits of both technologies.

Cloud-based systems and services and the use of public clouds have accelerated digital transformation. As a result, many organizations find that their needs have grown beyond what their traditional WAN can deliver, in part, because a significant amount of communications extend beyond a well-defined set of locations. In many cases the growth in data traffic has exceeded their network capacity often creating latency and bottlenecks that slow traditional WANs to a crawl. This is a critical issue in a digitally-enabled world where employees, customers, and other stakeholders demand better experiences

While technologies like cloud computing, mobile devices, internet of things (IoT), and artificial intelligence (AI) are dramatically improving business processes, product and service offerings, and engagement with customers, partners, and employees, they can also increase bandwidth demands. Attack surfaces are also increased, requiring security to be extended to include application level visibility for programmable and dynamic protection. Addressing these factors increases network complexity and that can negatively impact security and application performance, manageability, and costs

In traditional WANs the routing was defined to simply provide secure, private connections between known sites, typically corporate, partner, and vendor locations. A small number of the corporate locations would provide access to and from the internet for corporate users. Today’s SD-WANs use application-aware routing to optimize performance and security over both private and public internet connections.

SD-WAN architecture, defined by the MEF Forum (a non-profit industry consortium), consists of an SD-WAN Edge, SD-WAN Controller, and SD-WAN Orchestrator.

  • The SD-WAN Edge is a physical or virtualized network function (VNF) that can be deployed at an organization's branch/regional/central office site, datacenter, and/or in public or private cloud platforms.

  • The SD-WAN Controller centralizes security and management. It lets operators manage the network through a single pane of glass and set policy for the orchestrator to execute.

  • The SD-WAN Orchestrator is the virtualized manager for the network that oversees traffic and the application of policy and protocols set by the network operators.

  • The SD WAN Orchestrator and Controller dynamically manage the flow of data and determine the priority level of applications. Some traffic is bound for internet locations and does not typically need to remain on the corporate network, e.g., SaaS applications, general web traffic, and access to public cloud resources—but rather use the internet directly, possibly through a VPN connection. Traffic from business-critical applications and other high-priority communications, like VoIP calls, can remain on traditional corporate WAN connections (e.g., MPLS) for security, privacy, and performance.

Key SD-WAN features include application-based policy configuration, automated application recognition, path selection among multiple fixed and/or wireless links, and support for multiple routing protocols and architectures.

There are three main types of SD-WAN architecture: on-premises, cloud-enabled, and cloud-enabled with a backbone. They can either be self deployed and self managed or outsourced under a managed services agreement.

  • On-premises SD-WAN: SD-WAN hardware resides in an enterprise’s locations, whether self-managed or managed remotely by an SD-WAN service provider.

  • Cloud-enabled SD-WAN: SD-WAN locations connect to a virtual cloud gateway over the internet. This architecture can offer better performance when accessing cloud-based  applications.

  • Cloud-enabled with backbone SD-WAN: This architecture adds a private connection to a cloud-enabled SD-WAN, allowing traffic to dynamically switch between it and the public internet based on policy and protocols. The private connection improves SD-WAN security, adds bandwidth that helps deliver more consistent performance during traffic spikes, and provides backup when the public connection fails.

SD-WAN routing policies are used to send traffic over the fastest connection that meets the traffic’s security requirements, application needs, and SLA goals. It uses defined policies and contextual data to determine how to route traffic from where it originates to its destination and back. The contextual path selection parameters include: defined policy, type of device generating the traffic, application performance, application SLA requirement, WAN connection performance, and end-to-end performance.

The path decision with SD-WAN is dynamic and responsive—quickly adapting to changing conditions. For resiliency, when one connection goes down, SD-WAN policies automatically redirect traffic to a different available connection. Best practice for resilient critical site communications is to have physical connections from more than one CSP included in your SD-WAN architecture. If your primary CSP has an outage, traffic can use another CSP’s connection.

SD-WAN has the ability to extend existing software-defined and application-specific security policies into remote locations. For example, micro-segmentation, URL blacklisting, web filtering to combat phishing, and access to programmed security service chains.

Lower cost

  • Reduced capital expenditures (CapEx) and operating expenses (OpEx) at the WAN edge. SD-WANs run in the cloud or on COTS.

  • Less overprovisioning. SD-WANs use existing bandwidth more efficiently so you do not have to pay for unneeded capacity.

  • Increased bandwidth at lower cost. With more cost-effective internet access complementing dedicated WAN circuits, SD-WAN intelligent routing sends the right traffic through the best routes.

Improved application performance

  • Application-aware, intelligent routing optimizes application performance over private, internet, or hybrid connections with direct, highly secure access to both corporate on-network  and cloud applications. 

  • Quality of service (QoS) thresholds can be set for public and private connections without sacrificing performance or security. 

  • Dynamic path selection can send an application on a faster connection, or even split an application between two paths to improve performance by delivering it faster.

  • Granular application analytics can be used to improve quality of service and for future capacity planning.

Simplified operations

  • Ease of deploying upgrades and changes. The proprietary appliances associated with traditional WANs limited flexibility and made upgrades and changes slow and costly. Software-based architecture and centralized management vastly simplify SD-WAN ongoing maintenance and upgrades. 

  • Accelerated feature release. Cloud-native architecture supports DevOps, Agile, and continuous integration/continuous delivery (CI/CD), allowing fail-fast build-test-run iterations for new SD-WAN features. You can also easily integrate third-party products with SD-WAN open APIs.

  • Automated provisioning and configuration. While configuring every networking device at every branch office for traditional WANs has improved from the days of manually doing it in person, SD-WAN automated provisioning and configuration—which can be zero touch in some instances— dramatically reduces configuration and deployment complexity, time, and expense. 

  • Single pane of glass observability. Next-generation software platform management tools allow you to manage infrastructure from the same console, providing full network visibility that reduces management complexity and mean time to repair (MTTR).

Increased opportunity for service providers

  • Accelerate time-to-market through faster new service delivery and improved provisioning efficiency.

  • Expand total addressable market by extending private and public cloud connectivity to a wider variety of enterprise customers.

  • Bundle or offer additional services that include voice, productivity, and collaboration tools.

Choice and flexibility

  • Solutions tailored to your needs and capabilities. You can design, build, deploy and manage a SD-WAN deployment in-house or outsource to a fully managed service provider but still keeping control over key parameters to tune for your business needs. Service providers also provide choices that can create better SLA delivery, lower cost, more agile responsiveness to customers, and better visibility, security, and manageability.

Streamlined security

  • Broad set of security features available with SD-WAN solutions that allow you to streamline enforcement of security policies. SD-WAN can also provide an extra layer of security using encryption and tunneling over public internet connections when necessary. 

Improved agility, scalability, and flexibility

  • Software-based approach that allows administrators to quickly provision new branch offices, and dynamically configure network and security functions. With SD-WAN you can also quickly adapt to changing market conditions with flexible hybrid SD-WAN designs on a site-by-site basis. 

  • Network resources that scale on the fly and spin up services on demand according to your application needs. You can also control your traffic and prioritize key applications, so you can keep cloud applications running smoothly and improve user experience. 

Building a SD-WAN on open source software offers a wide range of benefits. Development teams innovate faster because open source makes it easy to mix and match industry-leading solutions from a wide variety of vendors to add new network functions, features, and technologies. In addition, open source support for containers and methodologies like Agile, DevOps, and CI/CD dramatically reduces deployment and life-cycle management intervals. 

Kubernetes is the dominant container infrastructure orchestration technology, and Red Hat® OpenShift® is a leading commercial Kubernetes solution. Red Hat OpenShift provides management capabilities for cloud native network functions like SD-WAN. Integration between Red Hat OpenShift and SD-WAN solutions from Red Hat ecosystem partners simplifies the connectivity among customer branch office installations with private and multi-cloud infrastructure. And, with Red Hat OpenShift you can use the same tools to manage both internal and external infrastructure from a single pane of glass.

Red Hat® Ansible® Automation Platform is a foundation for building and operating automation across an organization. The platform includes all the tools needed to implement enterprise-wide automation.

These Red Hat platforms are built on a Red Hat® Enterprise Linux® (the leading commercial Linux distribution) foundation, so the security, reliability, performance, ecosystem, and other benefits of Red Hat Enterprise Linux apply up through the entire stack. Red Hat platforms provide a standard operating environment for VNFs across telco and enterprise datacenters, branch offices, clouds with common life-cycle management, provisioning, tool sets, and automation. 

SD-WAN allows you to extend your application and security policies beyond traditional boundaries. Enhanced visibility and analytics gives you greater control over users, devices and applications regardless of location. 

Keep reading


IoT and edge computing

IoT needs compute power closer to where a physical device or data source is located. Edge computing provides that local source of processing and storage for IoT.


What is edge computing?

Edge computing is computing that takes place at or near the physical location of either the user or the source of the data.


Edge computing for telco

Edge computing is a priority for many telco service providers as they modernize their networks and seek new sources of revenue.

More about edge


A stable, proven foundation that’s versatile enough for rolling out new applications, virtualizing environments, and creating a more secure hybrid cloud.

An enterprise application platform with a unified set of tested services for bringing apps to market on your choice of infrastructure.

A portfolio of enterprise software optimized for lightweight deployment at the edge.



Edge computing in action: Space


Command Line Heroes Season 8, Episode 8:
"Robots and vehicles"


Gain a competitive edge with your container strategy