SD‑WAN (software-defined wide area network) is a way of running a multi-location business network through software instead of fixed hardware routes. It combines broadband, 5G, LTE, satellite, and MPLS links, then sends each application over the path that best fits its needs.
A central controller sets the rules and every site follows them. IT gets one view of the whole network instead of a router-by-router puzzle. The result is faster cloud applications, fewer outages, and a network that grows as fast as the business opens new locations.
Momentum is a managed service provider that delivers Juniper Networks, Cisco Meraki, Arista Networks, and Cato Networks SD‑WAN as Network as a Service, with design, deployment, and ongoing management included.
What created the need for SD‑WAN?
SD‑WAN exists because business applications moved to the cloud while traditional WANs kept sending traffic through a central data center. That detour slows cloud apps, congests the hub, and makes every new site expensive to connect.
The traditional WAN was designed around one assumption: every application lives in a central data center. Branch offices connected to headquarters over private MPLS circuits, and security sat at that single hub.
That assumption no longer holds. Email runs in Microsoft 365. Calls run in Microsoft Teams. Customer records live in Salesforce, and workloads run in AWS and Azure. Traffic that used to stay inside the corporate network now heads straight for the internet.
Routing cloud traffic back through headquarters creates three problems:
- Delay: A Teams call from a branch travels to HQ, out to the internet, and back again. Every extra hop adds latency and jitter that users hear.
- Congestion: The hub circuit becomes a bottleneck as every site competes for the same pipe.
- Cost: Adding MPLS bandwidth or new MPLS sites is slow and expensive compared with business internet.
Microsoft makes the same point in its own guidance. Its network planning documentation for Teams recommends routing Teams traffic around the VPN and using local or regional internet egress to reach Microsoft data centers. Local breakout at each site is exactly what SD‑WAN is built to do.
Hybrid work added a fourth problem. Employees now connect from home offices, clinics, job sites, and hotel rooms, not only from branches. A network built for fixed sites can't see or manage those users.
SD‑WAN was built to close that gap. It lets each location use the connections it has, reach cloud applications directly, and follow one set of policies managed from the center.
How does SD‑WAN work?
SD‑WAN works by measuring every network link at every site in real time and sending each application over the path that best meets its needs. A central cloud controller sets those rules once and pushes them to every location.
SD‑WAN places a software layer, called an overlay, on top of the physical connections at each site. The physical links underneath are the underlay. SD‑WAN doesn't care what the underlay is. It treats every link as a resource and decides, application by application, which one to use.
Here's what happens every second at each site:
- 1The edge device identifies the applicationIt recognizes a Teams call, a card payment, a video stream, or a backup job as the traffic leaves the site.
- 2It measures every linkLatency, jitter, and packet loss are tracked on each connection in real time.
- 3It matches the app to the best pathPolicy says voice needs low jitter, so the call rides the cleanest link. A backup can take whatever capacity is left.
- 4It reroutes when a link degradesIf the fiber circuit drops, traffic shifts to 5G or broadband. Depending on the platform, an active call can move without dropping.
- 5The controller keeps every site in syncIT changes a policy once, and every location picks it up.
The key design idea is separating the control plane from the data plane. The control plane decides how traffic should flow and lives in the cloud. The data plane moves packets and lives at each site. That split is what lets one team run hundreds of locations.
What is SD‑WAN architecture?
SD‑WAN architecture has three core parts: an edge device at each site, a central controller that decides how traffic should flow, and a management console IT uses to run every location. Underneath sit the internet, 5G, and MPLS links that the edge devices steer traffic across.
Core components
- Edge device: The physical or virtual appliance at each site. It connects to the local network and the WAN links, and it enforces policy on every packet.
- Controller: The brain. It watches network conditions, calculates the best paths, and tells every edge device what to do.
- Orchestrator or management console: The single interface IT uses to build templates, push configuration, roll out updates, and see analytics across every site.
- Gateways and points of presence (PoPs): Optional cloud nodes that optimize traffic to SaaS and public cloud, or connect sites that can't reach each other directly.
- Underlay: The actual transport links. Fiber, dedicated internet, broadband, 5G, LTE, satellite, and MPLS all qualify.
Types of SD‑WAN architecture
Common topologies
What are the benefits of SD‑WAN?
The main benefits of SD‑WAN are faster cloud application performance, higher uptime through automatic failover, lower connectivity costs, faster site openings, and simpler management from one console.
Where AI-driven SD‑WAN adds more
Some platforms layer AI operations on top of routing. Juniper Networks' Marvis assistant, for example, answers plain-language questions like why Zoom keeps dropping in one building, then points to the root cause. For lean IT teams, that turns hours of troubleshooting into minutes.
What are the challenges of SD‑WAN?
The biggest SD‑WAN challenges are choosing the right platform, the quality of the internet links underneath, security gaps from direct internet access, and the ongoing work of running the network. Each one has a clear fix when it's planned for up front.
What are the SD‑WAN management models?
There are four main SD‑WAN management models: DIY, co-managed, fully managed, and Network as a Service (NaaS). The right one depends on the size of your IT team and how much control you want to keep.
Momentum delivers every SD‑WAN platform it offers as NaaS, with management included from day one. Hardware is rented, licensing is simplified, and co-managed options are available for teams that want hands on the controls.
How secure is SD‑WAN?
SD‑WAN is more secure than an unmanaged internet connection, but on its own it isn't a complete security solution. How secure it is depends on the platform and how it's deployed.
What most SD‑WAN platforms include
- Encrypted overlay tunnels between sites, so traffic crossing the public internet stays private.
- Segmentation that keeps guest Wi-Fi, point-of-sale, IoT devices, and corporate traffic apart.
- Stateful firewalling and access control lists at the edge.
- Centralized policy, which removes the configuration drift that happens when every router is set up by hand.
Where gaps appear
When each branch sends traffic straight to the internet, each branch becomes an entry point. Remote users outside any site aren't covered at all. SaaS usage, data movement, and web threats need inspection that basic SD‑WAN doesn't provide.
How organizations close them
The stakes keep rising. IBM's 2026 Cost of a Data Breach Report puts the global average cost of a breach at a record $4.99 million, up 12% from the year before. Organizations that use AI and automation extensively in security save an average of $1.93 million compared with those that use none.
What is the role of SD‑WAN in SASE?
SASE (secure access service edge) combines networking and security into one cloud-delivered service. SD‑WAN is the networking half. The security half is often called SSE (security service edge).
Gartner projects that by 2027, 65% of new SD‑WAN purchases will be part of a single-vendor SASE offering, up from 20% in 2024.
- SD‑WAN gets traffic from every site onto the best path.
- SSE services inspect that traffic and verify every user and device before granting access.
- One policy follows the user, whether they're in a branch, at home, or on the road.
Most organizations don't adopt SASE in one step. Common starting points include:
How do SD‑WAN platforms compare?
There's no single best SD‑WAN. Each leading platform is built around a different priority, so the right choice depends on your sites, your IT team, and your security plans. Momentum delivers four of them as a managed service, which lets the recommendation follow your requirements rather than a vendor quota.
Worked with the Momentum Channel Team on customer quotes and received responses and recommendations quickly and accurately.
Side by side
Questions that point to the right platform
Not sure which fits? Get a platform recommendation mapped to your sites and apps.
Talk to an SD‑WAN expertSD‑WAN vs MPLS, VPN, SASE, and NaaS
SD‑WAN manages traffic across many links and sites. MPLS is a private carrier circuit, a VPN is a single encrypted tunnel, SASE adds cloud-delivered security to SD‑WAN, and NaaS is a way to buy the whole network as a subscription.
These aren't always either-or choices. SD‑WAN can run over MPLS, sit inside a SASE platform, and be delivered as NaaS all at once.
SD‑WAN FAQs
Software-defined wide area network. "Software-defined" means routing decisions come from central software policy rather than being set by hand on each router.
It manages every WAN link at every site, sends each application over the best available path, and fails over automatically when a link degrades, all from one console.
A retail chain runs fiber and 5G at each store. Card payments and Teams calls get the cleanest link, guest Wi-Fi gets what's left, and if the fiber drops the store keeps taking payments over 5G.
A traditional WAN uses fixed routes, often over MPLS, back to a central hub. SD‑WAN uses software to steer traffic across any mix of links, including direct paths to cloud apps.
No. A VPN is one encrypted tunnel between two points. SD‑WAN manages many links across many sites and picks paths per application, using encrypted tunnels as one part of the job.
It can, but it doesn't have to. SD‑WAN runs over MPLS, broadband, and 5G at the same time, so many organizations keep MPLS at critical sites and retire it elsewhere as contracts end.
In most branches, yes. The SD‑WAN edge device handles routing plus application policy, encryption, and often firewalling. Complex cores and data centers may still use dedicated routers.
It encrypts traffic between sites and supports segmentation and firewalling. For remote users, SaaS security, and threat inspection, pair it with secure SD‑WAN features or SASE.
MPLS is private but doesn't inspect traffic for threats. SD‑WAN with integrated security or SASE offers broader protection, especially for cloud and internet traffic.
It depends on the quality of the underlying links, it can be harder to troubleshoot without strong analytics, and it needs added security for direct internet access. A managed provider addresses all three.
Yes. SD‑WAN is the networking layer inside SASE. Most SASE platforms include SD‑WAN, and many organizations deploy SD‑WAN first and add SASE security over time.
A single site can come online in days with zero-touch provisioning. A full multi-site rollout depends on site count, circuit lead times, and design complexity.
Cost depends on site count, bandwidth, platform, and management model. With NaaS, hardware, licensing, and management roll into a predictable monthly price per site.
A provider designs, deploys, monitors, and supports the network for you. At Momentum, management is included with every platform as part of Network as a Service.
Any platform with application-aware routing can prioritize Teams. Juniper adds SLA assurance for Teams calls, and Momentum can manage both the network and Teams Phone under one team.
Yes. SD‑WAN treats 5G, LTE, and satellite as additional links, which makes them strong options for failover, remote sites, and temporary locations.