Glossary · simply explained

SD-WAN (Software-Defined WAN)

SD-WAN controls site connectivity in software: traffic automatically takes the best path over internet, fibre or mobile — centrally managed, encrypted and more flexible than rigid MPLS lines.

SD-WAN stands for Software-Defined Wide Area Network — put simply: your site connectivity is controlled by software instead of rigid individual lines. A central controller decides for every application which path its traffic takes: internet access, fibre, cable or mobile (LTE/5G).

Key takeaways

  • SD-WAN steers site connectivity in software: applications automatically take the best path available.
  • Any lines can be combined — internet, LTE/5G, MPLS: the best line per site, with redundancy.
  • Central management instead of per-site configuration: policies apply everywhere, new sites connect quickly.
  • The most common trigger in practice: expiring MPLS contracts and cloud services throttled through the head office.

How SD-WAN works

SD-WAN places an encrypted overlay over any access lines. Policies are defined centrally ("prioritise video calls, backups at night") and enforced automatically at every site. If a line fails or its quality drops, traffic switches to the next-best path without interruption.

What SD-WAN delivers

  • Performance: applications automatically take the fastest available path — essential for cloud, SaaS and video conferencing.
  • Resilience: multiple lines per site, automatic failover within seconds.
  • Cost: affordable internet lines replace or complement expensive MPLS circuits.
  • Oversight: one central dashboard for all sites instead of device-by-device configuration.

Limits and challenges

SD-WAN is not a sure-fire success — these points decide project outcomes:

  • Quality stands and falls with the underlying lines: without clean underlay planning, the overlay inherits every weakness.
  • Design and policies take experience: misconfigurations cost performance or tear open security gaps.
  • The initial investment in devices, licences and migration needs to be calculated — as a managed service it becomes a predictable monthly amount.
  • Legacy systems and special cases such as legacy protocols or OT networks deserve a close look before the rollout.

Typical use cases

SD-WAN plays strongest where many sites with different lines come together: branch and industrial networks, changing spaces down to construction sites, international rollouts. Two case studies show what that looks like in practice: fully managed SD-WAN across 250+ sites down to the construction site and a rollout across twelve countries with one access and security model.

SD-WAN and SASE

SD-WAN solves connectivity — security joins in when SD-WAN converges with security services such as ZTNA, Secure Web Gateway and CASB into SASE/SSE: networking and security from one cloud, one policy set.

KAEMI designs, implements and operates SD-WAN as a managed service — from site analysis and provider management to 24/7 operations, on platforms such as Cisco Meraki and Juniper.

Frequently asked questions about SD-WAN (Software-Defined WAN)

What is the difference between SD-WAN and MPLS?

MPLS is a dedicated carrier-operated line technology with guaranteed quality but high cost and long lead times. SD-WAN uses any access lines (including internet) and controls quality in software — more flexible, faster to roll out and usually far cheaper.

Is SD-WAN secure?

Transport is encrypted. Full security (access control, web filtering, data protection policies) comes when SD-WAN is combined with SSE services into SASE — networking and security in one platform.

What is the difference between SD-WAN and SASE?

SD-WAN is the connectivity building block. SASE unites SD-WAN with cloud security services (ZTNA, SWG, CASB, DLP) into one platform — SD-WAN is part of SASE, not a competitor.

More terms

Security Breach explained simply

A security breach occurs when protective measures have actually been broken through and unauthorized parties have gained access to systems or data. The term is narrower than that of an incident and triggers concrete obligations, from the GDPR report within 72 hours to informing those affected.

SASE/SSE explained simply

SASE/SSE shifts network and security functions into a shared cloud platform that serves users and sites at the nearest access point. Building blocks such as ZTNA, Secure Web Gateway, CASB and Firewall as a Service replace the central appliance in the data center.

Security Operations Center (SOC) explained simply

A security operations center continuously monitors the IT environment, assesses alerts and responds to incidents before anomalies turn into larger damage. This article explains tasks, roles and tools as well as the decision between an internal and a managed SOC.

Want to put “SD-WAN” into practice in your own network? Talk to KAEMI, aligned to your requirements and with a managed service from a single source.