SD-WAN — implementation and management

Companies with 5+ branches lose 30-50% of networking budget to MPLS

Keeping MPLS at every location costs a multiple of an ordinary internet link of the same bandwidth — and it is that gap, not the technology, that triggers the migration.

Why do companies still pay for MPLS?

• Concern about SLA for critical applications (VoIP, ERP, videoconferencing)
• Complexity of managing multiple links
• Lack of application visibility (which traffic goes through which link)
• Security — firewall at each branch edge

SD-WAN solves all these concerns — intelligently routing traffic, aggregating links, and embedding security.

5 key SD-WAN capabilities

1. Application-aware routing

SD-WAN recognizes traffic per application (VoIP, Teams, ERP, Salesforce, Facebook) and routes it via the optimal path.

2. Auto-failover in <1 second

If the primary link fails, traffic switches to secondary without user interruption.

3. WAN optimization

Compression, deduplication, caching, QoS per application, Forward Error Correction.

4. Integrated security (Secure SD-WAN)

Firewall, IPS, URL filtering, SSL inspection, antimalware built into edge device.

5. Central management (zero-touch provisioning)

New location → device shipped to branch → plug & play.

What you get from nFlo

• Network assessment — inventory of locations, links, applications
• SD-WAN design — topology, vendors, QoS and security policies
• POC at 2-3 locations (4-6 weeks)
• Rollout at remaining locations (zero-downtime migration)
• Security configuration — firewall, IPS, URL filtering, VPN
• SIEM integration — logs to central monitoring
• Training — for IT team + documentation
• Managed service (optional) — full SD-WAN management by the nFlo NOC within the scope and SLA set in the contract

How does Secure SD-WAN on FortiGate combine branch connectivity with traffic inspection?

SD-WAN decides which link traffic takes. Security decides whether that traffic should pass at all. When a branch goes to the internet locally, both jobs have to be done on site — otherwise you are left with sending all traffic through headquarters or with a separate firewall next to the router at every location, with its own rules and its own console.

In the Secure SD-WAN approach, both functions run on one edge appliance and are described by one policy. Fortinet is an example: according to the vendor, networking and security share the same FortiOS system and a single policy engine on a FortiGate appliance, which:

• recognizes applications and steers traffic across links (internet, LTE, MPLS) by application and user,
• measures latency, jitter and packet loss on the links and automatically fails traffic over to a healthy path,
• inspects traffic on the same appliance: IPS, web and DNS filtering, SSL inspection,
• lets you bring a new branch online without on-site configuration (zero-touch) and maintain the policies of all sites centrally in FortiManager.

What does this change in a project? Traffic steering rules and security rules are designed together, so an exception added for one application does not quietly open a path for another. A policy change reaches all branches from one place. In return, the model has to be sized to the traffic with inspection enabled, not to raw routing throughput — Fortinet lists it in its datasheets as threat protection.

We cover the appliances on the FortiGate page. If SD-WAN is part of a firewall replacement at headquarters or branches, we run it together with our Firewall Implementation service; you can read about how nFlo works with the vendor on the Fortinet page.

Related services

• Security audits
• SOC as a service