SD-WAN — implementation and management
Companies with 5+ locations lose a significant share of their networking budget to MPLS. SD-WAN delivers the same SLA via cheaper Internet + LTE with centralized policy management. Includes: application-aware routing, auto-failover, security (integrated firewall, VPN, URL filtering). Critical for retail, manufacturing, logistics, finance.
What is SD-WAN?
SD-WAN (Software-Defined Wide Area Network) is a networking technology that replaces rigid MPLS links with centrally managed software. It connects multiple company locations with headquarters and cloud via various media (Internet, LTE, MPLS) — selecting optimal link per application. Result: lower costs (MPLS share drops significantly), higher availability (auto-failover), security as code. nFlo implements Fortinet Secure SD-WAN, Cisco Meraki, VMware VeloCloud.
MPLS costs $20k/month for 15 branches — internet costs $500 per location
SD-WAN — intelligent links with security
Application-aware routing
Selects link per application, SLA per service
Integrated security
Firewall, IPS, URL filtering in edge device
Auto-failover
Secondary link active in <1s, no user interruption
Companies with 5+ branches lose 30-50% of networking budget to MPLS
Keeping MPLS at every location costs a multiple of an ordinary internet link of the same bandwidth — and it is that gap, not the technology, that triggers the migration.
Why do companies still pay for MPLS?
- Concern about SLA for critical applications (VoIP, ERP, videoconferencing)
- Complexity of managing multiple links
- Lack of application visibility (which traffic goes through which link)
- Security — firewall at each branch edge
SD-WAN solves all these concerns — intelligently routing traffic, aggregating links, and embedding security.
5 key SD-WAN capabilities
1. Application-aware routing
SD-WAN recognizes traffic per application (VoIP, Teams, ERP, Salesforce, Facebook) and routes it via the optimal path.
2. Auto-failover in <1 second
If the primary link fails, traffic switches to secondary without user interruption.
3. WAN optimization
Compression, deduplication, caching, QoS per application, Forward Error Correction.
4. Integrated security (Secure SD-WAN)
Firewall, IPS, URL filtering, SSL inspection, antimalware built into edge device.
5. Central management (zero-touch provisioning)
New location → device shipped to branch → plug & play.
What you get from nFlo
- Network assessment — inventory of locations, links, applications
- SD-WAN design — topology, vendors, QoS and security policies
- POC at 2-3 locations (4-6 weeks)
- Rollout at remaining locations (zero-downtime migration)
- Security configuration — firewall, IPS, URL filtering, VPN
- SIEM integration — logs to central monitoring
- Training — for IT team + documentation
- Managed service (optional) — full SD-WAN management by nFlo NOC 24/7
Related services
How we work
Our proven service delivery process.
Assessment
Inventory of locations, links, critical applications
Design
Topology (hub-and-spoke, full mesh), QoS policies, security
POC
Proof of concept in 2-3 locations, SLA validation
Rollout
Gradual deployment in remaining locations (zero-downtime)
Management
Managed service or operational support
Benefits for your business
What you gain by choosing this service.
Cost reduction
Expensive MPLS → much cheaper Internet+LTE every month
Application performance
Direct-to-cloud for SaaS (O365, Salesforce) — no tromboning
Security as code
Central firewall, IPS, URL filtering policies
High availability
Auto-failover on 2 or 3 links (Internet + LTE + MPLS)
Related Articles
Expand your knowledge with our resources.
IT services outsourcing — how to choose a provider and where to draw the line of responsibility
Outsourcing IT services is not a decision about whether to outsource, but a decision about where the line of responsibility runs. This article compares three delivery models, shows what stays on your side despite the contract, and lists the questions worth asking a provider before you sign.
Read more →Penetration test vs vulnerability scan: what really differs
A company that buys a scan instead of a pentest is not buying the same thing for less — it is buying different information. Here is exactly where the boundary runs and how to arrange both into one process.
Read more →Web application penetration testing cost and what creates it
Three quotes for testing the same application can differ several times over — and rarely because someone applies a different margin. Each one prices different work. Here is what that difference is made of, and how to write a request that makes quotes comparable.
Read more →Frequently Asked Questions
Common questions about SD-WAN — implementation and management.
What is SD-WAN in simple terms?
SD-WAN (Software-Defined Wide Area Network) is a technology for managing WAN (between company branches) via software, not rigid hardware configuration. Instead of expensive MPLS, the company connects branches via Internet + LTE + optionally MPLS. The system automatically routes traffic: important applications (VoIP, ERP) through the best link, less important through cheaper ones. Reduces WAN costs significantly while maintaining SLA.
What are the types of WAN networks?
Traditional: (1) MPLS (Multi-Protocol Label Switching) — dedicated, expensive, high SLA, (2) Internet VPN (IPsec) — cheap, variable SLA, (3) Leased lines — most expensive. Modern: (4) SD-WAN — software-defined, multi-link, (5) SASE (Secure Access Service Edge) — SD-WAN + cloud security as service, (6) Direct Internet Access + CASB — for SaaS. Trend 2024-2026: MPLS → SD-WAN/SASE migration.
How much does SD-WAN cost?
SD-WAN costs (2026): (1) Edge device (CPE) — $1-6k per location (depending on throughput and vendor), (2) License per device — $700-3.5k/year, (3) Orchestrator (central management) — $7-25k/year, (4) Deployment — $5-20k per location. Typical 10-branch company: CAPEX $35-70k, OPEX $20-50k/year. **Savings vs MPLS**: typically 12-18 month payback.
Who are the best SD-WAN vendors in 2026?
Gartner Magic Quadrant 2024 leaders: (1) Fortinet Secure SD-WAN — best value + FortiGate integration (security-first), (2) Cisco Meraki SD-WAN — cloud-managed, simple operation, (3) VMware VeloCloud — enterprise features, largest installed base, (4) Palo Alto Prisma SD-WAN (CloudGenix) — AI-driven policies, (5) Aruba EdgeConnect (Silver Peak) — WAN optimization. nFlo recommends Fortinet Secure SD-WAN for most clients — integrated security, competitive pricing.
SD-WAN and security — does SD-WAN replace firewall?
Modern SD-WAN (Secure SD-WAN) HAS built-in firewall, IPS, URL filtering, antimalware, SSL inspection — replaces separate edge firewall in the branch. But DOES NOT REPLACE: (1) central security platform (SIEM, SOC), (2) cloud security (CASB for SaaS, ZTNA), (3) EDR on endpoints, (4) email security. SASE = SD-WAN + cloud security = target model 2025+. For full protection: Secure SD-WAN edges + ZTNA + CASB + EDR + SIEM.
How long does SD-WAN deployment take?
Typical SD-WAN project (10 branches): (1) Assessment and design — 4-6 weeks, (2) POC at 2-3 locations — 4-6 weeks, (3) Rollout — 1-2 weeks per location (zero-downtime — new link works in parallel with old for 2 weeks), (4) MPLS decommission — 4-8 weeks (depending on contracts). **Total 4-6 months**. Larger deployments (50+ locations) — 9-12 months with parallel rollout.