Enterprise SD-WAN Deployment: Lessons From the Field
SD-WAN sales pitches do not survive contact with a real enterprise WAN. Here is what works, what does not, and how to deploy without breaking the business.
Why SD-WAN exists
Traditional enterprise WANs were built on MPLS — reliable, expensive, and slow to provision. SD-WAN replaces the carrier-managed routing with software-defined overlays on commodity internet links. The promise is lower cost, faster deployment, and application-aware routing.
The promise is real. The execution determines whether you realize it.
The major platforms
Cisco Catalyst SD-WAN (formerly Viptela), VMware VeloCloud, Fortinet Secure SD-WAN, and Versa Networks are the established enterprise platforms. Each has a credible product. The differentiation is in the operational model and the integration with the rest of your security and networking stack.
If you already operate Cisco, Catalyst SD-WAN's integration with the broader Cisco stack is worth the lock-in. If you operate Fortinet firewalls, Secure SD-WAN is the obvious complement. Lead with operational fit, not feature comparison.
Underlay matters more than overlay
SD-WAN does not fix bad internet. A dual-broadband site with 4G failover gives the overlay something to work with; a single asymmetric DSL link does not. Plan the underlay before designing the overlay.
For critical sites, retain at least one MPLS or dedicated circuit alongside the broadband links. The cost saving is real but does not justify outages.
Security integration is the hard part
SD-WAN backhauls traffic to a security stack. Where that stack lives — on-prem firewalls, regional hubs, cloud-delivered SSE (Zscaler, Netskope, Cisco Umbrella) — defines the architecture.
Secure Access Service Edge (SASE) is the marketing term for SD-WAN plus cloud-delivered security. For greenfield deployments, SASE is increasingly the default. For brownfield, plan the migration in phases — security policy first, traffic redirection second.
Deployment patterns that work
Pilot on three sites that span the use case range: a large headquarters, a typical branch, and an edge site with constrained connectivity. Run the pilot for at least 90 days. Build the operational runbooks during the pilot, not after.
Phase the broader rollout by region. Carry MPLS in parallel for at least one quarter per region before decommissioning. The cost of parallel running is much less than the cost of a failed cutover.
What kills SD-WAN projects
Underestimating the application discovery work. Application-aware routing requires accurate application categorization, which requires both a good DPI engine and disciplined exception handling.
Treating SD-WAN as a network project when it is a security and application project. The networking team can install the hardware; the broader change requires the security team and the application owners.
Reader questions, answered
Can we drop MPLS entirely?+
For most sites, yes — eventually. For critical sites with hard latency requirements, keep one dedicated circuit.
Is SASE the same as SD-WAN?+
No. SASE is SD-WAN plus cloud-delivered security (SWG, CASB, ZTNA, FWaaS) as an integrated service.
Raza Ahmad is a technology author and IT infrastructure specialist based in Melbourne, Australia. He writes practitioner-grade guides on cloud computing (Azure and AWS), cybersecurity, enterprise networking with Cisco platforms, Linux administration, DevOps, and virtualization. His work focuses on translating complex infrastructure topics into clear, accurate guidance that engineers, system administrators, and IT decision makers can put to work in production environments. Every article published under his byline is fact-checked against current vendor documentation, official standards, and Raza's own hands-on experience operating the technologies he covers.
More from Networking
A Field Guide to BGP Troubleshooting in Modern Enterprise Networks
The diagnostic patterns experienced network engineers use when BGP misbehaves between data centers, clouds, and the internet edge.
CCNA vs CCNP: Which Cisco Certification Should You Pursue?
How to choose between Cisco's associate and professional certifications based on where you are in your career and what you want to do next.
The Complete Cisco Networking Guide for Network Engineers
A structured reference for network engineers working with Cisco IOS, IOS-XE, and NX-OS — covering switching, routing, security, and modern automation.
One email. The technology stories that actually matter for engineers.
A curated digest of the week's most useful tutorials, reviews, and analysis — no clickbait, no AI summaries of someone else's work.
Free. Unsubscribe anytime. See our privacy policy.