SD-WAN: A Modern Alternative to Traditional WAN

The Traditional WAN: Built for a Different Era

For decades, the Wide Area Network (WAN) has been the backbone connecting an organization's geographically scattered sites. A typical setup involved connecting branch offices back to a central headquarters or data center using private, dedicated circuits, with Multiprotocol Label Switching (MPLS) being the gold standard for its reliability and performance.

The design was simple and effective for its time: a "hub-and-spoke" model where the data center was the center of the universe. All traffic, including requests destined for the public internet, would be routed from the branch (the spoke) back to the data center (the hub). This process is known as traffic backhauling. At the data center, traffic would pass through a centralized security stack (firewalls, intrusion prevention systems, etc.) before being sent to its final destination.

This architecture is illustrated in the diagram below on the left.

While secure, this model has become a major bottleneck in the age of the cloud. The following video from Kevin Wallace Training explains this problem clearly.

As the video explains, sending a branch user's request for a cloud application (like Office 365 or a service on AWS) all the way back to the data center, only to have it sent right back out to the internet, adds significant latency and consumes expensive, private MPLS bandwidth. This is the core problem that SD-WAN was designed to solve.

SD-WAN: A Software-Defined Revolution

SD-WAN applies the principles of Software-Defined Networking (SDN) to the WAN. At its core, it separates the network's control plane (the "brain" that decides where traffic should go) from the data plane (the hardware that actually forwards the packets).

Instead of configuring each router individually, SD-WAN uses a centralized controller to manage the entire WAN fabric. This controller has a complete view of the network and can make intelligent, real-time routing decisions based on policies you define.

A key innovation of SD-WAN is its use of an overlay network. It creates a virtual, encrypted network fabric on top of whatever physical connections are available—this is the underlay. This gives SD-WAN its "transport independence."

This transport independence means you can use a mix of connections—reliable but expensive MPLS, cheap but less reliable broadband internet, and wireless 4G/5G—and the SD-WAN controller will intelligently steer traffic according to your policies.

For example, you could create a policy stating:

• Voice over IP (VoIP) traffic: Must use the high-quality MPLS link. If MPLS performance degrades, automatically fail over to the broadband link.
• Office 365 traffic: Send directly from the branch to the internet (this is called Direct Internet Access or DIA). This avoids the backhauling problem entirely, as shown on the right side of the "Traditional WAN vs SD-WAN" diagram above.
• Bulk data backup traffic: Use the cheap broadband link during off-peak hours.

Contrasting the Architectures

Now that we have a grasp of both models, let's put them side-by-side. The image below provides a high-level comparison of the key features.

To dig deeper into this comparison, the following article from Palo Alto Networks provides an excellent breakdown.

The article you just read makes the contrast clear. Let's summarize the core shift in thinking for each category:

• Management: Moves from manual, error-prone, device-by-device CLI configuration to centralized, automated, policy-based GUI management.
• Traffic Optimization: Moves from static, rigid traffic paths to dynamic, application-aware path selection based on real-time network conditions.
• Scalability: Moves from a slow, complex, hardware-dependent process to a fast, agile, software-defined model, often featuring Zero-Touch Provisioning (ZTP) for new sites.
• Cost: Moves from a dependency on expensive, private MPLS circuits to a hybrid model that intelligently leverages cheaper public internet connections, significantly reducing operational expenses.
• Security: Moves from relying on a centralized security stack at the data center to integrating security features (like encryption and unified policy) directly into the WAN fabric, enabling secure direct internet access from the branch.

Conclusion

In this lesson, we contrasted the rigid, hardware-centric architecture of traditional WANs with the flexible, software-centric approach of SD-WAN. We saw that while traditional WANs served us well for decades, their hub-and-spoke design and reliance on backhauling traffic are ill-suited for the decentralized, cloud-driven world.

Key Takeaways:

• Traditional WANs typically use private MPLS circuits in a hub-and-spoke model, backhauling all branch traffic to a central data center. This is inefficient and expensive for cloud applications.
• SD-WAN is a software-defined overlay architecture that separates the control plane from the data plane.
• It provides transport independence, allowing it to run over any mix of MPLS, broadband, and LTE connections.
• A centralized controller enables automated, policy-based management and dynamic, application-aware path selection.
• The core benefits of SD-WAN are improved application performance (especially for cloud), lower costs, greater agility and scalability, and simplified network management.

The principles we've discussed today—separating the control and data planes, centralizing intelligence, and enabling automation—are central to the broader field of Software-Defined Networking. In our next lesson, we will explore the SDN architecture in more detail, examining the roles of northbound and southbound APIs and the capabilities of SDN controllers like Cisco DNA Center.