SD-WAN, or software-defined wide area network, connects a company's branch offices and home workers to head office and to cloud apps over ordinary internet links, and manages all of those connections centrally from software. A wide area network, or WAN, is the network that joins a company's offices in different cities.
For many years, Indian banks and retail chains joined their branches with private leased lines, often MPLS lines. MPLS is a private network service that an operator sells, with a guaranteed speed. These lines are reliable but expensive. And every branch's internet traffic went first to head office to be checked, and only then out to the internet. That became slow once most apps moved to the cloud.
SD-WAN uses whatever links a branch has: perhaps one leased line, one broadband connection and one mobile data connection. A small SD-WAN device in each branch measures every link many times a second, for delay and for lost data. A central controller holds the company's rules, called policies, and sends them to every branch device. The policies say which app should use which link.
Here is a typical case. A gold loan company has 400 branches across Kerala, with its head office in Thrissur. In the Palakkad branch, a loan executive is weighing a customer's gold chain and entering the loan in the core banking system. That app is critical, so the policy sends it over the link with the lowest delay, the leased line. A staff training video uses the cheap broadband line. At 11:20 a.m., road works cut the leased line. The SD-WAN device notices within a second. It moves the core banking traffic to broadband, and the loan entry goes through. When the line is repaired, the traffic moves back.
The IT team in Thrissur changes the policies for all 400 branches from one screen. A new branch's device is shipped, plugged in, and receives its settings automatically, as in cloud-managed networking.
SD-WAN is a clear example of separating the software from the hardware. The decisions about routes are made in software, and the box in the branch can be fairly ordinary hardware.
SD-WAN carries the traffic, but it does not fully check it for attacks. So companies combine it with security delivered from the cloud, called SASE (secure access service edge). Traffic then goes from the branch straight to the nearest SASE location, is checked there, and continues to the cloud app, with no trip through head office. Branches that still need a firewall on site use a next-generation firewall. Inside the branch, the SD-WAN device connects to the enterprise switches. Many companies buy SD-WAN from a telecom operator or a partner, which installs it and runs it for them.