Resources > Security Terms Glossary > What Is SD-WAN?

What Is SD-WAN?

A software-defined wide area network (SD-WAN) is a network service that uses virtualization to connect an organization’s users to workloads across multiple transport services, such as multiprotocol label switching (MPLS) nodes, VPNs, broadband internet, LTE, and other existing network infrastructure. With automated traffic steering to optimize traffic, SD-WAN technology offers an efficient alternative to traditional WAN as organizations migrate away from on-premises data centers.

Read our ebook

How Does SD-WAN Work?

SD-WAN uses application-aware routing protocols to improve application performance. Most SD-WAN solutions create virtualized overlays in the form of encrypted tunnels, and a centralized management function intelligently steers network traffic across the WAN, through these tunnels, in the most efficient way available. Traffic is prioritized by business case and policy, offering optimal quality of service (QoS).

Software-defined networking (SDN) technology is a critical element of SD-WAN, allowing for on-the-fly network management and configuration to suit the needs of moment-to-moment traffic or specific use cases, such as maintaining uptime for critical applications.

SD-WAN creates secure tunnels that enable users and entities to connect directly to software as a service (SaaS) and infrastructure as a service (IaaS) providers, which can lower costs for additional infrastructure, improve connectivity and user experience, and reduce the attack surface compared to a traditional or hybrid WAN.

Why Is SD-WAN Important?

Traditional WAN architectures fall short as organizations migrate more of their apps and data to the public cloud. Security is more important than ever, but backhauling traffic from remote users and branch offices over private networks—such as MPLS or VPN—to a centralized internet gateway and back again introduces latency and creates a poor user experience.

Hybrid WANs can see to some of these issues, and they’re still a compelling alternative to the expense and inflexibility of traditional WAN connections. However, they don’t necessarily use SDN technology—in which case they can’t dynamically route traffic to ensure the best path. This alone puts hybrid WAN at a distinct disadvantage compared to SD-WAN.

By taking advantage of software-defined policies to determine optimal paths, SD-WAN makes it easy to establish local internet breakouts, which bring cloud-based applications and other cloud services as close to users as possible. What’s more, combining SD-WAN with cloud-delivered security allows an organization to bring policy as close as possible. We’ll look at that in more detail shortly.

What’s the Difference Between WAN and SD-WAN?

Traditional WAN	SD-WAN
Legacy data center-centric approach	Modern software-defined networking approach
Lengthy deployment and configuration	Fast, simple deployment and configuration
Rigid, complex, cumbersome, and expensive	Flexible, simple, easy to manage, and affordable
Difficult to integrate with SWG, firewalls, etc.	Easy to integrate with SWG, firewalls, etc.
MPLS connections are private but not secure	Virtual tunnel overlays are encrypted end to end

Benefits of SD-WAN

SD-WAN creates the shortest bridge between two points, regardless of where those points are located. This makes it easy to see how SD-WAN offers a variety of benefits over traditional WAN:

Lower costs: Most organizations’ WAN traffic has spiked massively with increased use of the cloud, driving up costs—especially if they bought new hardware to accommodate the higher bandwidth needs. SD-WAN reduces these costs by letting you take advantage of cost-effective options like the public internet.
Higher performance: Intelligent traffic steering gives priority to critical application traffic (e.g., VoIP and other network services) and creates direct tunnels to eliminate backhauling, reduce latency, and enhance productivity and the user experience.
Greater simplicity: Driven by intelligent automation, the most advanced SD-WAN solutions let you take advantage of zero-touch provisioning, removing the need to configure devices ahead of time. ZTP can automatically provision and configure any router in the WAN.
Stronger security: SD-WAN simplifies branch office operations and efficiently connects your branches to the internet, making it easy to establish local breakouts—but these connections still need to be secured. Cloud-based security is the natural fit here, as part of a complete SASE framework.

SD-WAN Security and SASE

Secure access service edge (SASE) is a network architecture framework that brings cloud native security technologies—SWG, CASB, ZTNA, and FWaaS in particular—together with WAN capabilities to securely connect users, systems, and endpoints to apps and services anywhere. To support agile operations, these technologies are cloud-delivered and can be managed centrally.

Zero trust, a core tenet of SASE, asserts that no user can be trusted by default. A SASE architecture enforces zero trust policies in the cloud to safeguard sensitive data and protect organizations from web-based threats.

So, how does SD-WAN fit into all this? As a central element of a SASE framework, it supports cloud-first strategies and secure digital transformation initiatives. Rather than being backhauled to your data center for security functions, end user device traffic is inspected at a nearby point of presence and sent to its destination from there. This means more efficient and secure access to apps and data, making it the far better option for protecting distributed workforces and data in the cloud.

Next-Generation SD-WAN

SD-WAN optimization has much to offer today’s agile, distributed operations. Even so, with cloud adoption still trending upward, some legacy SD-WAN systems struggle to keep up due to insufficient scale and bandwidth. This is driving demand for the next generation of SD-WAN.

In a next-gen SD-WAN architecture, branch services such as network security can all be delivered from cloud platforms over any internet connection. Harnessing the power of machine learning and automation, it can boost WAN edge bandwidth, enable an improved user experience, and offer superior security.

Benefits include:

Application-centric security, rather than packet-centric, enhancing security in distributed environments
Minimal manual intervention required, enabling a more agile approach to DevOps and API management
Real-time orchestration and enforcement delivered from the cloud

SD-WAN with Zscaler

Zscaler partners with the world’s leading SD-WAN vendors to provide comprehensive security, visibility, control, and data protection for branch users going directly to the internet. Together, we make it easy for your organization to migrate from a hub-and-spoke network to a cloud-delivered architecture by enabling secure local internet breakouts for your branch offices.

With the power of Zscaler Internet Access™ and leading SD-WAN service providers, you’ll be able to:

Reduce the cost and complexity of routing traffic locally and securely
Simplify branch operations for greater efficiency and user experience
Provide identical protection no matter where or how your users connect
Easily and instantly scale deployment to meet your business needs

Zscaler seamlessly integrates with more than a dozen leading SD-WAN providers, including Aruba, Cisco, Juniper, VMware, and more, to offer you secure, fast, and reliable access to apps from any device, anywhere.

Learn more about our SD-WAN partnerships.

Learn more about Zscaler Internet Access.