SD-WAN rollouts, one branch office at a time

What to look for, and what to ignore

What SD-WAN actually costs

SD-WAN pricing is notoriously complex because it bundles hardware, software licensing, transport circuits, and potentially managed services into a single per-site cost. The total monthly expenditure per site can range from $150 for a basic branch with broadband to over $2,000 for a high-bandwidth hub site with managed SASE services. The three dominant pricing models, DIY (buy the hardware and software, manage it yourself), co-managed (vendor provides the platform, you share operational responsibility), and fully managed (vendor handles everything), create fundamentally different cost structures. The per-site figures below are drawn from vendor-published pricing.

For a mid-market organization deploying SD-WAN across 50 branch sites, expect total cost of ownership of $200,000-$500,000 per year including hardware amortization, software licensing, transport circuits, and management overhead. DIY deployments with Fortinet or Cisco land at the lower end but require internal networking expertise. Fully managed services from Aryaka or Cato land at the higher end but eliminate operational overhead. The single biggest cost savings lever is MPLS displacement: if you are currently spending $500-$1,500/month per site on MPLS circuits, migrating to SD-WAN with dual broadband at $100-$300/month per site delivers 50-70% transport cost reduction that dwarfs the SD-WAN platform cost.

How to compare them

Security integration depth: built-in vs bolt-on vs cloud-delivered

Every SD-WAN vendor claims integrated security, but the implementation varies enormously. Some have a full NGFW in the appliance (Fortinet), some offer lightweight firewalling with cloud-delivered advanced security (Cisco with Umbrella), and some are networking-only and require a separate security stack entirely (legacy VMware VeloCloud). Your architecture depends on which model you choose.

Ask: Is the firewall stateful or next-generation? Is IPS signature-based or behavioral? Is the security processing done on the appliance or in the cloud? What is the throughput impact of enabling all security features simultaneously? Can the platform replace our existing branch firewalls, or do we need both?

Application-aware routing granularity and path selection intelligence

The difference between basic SD-WAN and a great SD-WAN is how intelligently it routes traffic. Basic platforms select paths based on static priority or simple metrics. Advanced platforms use real-time SLA measurements per application, support forward error correction for lossy links, and offer packet-level steering to optimize voice and video quality.

Ask: How frequently does the platform measure path quality? Can I set SLA thresholds per application (latency, jitter, packet loss) and have traffic automatically fail over when thresholds are breached? Does the platform support forward error correction or packet duplication for mission-critical traffic?

Scalability: from 10 sites to 10,000 sites

A platform that works beautifully for 20 sites may struggle at 500. Controller architecture, policy propagation latency, and monitoring overhead all scale differently. Enterprise buyers must validate at projected scale, not at current deployment size.

Ask: What is the maximum number of sites the orchestrator supports per instance? What is the policy propagation latency when pushing changes to 1,000 sites? Can the controller be deployed in an HA pair? What are the largest production deployments on this platform?

Cloud connectivity and multi-cloud support

Most enterprise traffic terminates in AWS, Azure, or GCP. SD-WAN platforms that offer native cloud on-ramp (virtual appliances deployed in cloud VPCs with optimized routing to cloud workloads) deliver measurably better performance than platforms that rely on public internet paths to cloud regions.

Ask: Can I deploy virtual SD-WAN appliances in AWS, Azure, and GCP? Does the platform integrate with cloud-native networking (AWS Transit Gateway, Azure Virtual WAN)? Is cloud traffic optimized through the vendor's backbone or routed over the public internet?

Total cost of ownership including transport, management, and hidden fees

SD-WAN platform licensing is typically 20-30% of the total WAN cost. Transport circuits, managed services, professional services, hardware refresh, and security add-ons make up the rest. Vendors that quote low per-site licensing but require expensive add-ons for essential features distort the true cost picture.

Ask: Provide a total-cost-of-ownership breakdown for a 50-site deployment over 3 years, including hardware, software, transport recommendations, professional services, and support. What features require additional licensing beyond the base subscription?

Operational complexity and day-two management effort

SD-WAN promises simplification, but some platforms are more complex to operate than the MPLS networks they replace. The day-two operational burden (firmware updates, policy tuning, troubleshooting, and monitoring) determines whether your team spends less time on WAN management or more.

Ask: How are firmware updates deployed across the fleet? Can I stage and schedule updates with automatic rollback on failure? What does the typical troubleshooting workflow look like when a branch reports poor application performance? How many full-time network engineers do your customers typically allocate per 100 sites?

Before you buy

1. 1Inventory your current WAN: list all sites with their current connectivity (MPLS bandwidth, broadband availability, LTE coverage), monthly transport cost, and contract termination dates. This is the foundation of your business case and migration plan.
2. 2Define your target architecture: pure SD-WAN with separate security, SD-WAN with on-box security (Fortinet model), or fully converged SASE. This decision eliminates a large share of vendors immediately.
3. 3Document your top 5 application priorities with their network requirements (bandwidth, latency sensitivity, acceptable packet loss). Voice, video conferencing, and real-time transactions need different treatment than email and web browsing.
4. 4Determine your deployment model: DIY (requires 1-2 dedicated network engineers per 100-200 sites), co-managed (shared responsibility with vendor/partner), or fully managed (WAN-as-a-service). Be honest about your team's capacity.
5. 5Check broadband and DIA availability at every site. SD-WAN cost savings depend on quality internet being available. Sites with only satellite or poor DSL may still need MPLS or 5G cellular.
6. 6Calculate your current MPLS spend and potential savings from broadband migration. This is the primary ROI driver and the number your CFO cares about.
7. 7Verify cloud connectivity requirements: which cloud providers do you use (AWS, Azure, GCP), and does the SD-WAN platform offer native cloud on-ramp with virtual appliances in those clouds?
8. 8Assess security requirements: does your compliance framework require specific security controls at the branch edge? If yes, evaluate SD-WAN platforms with integrated NGFW rather than planning to bolt on security later.
9. 9Run a 4-6 week proof of concept across 5-10 representative sites. Include your most challenging site (worst ISP, most latency-sensitive applications) in the POC. That is where the real evaluation happens.
10. 10Negotiate circuit diversity: if deploying dual broadband for redundancy, verify that the two ISPs use different last-mile infrastructure. Two ISPs sharing the same cable plant provide no real redundancy.
11. 11Plan for the parallel-run period: budget 6-12 months of dual transport costs (MPLS plus broadband) at critical sites during migration. This is the most expensive phase and must be included in the business case.
12. 12Review the vendor's hardware lifecycle and end-of-support policy. SD-WAN appliances have a 4-5 year useful life, and you need clarity on when hardware becomes unsupported and requires replacement.