SD-WAN Deployment
We design and deliver SD-WAN rollouts for businesses with several sites. We assess the network you have, arrange the connectivity, configure routing and security, test your applications and manage each cutover, then set the network up for ongoing support. A site moves when its connections, configuration and rollback plan are in place.
Start with the network you have today
We begin by mapping what is in place at each site: carriers and services, contract and renewal dates, firewalls, routing, applications, security policy and any known performance problems.
We also look for the dependencies that are easy to miss, because they cause trouble at cutover if nobody has found them first.
What comes out is a design and migration plan built for your environment, with each site's differences accounted for.
- ✓Fixed public IP addresses
- ✓Inbound connections
- ✓VPNs and remote access
- ✓DNS
- ✓Hosted applications
- ✓Systems tied to a particular network route
Connectivity at each site
SD-WAN can only use the connections underneath it. We compare the options against each site, its applications and how resilient it needs to be, and different sites often end up with different combinations of primary and backup links.
Two carriers can still share the same physical infrastructure. Where a site needs real path diversity, we check the physical route as well as the provider name. We also check wireless coverage and backup capacity against the applications that have to keep working during a fixed-line fault.
New fibre and enterprise services can take longer to deliver than the devices take to configure. So we check availability and place carrier orders early, alongside the design, and a late circuit at one site doesn't hold up the others.
- ✓NBN Enterprise Ethernet
- ✓Business fibre
- ✓Other fixed-line services
- ✓4G and 5G
- ✓Starlink
- ✓Existing MPLS
Who should design, deploy and run your SD-WAN?
There are several workable ways to do it. Which one fits depends on how much control you want and what your IT team can run once the project ends.
Carrier-managed SD-WAN
A carrier supplies a managed network product, often bundled with its connectivity. It can suit a business that wants a fairly standard branch network and is comfortable with the carrier's platforms and service boundaries. Check who looks after firewall policy, application performance, other carriers and problems that cross those boundaries.
Managed by your IT team
Your network team designs and runs the platform directly. You control policy, changes and carrier choice, but the team needs capacity for monitoring, firmware, incident response, application tuning and documentation long after the project finishes.
Engineering-led deployment and management
We design the network independently of any one carrier and deliver the rollout. Together we agree whether operations stay with your IT team, are shared, or move to our Managed SD-WAN service, and the deployment scope includes the management access, change process and support responsibilities that arrangement needs.
How we deliver an SD-WAN rollout
Review the current network
The planning work becomes a site-by-site record of connectivity, carriers, firewall and routing configuration, MPLS services, application paths, site access and contracts. We note how head office, warehouses, branches and remote sites differ, so reusable site patterns can be designed around them.
Design the target network
We choose the underlays and the primary and backup combination for each site type. Routing and application classes, path-quality thresholds, firewall policy, segmentation, internet breakout, VPN, remote access and monitoring are designed together. We also confirm device capacity, licensing, central management and how configuration changes will be reviewed.
Platform choice depends on the existing network and the team that will run it. Fortinet FortiGate and Cisco Meraki differ in management, security integration and day-to-day operation. When an existing SD-WAN platform is being replaced, we review the architecture and application policies afresh, because a like-for-like hardware swap can carry old problems across.
Prepare circuits, devices and site configurations
Carrier orders, site access and equipment staging run alongside policy design. Each device gets a configuration that reflects its site type and the approved policy for application routing, security and failover.
Where zero-touch provisioning suits, devices are registered centrally, shipped to site and pick up their configuration when they connect. That cuts repetitive setup at each branch. Site discovery, application testing and the cutover plan still have to be done.
Test the design at representative sites
We pick pilot sites that cover the different connection types and workloads across the business. The pilot tests application steering, link degradation and failure, firewall policy, secure internet breakout, VPNs, voice and video, monitoring and support processes under real use.
We compare the results with the application baseline and adjust the templates before they go to other sites.
Move sites in planned waves
We group sites by carrier availability, location, business priority, application dependencies and migration risk. Each cutover has a change window, a communication plan, site contacts, validation checks and a documented rollback path.
Where the design allows parallel running, the existing network stays available until the new one has shown stable production performance.
Validate and hand over the network
We check application access, performance, routing, security policy, failover, monitoring and the site acceptance criteria we agreed. You receive documentation covering connectivity, device and policy configuration, management access, site exceptions, known dependencies and escalation paths.
The operating responsibilities agreed at the start are confirmed before the project closes, including management access, change approval and escalation routes. Your IT team can take the network on, share it with us, or hand it to our Managed SD-WAN service, so each site is ready to run from the day it's handed over.
Where SD-WAN deployments go wrong
Most rollout problems trace back to a handful of causes: a site dependency nobody found, a circuit that arrives late, a pilot policy copied across unchanged, or old links removed before the new ones are proven. Choose one to see how a staged plan absorbs it.
An eight-site rollout. Pick what goes wrong and watch the plan adjust.
The other common gap, nobody owning the network after go-live, is settled before deployment starts and written into the handover.
Measure application performance before and after cutover
A healthy circuit doesn't mean the applications on it are performing well. A Teams call, an ERP session and a file replication job each need different things from delay, loss, bandwidth and inspection.
Before cutover, we record how Microsoft 365, Teams, SaaS, ERP, voice, video and other critical systems perform at representative sites, using the monitoring and application data already in the environment. Depending on what is available, that covers latency, jitter, packet loss, response behaviour and the routing and inspection path.
We then test the new paths against that baseline, looking at application identification, path-health checks, steering thresholds and failover behaviour. We also check that changes to inspection, DNS and VPN haven't created a new application problem.
Branches differ, so we check a policy template against each site type before reusing it. A warehouse may run operational systems and inbound connections a small office doesn't have, and the design and test plan need to reflect that.
- ✓Teams and voice: jitter and lossrecorded
- ✓Microsoft 365: latency and pathrecorded
- ✓ERP: response behaviourrecorded
- ✓DNS, VPN and public IPdocumented
Moving away from MPLS
SD-WAN doesn't have to mean cancelling MPLS straight away. Some businesses keep it through the rollout, for selected workloads, or until contracts expire. Others replace it with a mix of fixed and wireless connections once performance, resilience and security have been tested.
We line up contract dates and notice periods against lead times for the replacement circuits. Where parallel running is possible, the new network is tested under production load before the old links are switched off. That leaves a practical way back if an application or route behaves differently after cutover.
The commercial comparison needs to cover more than the price of the access circuits.
- ✓Hardware and licences
- ✓Security
- ✓Managed support
- ✓Backup connections
- ✓Migration work
- ✓Overlap between old and new contracts
- ✓Ongoing carrier arrangements
Security changes with the traffic paths
SD-WAN changes how branch traffic reaches the internet, cloud services and other sites. Direct internet breakout can remove unnecessary backhaul, but it also changes where traffic is inspected and which policy applies. So we design security alongside routing and failover.
- ✓Firewall policy aligned to the new traffic paths
- ✓Secure internet breakout defined for each site and user group
- ✓Segmentation planned before cutover
- ✓IPS and application control tuned to the environment
- ✓VPN and remote access reviewed against the new design
- ✓Logging and incident escalation confirmed
- ✓ZTNA or SASE considered where remote users or cloud access need it
- ✓Security controls tested when traffic moves between eligible paths
On Fortinet, FortiGate runs firewall and SD-WAN in FortiOS with centrally managed policy. Whether a design suits a site depends on the equipment, inspection capacity, configuration and licensing. Our Fortinet Secure SD-WAN guide covers the security architecture in more detail.
See what we’ve delivered for our clients
Questions we get asked about SD-WAN deployment
How do you deploy SD-WAN across multiple sites?
We start by assessing current links, carriers, applications, firewalls and site requirements. Connectivity orders, design and device staging then run in parallel.
We test at representative sites, then migrate in planned waves with application and security validation, a documented rollback path and an agreed handover.
What is the difference between SD-WAN deployment and Managed SD-WAN?
Deployment is the project to design, configure, test and migrate the network.
Managed SD-WAN is the ongoing service: monitoring, policy and firewall changes, carrier escalation, firmware, reporting and lifecycle work. We can deliver either or both.
How long does SD-WAN implementation take?
It depends on site preparation, existing connectivity, any new circuit orders, equipment, site access and how complex the applications are. Carrier lead times and undocumented dependencies are the usual causes of delay, so we review each site before setting the rollout programme, and sites with suitable services already in place can often move earlier.
What causes SD-WAN projects to run late?
Carrier lead times, site access, incomplete documentation and application dependencies nobody knew about are the common causes of delay.
Will sites have downtime during migration?
Any cutover carries some change risk, and some services may need a maintenance window. We plan and communicate those windows, validate the result and prepare a rollback.
Where the architecture allows parallel running, the existing WAN can stay available during testing.
Can we keep MPLS while SD-WAN is deployed?
Yes, where the existing design and services support it. MPLS can stay for the transition, for certain workloads or for contract reasons. Where it is being retired, it comes out once applications, resilience and security have been validated on the new network.
Does zero-touch provisioning mean no on-site work?
No. It cuts manual device configuration. Site access, cabling, power, existing equipment, the carrier handoff, application policy and validation still need attention.
How do we choose the SD-WAN platform?
We look at firewall requirements, existing devices, inspection capacity, central management, licensing, site types and what your team can support.
Fortinet and Cisco Meraki suit different environments, and the choice also shapes the rollout method and how the network is run afterwards.
What should an SD-WAN quote include?
The scope of discovery, connectivity, equipment and licensing, security design, policy configuration, staging, pilot testing, rollout, application validation, rollback and documentation.
It should also say which ongoing monitoring, carrier management and support are included, and which aren't.
Who manages carrier faults after go-live?
That's set out in the operating agreement. Under our Managed SD-WAN service, we investigate the carrier, routing, firewall, local network and application path together, including issues that cross supplier boundaries.
Talk to us before the first circuit is ordered
Tell us about your sites, current connectivity, applications and any MPLS or carrier renewal dates. We'll review what the rollout needs, identify the early decisions and work through a migration plan with you.