Managed SD-WAN
We design, deploy and manage SD-WAN across your sites, carriers and application paths. We monitor network performance, manage routing and failover, make network changes, work with carriers on faults and keep firmware, lifecycle and documentation current.
- ✓Head office: fibre and 5Ghealthy
- !Warehouse: packet loss on fibreTeams on 5G
- !Branch: carrier faultraised
When SD-WAN is worth it
SD-WAN earns its place when simple primary-and-backup connectivity is no longer enough to run the network cleanly across sites.
Several sites use different carriers or connection types
SD-WAN brings routing, failover and policy under common management while fibre, nbn, 4G/5G, Starlink or other services can still vary by location.
Primary and backup connectivity by siteTeams, voice or cloud applications perform differently between sites
Application-aware routing can use path quality, including latency, jitter and packet loss, when deciding which eligible connection should carry the traffic. The cause is often the path, the inspection point, the firewall policy or DNS behaviour, more than the bandwidth.
See application steering in actionSome sites cannot wait for a complete link failure
SD-WAN can respond to degraded path quality as well as a hard outage, provided the backup path has the capacity the site needs.
How we handle network issuesNetwork policy is becoming difficult to manage site by site
Central policy and configuration make routing, failover and network change more consistent across the estate.
What we manage day to dayFailover you can test and trust
It's unclear what traffic moves, how quickly it moves and what users notice when a link degrades. SD-WAN makes failover policy-driven and testable.
How we handle network issuesNew sites that join a known design
Each site needs its own carrier conversation, firewall configuration and routing change. With SD-WAN, a new site joins a known, documented design. A new site can open on 5G or Starlink while its fixed service is installed.
From the current network to Managed SD-WANConsistent security policy across branches
Local exceptions, older equipment and VPN patterns drift apart over time. Central policy brings the branches back into line.
One managed networkA WAN that follows where the traffic now goes
Microsoft 365, SaaS and Azure traffic still follows a data-centre-first path, and IT has no single view of site health, underlay performance, failover state and application paths.
See application steering in actionA single site may only need a well-managed firewall and resilient primary and backup connectivity. SD-WAN becomes more useful as sites, paths and application requirements become harder to manage individually.
Compare SD-WAN, MPLS and SASEWhat we manage day to day
Path monitoring
Availability, latency, jitter and packet loss across the paths each site relies on, with monthly WAN health and application performance reports.
Routing and failover
Application-aware routing and failover policy for Microsoft 365, Teams, SaaS, ERP, voice and other business systems. Where a site has two links, both can carry traffic at the same time.
Policy and change
Routing, SD-WAN, firewall and segmentation changes applied centrally, validated and documented.
Carrier faults
Faults raised and followed through with the carrier, using path and site data from the managed network.
Firmware and lifecycle
We supply the FortiGate or Meraki hardware, licences and support contracts. Firmware planning, hardware lifecycle, diagrams, site information and escalation details kept current.
Support
Network issues raised and tracked through our AI-assisted service desk in Microsoft Teams. Network issues go to engineers who know your sites, and you can reach them directly when something needs investigating.
Running each site on its own, or as one managed network
Separately managed sites can work well. These are the limitations we see most often as an estate grows.
The platform matters, but the design and the way the network is run afterwards matter more.
Network capability
Offices, branches, clinics, warehouses and project sites, with common policy and different connectivity where locations need it.
P1 response under our SLA-driven support model, including a major connectivity failure.
FortiGate, FortiManager, FortiAnalyzer, SD-WAN, VPN, segmentation and secure edge.
Explore Fortinet SD-WAN →Cloud-managed routing, switching, wireless and branch networking.
Compare Fortinet and Meraki →Application-aware routing for Microsoft 365, Teams and business systems
Teams, voice, ERP and SaaS applications respond differently to latency, jitter and packet loss. We set health checks and routing policy around the applications in use across the network.
When an eligible path degrades, application steering moves traffic according to the thresholds and failover policy set for that application. We review those policies as sites, carriers and applications change.
Direct cloud breakout and security inspection are designed together, so traffic leaving a site for Microsoft 365 or SaaS is still covered by firewall policy.
Choose a fibre condition at a branch to see how each application is routed.
Primary and backup connectivity by site
Managed SD-WAN runs across the carrier services underneath it, and it can only choose between the paths each site has. We work across Telstra, nbn, Vocus, Superloop, TPG Telecom, AAPT and Starlink, with primary and backup connectivity matched to each site's workload, location and resilience requirements. SD-WAN performs only as well as the links beneath it, so the underlay is part of the design.
Primary connectivity
nbn Enterprise Ethernet, business fibre, MPLS or other fixed services selected around the site and the applications it runs.
Backup paths
4G, 5G, Starlink or a second fixed service, with enough capacity for what the site needs to keep working.
Carrier and path diversity
Different providers can still share physical infrastructure. Where resilience matters, we look at both the carrier and the underlying path.
Head office and sites running latency-sensitive applications may need business fibre or nbn Enterprise Ethernet, with performance and restoration commitments appropriate to the site. Sites that have to ride through a carrier fault need a diverse second path. Small branches and pop-up sites can start on broadband or 4G/5G. Remote locations may rely on satellite and cellular under the same managed policy.
If the work involves wider carrier changes or redesign across the estate, see our multi-site network upgrade service.
How we handle network issues and change
A path degrades
We check latency, jitter and packet loss, confirm which applications are affected, then investigate the carrier, network edge and application path.
A link fails
We confirm failover, check that the site can reach the applications it needs, then raise the carrier fault and follow restoration.
A network change is required
We apply the change centrally, validate it at the affected sites and update the documentation.
A site keeps having the same problem
We use path history, device telemetry and carrier evidence to separate recurring carrier faults from routing, firewall or local network issues.
What happens to your existing MPLS network?
Moving to SD-WAN does not automatically retire MPLS. We look at which applications use private connectivity, the carrier contracts, how critical each site is, and what is available at that location and how it performs.
Some sites keep MPLS during migration or for longer. Others move to business fibre, nbn Enterprise Ethernet or a mix of fixed and mobile connections.
We weigh ongoing carrier costs, application paths, resilience and support responsibilities against the expected benefit. The detailed comparison is in our SD-WAN vs MPLS vs SASE guide.
- ✓Hard latency or private-transit requirements, still under contract
- ✓Workloads that depend on predictable point-to-point performance
- ✓Locations where the transition risk outweighs the near-term benefit
- ✓Traffic has moved to Microsoft 365, SaaS and Azure
- ✓The site pays for private transit it no longer uses
- ✓nbn Enterprise Ethernet, fibre or 4G/5G now meets the requirement
From the current network to Managed SD-WAN
Review the current network
Map sites, carrier links, applications, firewalls, routing, existing SD-WAN or VPN, and the issues already affecting the estate, and decide what to keep, change or leave behind. Unclear firewall rules, unsupported hardware, weak failover, poor documentation, carrier ambiguity or exposed management access are fixed before cutover, because migrating them makes them harder to unwind.
Set the design and policy
Confirm the connectivity at each site, application routing, failover thresholds, firewall and segmentation policy, and how the environment will be managed.
Pilot and move sites in stages
Validate representative sites first, then move the wider estate in controlled waves, with communication, testing and rollback planned for each one.
See the full SD-WAN Deployment approach →Run it day to day
Monitor paths and applications, manage change, coordinate carrier faults, and keep firmware, lifecycle and documentation current. New sites join the same design and policy.
Why clients choose us for managed SD-WAN
01Design first, then platform, then carrier
We shape the network around site criticality, application paths, security policy and the support model, then have the carrier conversation against that design. We aren’t tied to one carrier, so each site’s connections are chosen for that site.
02We follow the problem across the whole path
We investigate the carrier, routing, firewall, local network and application path together, including issues that cross supplier boundaries.
03Security and networking designed together
Firewall policy, secure internet breakout, segmentation, VPN, ZTNA and the path to SASE are part of the SD-WAN design from the start. Traffic between sites runs over encrypted overlays, and firewall logs can feed your wider security monitoring.
04Fortinet and Meraki expertise in-house
We design, deploy and manage Fortinet and Cisco Meraki networks, including FortiGate, FortiManager, FortiAnalyzer and Meraki cloud management.
05Your IT team keeps visibility and control
Management access, responsibilities and change authority are agreed with your team, with network issues handled through our AI-assisted service desk in Microsoft Teams.
06We stay with the network after go-live
Monitoring, documentation, lifecycle and escalation continue after the rollout, so the network stays easy to operate. The carriers, the hardware and network changes stay with us, so there’s one place to take a network issue.
See what we’ve delivered for our clients
Questions we get asked about Managed SD-WAN
What happens in an initial SD-WAN review?
We look at your sites, carriers, applications, firewalls, routing, support arrangements and recurring issues. Then we show where SD-WAN would improve performance, resilience or management, what equipment can stay, and whether a smaller, targeted change would meet the requirement.
Is Managed SD-WAN the same as SD-WAN as a service?
Usually, yes. Both describe an ongoing SD-WAN service. We design and deploy the SD-WAN, then manage monitoring, routing and application policy, failover, network change, carrier escalation, firmware, lifecycle and documentation as an ongoing service. We work primarily across Fortinet and Cisco Meraki.
Should we buy SD-WAN from our carrier or a managed provider?
It depends on how many carriers your sites need. A carrier’s SD-WAN usually runs over that carrier’s own services. We source across the major Australian carriers, 5G and Starlink, choose the primary and backup connections for each site, and design the SD-WAN, security and day-to-day management around them. You can change the carrier at one site without redesigning the network. SD-WAN Deployment compares the options in more detail.
Does SD-WAN replace MPLS?
Sometimes. MPLS may be removed, reduced, kept during the transition or kept for specific workloads. It depends on contracts, site criticality, application dependencies, underlay quality and how much risk the business can carry. What happens to your existing MPLS network covers how we decide.
What underlays can SD-WAN use?
nbn Enterprise Ethernet, business fibre, broadband, 4G/5G, satellite and MPLS. Different sites often need different combinations, depending on availability, performance, resilience and business impact.
How disruptive is an SD-WAN rollout?
A well-planned rollout is staged and controlled. We plan site groups, change windows, testing, rollback and communications before migration. Where the existing connections and equipment allow it, we can run the old and new networks in parallel while each site is tested. SD-WAN Deployment explains the approach.
Is Fortinet SD-WAN a good fit for us?
It often is where FortiGate firewalls are already in place, or where firewall and SD-WAN should run in one environment. We choose it when it fits the architecture, security requirements and how your team operates, and we also run Cisco Meraki.
Is SD-WAN worth it for a small business?
It depends more on the network than the size of the business. A single-site business may only need resilient connectivity and a managed firewall. A smaller organisation with several sites, important cloud applications or more complex failover requirements can still benefit from SD-WAN.
What should a Managed SD-WAN provider monitor?
Link availability is only part of it. Monitoring should cover path quality, failover behaviour and the applications using those paths, including latency, jitter and packet loss where they affect routing decisions.
How do you handle carrier faults?
We use the network data already available to establish the affected site and path, raise the fault with the carrier and follow it through to restoration. Recurring issues are reviewed against the path history and failover behaviour.
Can SD-WAN improve Microsoft 365 and Teams performance?
Yes, when the network path contributes to the problem. Application-aware routing can move traffic onto a better available path, while direct cloud access can shorten the route from a site to Microsoft services. Performance still depends on the carrier service, firewall, local network and Microsoft service path.
Do we need SASE as well?
Not necessarily. SD-WAN can be deployed on its own. SASE or ZTNA becomes relevant where remote access, cloud-delivered security or identity-based application access also needs to change.
What does a Managed SD-WAN service include?
Monitoring, application routing, failover, network change, carrier escalation, firmware, lifecycle and documentation across the SD-WAN environment.
Talk to us before your next WAN or carrier decision
Tell us about your sites, connectivity, application performance or current SD-WAN environment. We'll work through the requirements and recommend a suitable design and management approach.