SD-WAN vs MPLS vs SASE
MPLS provides private WAN connectivity between sites. SD-WAN manages traffic across available connections, with application-aware routing and central policy. SASE brings cloud-delivered security and identity-aware access into the architecture.
We help businesses assess these options against their existing network, application requirements, security needs and carrier contracts. The decision may involve replacing MPLS, introducing SD-WAN, extending security through SASE or combining elements of all three.
What determines the best WAN architecture?
The choice starts with the applications your sites use, the connections available and the way the network will be operated after deployment. These factors shape the decision.
- Applications and cloud traffic. Microsoft 365, Teams, SaaS, Azure, private applications and AI workloads have different traffic patterns. We examine where the applications run and how users and systems reach them.
- Sites and network topology. The number and location of sites affect connectivity choices, network resilience, routing, central management and security policy.
- Existing carrier contracts. MPLS renewal dates, notice periods, early termination charges and carrier dependencies can influence when a migration is commercially sensible.
- Connectivity available at each location. nbn, business fibre, broadband, 4G/5G, Starlink and retained private connectivity need to be assessed site by site.
- Security and access requirements. Branch firewalls, remote users, third-party access, segmentation and cloud security determine where security controls need to operate.
- Ongoing management. SD-WAN and SASE introduce policy, monitoring, licensing and operational responsibilities. The organisation needs a clear model for maintaining them.
MPLS, SD-WAN and SASE solve different problems
They come from different points in WAN architecture, and they can work together.
MPLS provides carrier-managed private connectivity between locations, commonly with contractual service levels and traffic-class options.
It remains relevant for applications requiring controlled private-network transport, sites with limited alternative connectivity and environments where existing carrier arrangements continue to meet operational requirements.
MPLS transport does not automatically provide encryption, application security or protection against threats.
SD-WAN manages traffic across different WAN connections, which may include fibre, nbn, broadband, 4G/5G, Starlink and MPLS.
It can monitor path quality, select routes according to application and network policy, support local internet breakout and provide central visibility across sites.
Performance depends on the available connections and how the SD-WAN platform is configured and managed.
Secure Access Service Edge brings networking and security capabilities into a cloud-delivered architecture.
Depending on the platform and services selected, these can include Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), Zero Trust Network Access (ZTNA), Firewall as a Service (FWaaS) and SD-WAN integration.
SASE can secure traffic from branches, remote workers and other users. It can be introduced alongside an existing WAN, with its scope set by identity, application and security requirements.
How MPLS, SD-WAN and SASE compare
The same decision areas for each model, side by side. Select a model to bring its column forward.
| Decision area | |||
|---|---|---|---|
| Connectivity | Carrier-provided private circuits | Fibre, nbn, broadband, 4G/5G, Starlink, MPLS or a mix | Uses internet, SD-WAN or private connectivity to reach the service edge |
| Application performance | Carrier traffic classes and service levels within the private network | Path selection based on application policy and measured link quality | Depends on WAN access, service-edge location and inspection architecture |
| Cloud connectivity | Requires a suitable internet or cloud-access design | Supports local breakout and application-aware routing | Applies cloud security controls to internet, SaaS and application access |
| Resilience | Depends on carrier architecture, circuit diversity and restoration arrangements | Can monitor path quality and steer traffic across eligible connections | Depends on resilient access, service-edge availability and the chosen architecture |
| Security | Private transport; encryption and threat protection require separate controls | Encryption and integrated firewall capabilities depend on the platform | Common capabilities include SWG, CASB, ZTNA and FWaaS |
| Carrier flexibility | Usually tied to the carrier's MPLS service | Can combine different carriers and technologies | Can operate across different carriers, with suitable connectivity |
| Cost structure | Private circuit charges, service commitments and contract terms | Connectivity, hardware, licensing, deployment and management | Cloud security subscriptions, integration and ongoing administration |
| Management | Carrier operates the transport; internal IT or a provider manages the surrounding systems | Routing policy, monitoring, security, firmware and underlays need ongoing management | Adds identity, cloud security, access policy and service-edge administration |
- Connectivity: Carrier-provided private circuits
- Application performance: Carrier traffic classes and service levels within the private network
- Cloud connectivity: Requires a suitable internet or cloud-access design
- Resilience: Depends on carrier architecture, circuit diversity and restoration arrangements
- Security: Private transport; encryption and threat protection require separate controls
- Carrier flexibility: Usually tied to the carrier's MPLS service
- Cost structure: Private circuit charges, service commitments and contract terms
- Management: Carrier operates the transport; internal IT or a provider manages the surrounding systems
- Connectivity: Fibre, nbn, broadband, 4G/5G, Starlink, MPLS or a mix
- Application performance: Path selection based on application policy and measured link quality
- Cloud connectivity: Supports local breakout and application-aware routing
- Resilience: Can monitor path quality and steer traffic across eligible connections
- Security: Encryption and integrated firewall capabilities depend on the platform
- Carrier flexibility: Can combine different carriers and technologies
- Cost structure: Connectivity, hardware, licensing, deployment and management
- Management: Routing policy, monitoring, security, firmware and underlays need ongoing management
- Connectivity: Uses internet, SD-WAN or private connectivity to reach the service edge
- Application performance: Depends on WAN access, service-edge location and inspection architecture
- Cloud connectivity: Applies cloud security controls to internet, SaaS and application access
- Resilience: Depends on resilient access, service-edge availability and the chosen architecture
- Security: Common capabilities include SWG, CASB, ZTNA and FWaaS
- Carrier flexibility: Can operate across different carriers, with suitable connectivity
- Cost structure: Cloud security subscriptions, integration and ongoing administration
- Management: Adds identity, cloud security, access policy and service-edge administration
The important distinction. MPLS provides transport. SD-WAN manages network paths and traffic. SASE extends network and security policy to users, sites and applications through cloud-delivered services. These technologies can work together, and the design may change over time.
Where each model makes sense
Select what applies across your sites. The panel shows which models your situation points to.
Tick a few signals to see where they point.
MPLS may remain, SD-WAN may be introduced over existing connections, and SASE may be deployed at the same time or later. We determine the combination from the environment and its requirements.
How cloud and AI change the WAN decision
Traditional WAN designs often sent branch traffic through head office or a data centre before it reached the internet. That model can still serve private applications, but it can add unnecessary network distance for services hosted in Microsoft 365, Azure and other cloud platforms.
AI introduces additional traffic patterns. Agents, applications and automated processes may exchange information through APIs, cloud services and internal systems without a user starting each request. We look at:
Map application destinations, cloud regions, private services, APIs and dependencies between systems.
Decide which applications benefit from local internet breakout, which need private routes and where application-aware steering is appropriate.
Review firewall inspection, data protection, identity, secure access and logging across branch, cloud and remote-user traffic.
Review your MPLS options before renewal
A coming MPLS renewal is a useful point to assess the network architecture. Start early enough to review carrier terms, test alternative connectivity and complete any migration before contractual notice deadlines. Some networks justify retaining MPLS. Others can reduce private-network capacity, replace selected circuits or move to SD-WAN across internet connections.
What to examine:
Record each circuit, supplier, service level, monthly cost, expiry date, notice period and termination condition.
Confirm fibre, nbn, broadband, cellular and satellite options at each location, including installation and restoration considerations.
Test whether alternative connectivity can support the applications and workloads currently using MPLS.
Design routing, SD-WAN policy, local breakout, encryption, segmentation and monitoring before changing production connections.
Allow for testing, carrier provisioning, agreed cutovers and retirement of legacy services.
Is SD-WAN cheaper than MPLS?
It can be, particularly where expensive private circuits can be replaced with suitable business internet services. But the savings depend on the sites, applications, existing contracts and operating model. Comparing the circuit price alone gives an incomplete picture.
- Existing MPLS services: Monthly circuits, access charges, managed-router fees and contract commitments
- Replacement connectivity: Business fibre, nbn, broadband, wireless and satellite services
- SD-WAN platform: Firewalls or edge appliances, licences, subscriptions and central management
- Deployment: Design, staging, installation, cutover, testing and documentation
- Security: Firewall services, inspection subscriptions, secure access and logging
- Ongoing operation: Monitoring, policy changes, firmware, incident response and carrier coordination
- Transition: Parallel services, cancellation charges and unavoidable contract overlap
- SASE, where applicable: Cloud-delivered security subscriptions, identity integration and administration
What we recommend: model the total cost over the relevant contract period, including transition and ongoing management, and compare it with the performance, security and resilience the business will receive.
Moving from MPLS to SD-WAN
A controlled migration lets the new architecture be validated before existing connections are retired. Our SD-WAN Deployment guide covers the full rollout discipline.
Document site topology, circuits, routing, addressing, applications, security controls, dependencies and contract dates.
Choose the connectivity for each site, including resilience, application routing, hardware sizing, security and central management.
Select representative locations and test application behaviour, path quality, failover, security inspection and monitoring.
Coordinate carrier provisioning, site access and after-hours production cutovers. Where the architecture permits, validate the new network alongside existing services.
Verify acceptance criteria under production conditions. Retire MPLS connections according to agreed operational requirements and carrier contract terms.
What to consider at Australian sites
National networks face different connectivity conditions across metropolitan, regional and remote locations.
Service type, available bandwidth, contention, restoration arrangements and physical-path diversity vary by location.
Some sites can support multiple independent fixed connections. Others have limited access choices or shared infrastructure that affects resilience.
Wireless and satellite services can provide backup, temporary connectivity or an alternative where fixed services are unavailable.
We assess signal, congestion, capacity, antenna and equipment requirements, power, public addressing and application behaviour before including them in the design.
Direct internet breakout can improve performance where central backhaul adds unnecessary latency. The outcome depends on the branch location, ISP routing, application destination, security inspection and peering.
For Microsoft 365 and other cloud applications, we validate real network paths and application behaviour.
Two services are not necessarily independent. We investigate the carriers, physical paths, access infrastructure and shared points of failure.
The underlay design needs to reflect each site's actual conditions. We validate connectivity availability and performance before committing to the replacement architecture.
What to check before choosing a platform
Before selecting SD-WAN hardware, renewing MPLS or planning SASE, we review:
- Existing WAN topology, MPLS circuits and inter-site routing
- Carrier contracts, renewal dates, notice periods and termination conditions
- nbn access technologies and business fibre availability by site
- Cellular and Starlink options for backup or temporary connectivity
- Application requirements, including Teams, Microsoft 365, ERP and private workloads
- Latency, jitter, packet loss and bandwidth demands
- Physical-path diversity and backup capacity
- Firewall, VPN, segmentation and local-breakout requirements
- Central management, logging, reporting and change control
- Remote-user access, identity integration and SASE requirements
- Internal IT responsibilities and ongoing service ownership
- Total cost of connectivity, licences, deployment and management
This information establishes which architecture is viable and what it will take to operate it. Platform choice follows the assessment, including the choice between Fortinet SD-WAN and Cisco Meraki.
From WAN assessment to ongoing operation
We work with internal IT teams to assess the network, design the architecture and deliver the transition.
We examine the network topology, circuit inventory, carrier contracts, renewal terms, current spend and application dependencies.
We review fixed, wireless and satellite services at each site, including capacity, resilience and carrier diversity.
We design routing, application policy, failover, security inspection and central management on the platform that suits the environment. Our experience includes Fortinet, FortiGate, FortiManager, FortiAnalyzer and Cisco Meraki.
We manage pilot testing, carrier coordination, staging, production cutovers, validation and rollback.
We evaluate whether cloud security, ZTNA and identity-aware access should be included now or introduced later.
We provide monitoring, configuration changes, firmware and lifecycle management, carrier escalation and reporting under an agreed operating model.
Your IT team can retain management access, architecture governance and change authority according to the responsibilities set for the engagement.
Common questions about SD-WAN, MPLS and SASE
What is the difference between SD-WAN and MPLS?
What is the difference between SD-WAN and SASE?
Is SD-WAN cheaper than MPLS?
Is SD-WAN more secure than MPLS?
Does SD-WAN replace MPLS entirely?
Can MPLS and SD-WAN run together?
Can SD-WAN match MPLS performance?
How long does an MPLS-to-SD-WAN migration take?
What connectivity does SD-WAN require?
Should MPLS be cancelled before SD-WAN deployment?
Where does SASE fit in the migration?
Do we need SASE if we already have SD-WAN?
Can SASE be introduced without replacing MPLS first?
Can you work with our existing IT team?
Talk to us before your next WAN decision
Tell us about the MPLS renewal, SD-WAN plan or remote-access review in front of you. We'll assess the current environment, available connectivity, contracts and application requirements with your IT team.