Skip to main content
010 447 2445Contact
Arke Technologies home
Request a hardware quoteTalk to us
Arke Technologies home
Two technicians work on overhead lines from a cherry picker.

What is SD-WAN? SD-WAN vs MPLS cost, and when your organisation needs it

Last reviewed: September 2026

SD-WAN (software-defined wide area network) links an organisation's sites over any mix of fibre, LTE, 5G and MPLS, and steers each application down the healthiest path. This guide explains SD-WAN in simple terms, compares SD-WAN vs MPLS cost and shows when you need it. Arke Technologies designs and manages SD-WAN from Johannesburg.

Talk to usSee our SD-WAN service
Insights

What is SD-WAN? SD-WAN vs MPLS cost, and when your organisation needs it

Last reviewed: September 2026, 14 min read

SD-WAN (software-defined wide area network) links an organisation's sites over any mix of fibre, LTE, 5G and MPLS, and steers each application down the healthiest path. This guide explains SD-WAN in simple terms, compares SD-WAN vs MPLS cost and shows when you need it. Arke Technologies designs and manages SD-WAN from Johannesburg.

Last reviewed: September 2026, 14 min read

On this page

What is SD-WAN in simple terms?

In simple terms, SD-WAN is a traffic controller for the links between your sites. Each branch, campus, clinic or depot keeps its own connections, and a small SD-WAN device at each site measures them continuously and sends every application along the path that is working best at that moment. When a link slows down or fails, traffic moves to another automatically, without anyone reconfiguring a router.

The name explains the rest. A wide area network (WAN) connects sites that are far apart: head office, branches, a data centre and the cloud services everyone uses. SD-WAN is short for software-defined wide area network, sometimes written SD wide area network or SDWAN. "SD" in networking means software-defined: decisions about where traffic goes are made by central software and pushed to every site as policy, instead of being configured router by router. The same idea applied inside data centres and campuses is called software-defined networking (SDN).

What changes for the organisation is control. Instead of a carrier deciding how your traffic travels, your IT team, or the team that manages the network for you, sets the rules once, sees every link and application on one dashboard, and adds a site by connecting a device that arrives already configured. This guide deals with the decision; our SD-WAN and site connectivity page covers the platforms and how we deliver them, and more guides sit in our insights library.

A worker in a hard hat and hi-vis carries a coil of blue cable along a street.

How SD-WAN works: the underlay, the overlay and the controller

An SD-WAN has three layers (the underlay, the overlay and the controller) and uses them for two jobs: choosing a path for each application and letting cloud traffic out locally. The second layer answers a common question: what is an SD-WAN overlay?

  1. The underlay

    The physical links at each site: business fibre, fixed LTE or 5G, a dedicated internet line or an existing MPLS circuit. SD-WAN does not replace these links; it uses them.

  2. The overlay

    The SD-WAN devices build encrypted tunnels across the underlay, from each site to the others, to a hub or directly to cloud services. This virtual network of tunnels is the overlay: every site sees one private network, whatever mix of links sits underneath.

  3. The controller

    Central software, in the cloud or on your own servers, holds the policies: which applications matter most, which may use the mobile link and how security applies. It pushes those policies to every device and collects their measurements.

  4. Path selection

    Each device measures delay, jitter and packet loss on every tunnel and sends each flow down the path that meets its policy. Voice and video get the cleanest path; a large backup can take the cheaper one.

  5. Local breakout

    Traffic for Microsoft 365, Google Workspace and other cloud services can leave for the internet at the branch, through a firewall, instead of travelling to head office first.

The result is a WAN that uses every link it pays for, rather than leaving a backup line idle until the main one fails.

SD-WAN vs MPLS: the differences that matter

An MPLS (multiprotocol label switching) network is a private WAN that a carrier builds and runs for you. Each site has a circuit into the carrier's network, and the carrier commits to performance for classes of traffic, such as voice, in its service-level agreement. SD-WAN starts from the opposite assumption: no single link is perfect, so reliability comes from several links, measured and managed from your side.

QuestionMPLSSD-WAN
Who controls the routing?The carrier, through change requestsYour team or your managed service provider, through central policy
Where does reliability come from?One engineered circuit and the carrier's commitmentsTwo or more links per site, ideally on different networks
How does cloud traffic travel?Usually back to a hub, then out to the internetDirectly from each site, through a firewall
Is traffic encrypted?Private, but not encrypted by defaultEncrypted in tunnels between sites
How fast can a site be added?When the carrier has provisioned the circuitAs soon as any fibre or LTE link is live
What can you see?The carrier's reportsLive measurements per link and per application

Neither is better for everyone. MPLS still suits an application that needs guaranteed latency from end to end, and a network under a contract with years left to run. SD-WAN suits organisations whose work has moved to the cloud and whose sites need more bandwidth and resilience than one circuit provides. Many run both for a while, with SD-WAN steering traffic across MPLS and broadband until each MPLS contract ends.

SD-WAN vs MPLS cost: what you actually pay for

Last reviewed: September 2026

The SD-WAN vs MPLS cost question is rarely settled by putting two monthly invoices side by side. MPLS bundles the link, the carrier's engineering and its performance commitments into one price per site. SD-WAN splits the same outcome into parts you buy separately. Where SD-WAN saves money, the saving comes from carrying traffic on business fibre and LTE, which generally cost less per megabit than a private circuit; where it disappoints, some of the parts were never counted.

Cost lineMPLSSD-WANWhat to check
LinksOne carrier circuit per site, priced by bandwidth and class of serviceUsually two links per site, such as business fibre plus LTE or 5G, from any providerThat the second link runs over a genuinely different network
EquipmentA carrier-managed router, often inside the monthly feeAn edge device per site, bought or rented, with a pair at each hubThroughput with encryption and security features switched on
LicencesUsually included in the serviceA subscription per device, often with a security tierThe renewal price in rand, and what stops working if it lapses
Internet and cloud accessCentral breakout at a hub, which needs its own bandwidth and firewallBreakout at each site, which needs a firewall or cloud security service at eachWho runs the security policy, and how changes are approved
ChangesCarrier change requests, sometimes billedPolicy changes made centrallyWho may make changes, and how they are logged
ManagementLargely inside the carrier's serviceMonitoring, updates and reporting, in-house or managedThe hours your team would spend, or the managed service fee
ContractMulti-year terms, with early-exit penaltiesDevice licences on one- to five-year terms; links on their own termsNotice periods and the cost of leaving

How to compare the two for your own sites:

  1. List every site with its current circuit, bandwidth, monthly charge and contract end date.
  2. Record what each site needs: users, applications, call volumes, cloud services, and what an hour of downtime costs there.
  3. Design the SD-WAN underlay for each site, usually two links, and price links, devices, licences and security over the same term as the MPLS contract.
  4. Add the once-off costs on both sides: installation, migration work, early-termination fees and the months you pay for both networks while sites move.
  5. Compare the total over three or five years, with the bandwidth and resilience each option buys set beside the price. An option that costs slightly more but doubles bandwidth and removes a single point of failure is often the better buy.

The savings usually come from cheaper bandwidth per megabit, backup links that carry traffic instead of sitting idle, fewer carrier change fees, less bandwidth at the hub once cloud traffic leaves locally, and quicker openings for new sites. They disappear into the second link at every site, security at every breakout, licence renewals, mobile data used while fibre is down, and months of running two networks during migration.

Management is a real line too. Where network management sits inside a managed IT agreement, published South African managed IT rates run from about R180 to R400 per user per month (matnet.co.za, September 2026); our guide to managed IT services costs explains what drives them. We do not publish SD-WAN prices, because the total depends on your sites, links, bandwidth and term; we model yours against your current MPLS invoices instead.

Does your organisation need SD-WAN?

You probably need SD-WAN if several of these are true:

  • You run three or more sites, such as branches, campuses, clinics, depots or satellite offices, that depend on systems at head office, in a data centre or in the cloud.
  • An outage at one site stops real work: tills, patient records, pay points, learner systems or a production line.
  • MPLS contracts are coming up for renewal, or new sites wait weeks for a circuit.
  • Cloud applications are slow at branches because their traffic travels through head office first.
  • Calls and video meetings break up at some sites; our guide to VoIP for business explains what voice needs from a network.
  • Failover to a backup link is manual, or nobody is sure the backup works.
  • Your board, an auditor or a regulator expects documented network controls and regular reporting.

You probably do not need it yet if you have a single site, or two sites with little traffic between them, and your staff work mainly in cloud applications. A business fibre line with an LTE backup, and a firewall that fails over between them, usually keeps such an office working; our guide to business fibre vs home fibre explains what to ask of the line.

Two South African conditions strengthen the case. Load-shedding can take a site offline when its router or the network's equipment loses power, and fibre does not yet reach every town or industrial site, so many sites rely on LTE or 5G as a main or second link. SD-WAN treats a mobile link as a full path rather than an idle spare, with data limits set in policy.

Risks in an SD-WAN project, and how to prevent them

  • Two links, one failure. Connections that share a duct, a pole route or a network fail together. We check that each site's links use different networks and, where possible, different technologies, such as fibre and LTE.
  • Devices sized without security. An edge device's headline throughput is often measured with encryption and inspection switched off. We size devices with every feature you will use switched on.
  • Unprotected breakout. Sending cloud traffic straight to the internet from a branch is only safe when every branch is firewalled. We design security at each breakout, on the device or as a cloud service; see what a firewall is and which one you need.
  • Lapsed licences. On many platforms an expired subscription removes features or support. Renewals sit in our service calendar, and in your budget from the first year.
  • Lock-in. Devices, licences and controller access should be registered to your organisation, with configurations and diagrams you keep.
  • Power. The edge device, the fibre router, the LTE router and the switch all need backup power, or load-shedding takes the site down whatever the design.
  • A big-bang migration. Moving every site at once puts everything at risk at once. We pilot one or two sites, test failover by disconnecting each link in turn, and keep a rollback plan until each site is signed off.
  • Dashboards nobody reads. Links and devices are watched through network monitoring, faults are raised as tickets, and the monthly review reports performance per site.

How Arke Technologies delivers SD-WAN

  1. Assess

    We map your sites, links, applications and contracts, including notice periods.

  2. Model the cost

    MPLS and SD-WAN side by side over your contract term, with once-off and monthly costs shown separately.

  3. Design

    The underlay for each site and the overlay across them: topology, application policies, security zones and failover. Fibre Boyz, our connectivity division, can supply business fibre and LTE, so the links and the network sit with one supplier; see business connectivity.

  4. Pilot and roll out

    Edge devices come through Server Hub, our hardware division, configured before dispatch, and the pilot proves failover before other sites move.

  5. Manage

    Monitoring, firmware, licences and change control under one SLA. Incidents are prioritised from P1, a critical outage, to P4, a low-impact request, with response and resolution targets agreed in your SLA to match the business impact of downtime.

  6. Review

    A monthly service review and report shows every link and site against its targets.

SD-WAN is one part of our network infrastructure services, alongside firewalls, Wi-Fi and structured cabling, so the links, the security and the site network are designed together.

Governance, compliance and procurement

  • Governance. Every policy change is requested, approved and logged; configuration backups and network diagrams stay current; and reports show link performance and incidents per site.
  • Compliance. Encrypted links between sites support the POPIA requirement (section 19) for reasonable technical measures to protect personal information. King IV Principle 12 places technology and information governance with the board, and PFMA and MFMA audits in departments and municipalities expect documented network controls and change records.
  • Procurement. Arke Technologies (Pty) Ltd is a Level 1 B-BBEE contributor (sworn affidavit available on request), giving buyers 135% procurement recognition. Company documents, our CSD supplier number and SARS tax compliance status are available on request. You can buy on a written proposal and SLA against your purchase order, or through a tender, for which we complete the standard bidding documents (SBD forms).
  • Continuity. The devices you buy, the licences, controller access, configurations and documentation are registered to your organisation, so the network keeps running if you change provider.

Related services

Related guides

Get our guides by email

Plain, sourced guides for the people who decide on and buy technology, sent to your inbox.

Topics (optional)

Leave these clear to receive everything.

By signing up, you agree that Arke Technologies (Pty) Ltd may email you guides and updates. Every email includes an unsubscribe link. Read our privacy notice.

Frequently asked questions

What is SD-WAN in simple terms? Show answer

SD-WAN is software that runs the links between an organisation's sites as one network. A device at each site measures every connection, such as fibre, LTE or MPLS, and sends each application down the best one, moving traffic automatically when a link fails. Central policy replaces router-by-router configuration, so adding or changing a site is quicker and more consistent.

Is SD-WAN cheaper than MPLS? Show answer

Often, but not automatically. SD-WAN usually buys more bandwidth for the money, because business fibre and LTE generally cost less per megabit than a private MPLS circuit. The saving shrinks once you add a second link at each site, device licences, security at every breakout and management. Compare the total cost over the contract term, site by site, before deciding.

What is an SD-WAN overlay? Show answer

An SD-WAN overlay is the virtual network of encrypted tunnels that SD-WAN devices build on top of each site's physical links. The physical links, such as fibre, LTE or MPLS, are the underlay. Because the overlay hides the differences between them, the organisation manages one private network and one set of policies, whatever mix of links each site has.

What does SD stand for in networking? Show answer

SD stands for software-defined. In a software-defined network, decisions about how traffic flows are made by central software and sent to devices as policy, instead of being configured on each device by hand. SD-WAN applies the idea to the links between sites, and software-defined networking (SDN) applies it inside data centres and campus networks.

Can SD-WAN replace MPLS completely? Show answer

Yes, for most organisations whose applications run in the cloud, provided each site has two dependable links on different networks. Where one application needs guaranteed latency from end to end, or an MPLS contract has years to run, keep MPLS at those sites and let SD-WAN steer traffic across MPLS and broadband together until the contract ends.

Is SD-WAN secure? Show answer

Yes, when it is designed with security at every site. SD-WAN encrypts traffic between sites, which MPLS does not do by default, and applies one policy across the network. Its weak point is local internet breakout: each site that sends traffic straight to the internet needs a firewall or a cloud security service, configured and monitored like any other.

How many sites does an organisation need before SD-WAN makes sense? Show answer

There is no fixed number, but SD-WAN usually earns its cost at three or more sites that depend on central or cloud systems. Two sites can justify it when downtime is expensive, such as a clinic or a production site. A single office is usually better served by business fibre, an LTE backup and a firewall that fails over between them.

Compare SD-WAN and MPLS for your sites

Send us your site list and your current WAN contracts, and we will set out SD-WAN vs MPLS cost over your contract term, with the resilience each option buys.

Talk to us