Skip to main content
010 447 2445Contact
Arke Technologies home
Request a hardware quoteTalk to us
Arke Technologies home
A worker in a hard hat and hi-vis carries a coil of blue cable along a street.

SD-WAN for multi-site organisations, and MPLS vs SD-WAN explained

SD-WAN (software-defined wide area network) connects your offices, branches, campuses or clinics over fibre, LTE and 5G, and steers each application down the best available link under central policy. Arke Technologies designs, deploys and manages SD-WAN across South Africa from Johannesburg, and gives you a straight MPLS vs SD-WAN comparison first.

Talk to usCompare MPLS and SD-WAN

What is SD-WAN? The meaning, explained

Start with the WAN. A wide area network connects sites that are far apart: head office, branches, data centres and cloud services. That is the WAN defined in one sentence, and the WAN description most buyers recognise is the set of lines and routers that link their offices. The traditional WAN technologies are leased lines, MPLS circuits from a carrier and site-to-site VPNs over the internet.

SD-WAN stands for software-defined wide area network. That is the full form; it is also written SD WAN or SDWAN, and the meaning is in the first two words. An SD-WAN builds encrypted tunnels over whatever links each site has, whether fibre, LTE, 5G or MPLS, and a central controller decides, application by application, which path each flow takes, based on live measurements of delay, jitter and packet loss. When a link degrades, calls and critical applications move to a healthy one without anyone having to notice first.

Put another way, SD-WAN applies the ideas of software-defined networking (SDN) to the WAN network, separating the control plane, where policy is decided, from the data plane at each site. The purpose of SD-WAN is better application performance and resilience over more varied links, with one place to manage every site. It is sometimes marketed as WAN 2.0, but it is less a new network than a smarter way to run the WAN connectivity you already buy. For a longer explanation, read what is SD-WAN.

Two technicians work on overhead lines from a cherry picker.

MPLS vs SD-WAN: which is better?

MPLS (multiprotocol label switching) is a private network a carrier runs for you, with performance guarantees end to end. SD-WAN runs over any mix of links and makes up for the absence of guarantees by using more than one path. The comparison:

MPLSSD-WAN
UnderlayOne carrier's private circuitsAny mix of business fibre, LTE, 5G and MPLS
PerformanceCarrier SLA on latency, with priority for voiceMeasured per link, with traffic steered to the best path
ResilienceDepends on the carrier; a second circuit is a second full costTwo or more links from different networks at each site
Cloud accessBackhauled through head office or a hubDirect, firewalled breakout to Microsoft 365, AWS and Azure
SecurityPrivate, but unencrypted by defaultEncrypted tunnels, with a firewall needed at each edge
Adding a siteWaits on carrier provisioningAs soon as any fibre or LTE link is live
VisibilityCarrier reportsPer-application dashboards you control
ContractMulti-year terms with one carrierDevice licences, with links from any provider

So which is better, SD-WAN or MPLS? For most South African organisations whose applications now live in the cloud, SD-WAN over business fibre and LTE gives more bandwidth, better resilience and direct cloud access. MPLS still earns its place where a single application needs guaranteed latency end to end, or where a contract has years to run. Many organisations therefore run a hybrid SD-WAN, with SD-WAN over MPLS and broadband together, keeping the MPLS circuit at the sites that need it and retiring it elsewhere as contracts end.

A technician lays cable from a pit beside a pavement, a test case open beside him.

What SD-WAN is used for, and who uses it

SD-WAN is used wherever an organisation has several sites that depend on central or cloud systems, and it is the site-to-site layer of our network infrastructure services. It suits:

  • Branch networks

    Retail, distribution, financial services and healthcare organisations with many small sites and a few critical applications.

  • Municipalities and provincial departments

    Satellite offices, libraries, clinics and pay points connected to billing, finance and records systems.

  • Mining and industrial operations

    Remote sites where fibre is not always available and LTE or 5G carries the load.

  • Home and remote workers

    Some platforms extend SD-WAN for home offices with a small edge device or client software; for most staff, a remote-access VPN or a cloud security service does the job.

Load-shedding adds a local reason. When a fibre link drops during an extended outage, SD-WAN moves traffic to an LTE or 5G link from another network, and critical work continues, provided the site cabinet is on a UPS.

SD-WAN security benefits, SASE, and whether SD-WAN is obsolete

The SD-WAN security benefits are practical: every link between sites is encrypted, traffic can be segmented by department or application, policy is set once and pushed to every site, and security-led platforms build a next generation firewall into each edge device. Direct internet breakout is only safe if every site is firewalled; see firewalls and network security.

SASE (secure access service edge) combines SD-WAN with cloud-delivered security: secure web gateways, zero-trust access for remote users, cloud access security and firewall as a service. That raises a common question: is SD-WAN obsolete? No. SASE SD-WAN is still SD-WAN; part of the security moves into the cloud, but every site still needs an edge that chooses paths and holds tunnels. We design today's SD-WAN so that a later move to SASE security does not force a redesign.

Yellow fibre patch leads fanned into a fibre distribution frame.

SD-WAN solutions: the platforms and how they differ

SD-WAN solutions fall into a few families. We configure Fortinet, Cisco, Sophos, MikroTik, Ubiquiti UniFi and TP-Link Omada equipment (experience, not partner status), and we recommend the family that fits your sites:

  • Firewall-led SD-WAN. Fortinet builds SD-WAN into its FortiGate firewalls (often searched as Forti SD-WAN), and Sophos Firewall includes SD-WAN routing. One box per site handles security and path selection, which suits enterprise SD-WAN designs with strict security needs.
  • Router-led SD-WAN. Cisco SD-WAN, the former Viptela platform now sold as Cisco Catalyst SD-WAN, runs on Cisco routers. Check existing hardware against the list of Cisco SD-WAN supported routers before planning. In its design, sites exchange routes over the Overlay Management Protocol (OMP), and each WAN link is identified as a transport locator (TLOC) in the overlay.
  • Cloud SD-WAN and virtual edges. SD-WAN software also runs as a virtual appliance on VMware or Hyper-V, or inside AWS, Microsoft Azure and Google Cloud, so cloud workloads join the WAN as another site. Some operators deliver it on universal customer premises equipment (uCPE), one box running several virtual network functions.
  • Carrier-managed SD-WAN. Bundled with the links and convenient, but tied to one provider's network and contract.
  • Free and open-source options. Firewalls such as pfSense and OPNsense offer multi-WAN failover and policy routing at no licence cost, but not the central orchestration that defines SD-WAN; they suit a handful of sites with a capable in-house team.

How we deliver managed SD-WAN

  1. Assess

    We map every site, its links, its applications and its traffic, and read your existing WAN contracts for notice periods.

  2. Design the underlay

    Ideally two links per site from different networks: business fibre plus LTE or 5G. Fibre Boyz, our connectivity division, can supply business fibre and LTE, so one supplier carries the whole stack; see business connectivity.

  3. Design the overlay

    Topology (hub-and-spoke or mesh), application policies for voice, Microsoft 365 and line-of-business systems, security zones and failover behaviour.

  4. Pilot

    One or two sites first, with failover tested by disconnecting each link in turn.

  5. Roll out

    Edge devices are supplied through Server Hub and configured before dispatch; where the platform supports zero-touch provisioning, a site comes online once its device is connected. Each site needs clean structured cabling, power and, where staff roam, sound business Wi-Fi.

  6. Manage and report

    Link quality, firmware, licence renewals and change control, with a monthly service review showing performance per site and per link, backed by network monitoring.

SD-WAN and MPLS costs: what drives the price

Last reviewed: September 2026

We quote the rollout as a project after an assessment, and ongoing management inside a managed service agreement. What drives the cost of each option:

  • Sites and links. The number of sites, the links at each and their bandwidth. Business fibre and LTE can come from any provider; MPLS circuits are priced per site by one carrier, usually on multi-year terms.
  • Edge devices. One appliance per site, or a high-availability pair at head office and data centres.
  • Licences and subscriptions. Most SD-WAN platforms license each edge device for one to five years, and security features add to that.
  • Orchestration. A cloud controller, or an on-premises one that you host.
  • Management. Monitoring, changes and reporting over the contract term.

The comparison that matters is total cost over the term, including the second link each site needs. We model MPLS and SD-WAN side by side for your estate before you decide.

Governance, compliance and procurement

  • Governance. An SLA that fixes scope, response times and escalation; change control on every policy change; and a monthly service review with per-site performance.
  • Compliance. Encrypted links between sites support POPIA's requirement for reasonable technical measures to protect personal information in transit. King IV Principle 12, and PFMA and MFMA audits in the public sector, expect documented network design, access control and change records, which we keep.
  • Procurement. A Level 1 B-BBEE contributor (sworn affidavit available on request), giving buyers 135% procurement recognition. Company documents, our CSD supplier number and tax compliance status are available on request, and we complete standard bidding documents for tenders. We work to proposal, SLA and purchase order; see procurement and compliance.
  • Continuity and exit. Controller access, configurations, network diagrams and licences are registered to you, so the network keeps running if you change provider.

How to choose among SD-WAN companies

  • Treat analyst rankings, such as the Gartner Magic Quadrant for SD-WAN, as a starting list rather than a decision; the right platform depends on your sites and your team.
  • Ask whether the service or product is certified under MEF 3.0 SD-WAN, the MEF 70 standard that defines common SD-WAN service terms, so you can compare proposals like for like.
  • Ask to see failover in a pilot, with calls running, before you sign.
  • Check that each site's two links travel over genuinely different networks.
  • For sites in other countries, ask whether you need a global SD-WAN service with a provider backbone between regions.
  • Read the exit terms: who owns the devices, the licences and the configuration.

Frequently asked questions

Which is better, SD-WAN or MPLS? Show answer

SD-WAN is the better fit for most organisations whose applications run in the cloud, because it combines several affordable links, steers traffic to the healthiest one and breaks out directly to cloud services. MPLS remains the better choice where one application needs guaranteed latency end to end. Many organisations run both for a while, using SD-WAN over MPLS and broadband until MPLS contracts end.

What is an SD-WAN used for? Show answer

An SD-WAN is used to connect several sites to each other and to cloud services over a mix of links, with central control over which traffic takes which path. Typical uses are branch and campus connectivity, keeping voice and video calls clear, failing over to LTE or 5G when fibre drops, and applying one security policy across every site.

Is SD-WAN obsolete? Show answer

SD-WAN is not obsolete; it has become the network half of SASE (secure access service edge). SASE adds cloud-delivered security, such as secure web gateways and zero-trust access, but every site still needs an edge device that holds tunnels and chooses paths. A well-designed SD-WAN can adopt SASE security later without a redesign of the sites.

Why is SD-WAN better than a traditional WAN? Show answer

SD-WAN is better than a traditional WAN mainly because it uses every link a site has instead of leaving backups idle. It measures each link continuously, sends critical traffic down the best one, encrypts everything between sites and is managed from one console. Adding a site is faster, and cloud applications no longer travel through head office first.

What are five disadvantages of using a WAN? Show answer

Five common disadvantages of a traditional WAN are cost, because private circuits are expensive for the bandwidth; complexity, because many sites and devices must be configured; security exposure, because every link is a way in; performance, with delay over distance and congestion; and dependence on carriers for changes and repairs. SD-WAN reduces most of these, though it still needs good design and management.

What companies use SD-WAN? Show answer

Organisations with several sites use SD-WAN: retailers, distributors, banks and insurers with branches, healthcare groups, mining companies, and public bodies such as municipalities and provincial departments. Colleges and school groups with more than one campus use it too. The common thread is several locations that depend on central or cloud systems, where an outage at one site stops real work.

Does SD-WAN work with 5G and LTE? Show answer

Yes, SD-WAN works well with 5G and LTE, which are common second links at South African sites and the only links at some remote ones. A 5G SD-WAN design uses the mobile link as a full path rather than an idle backup, with data limits and cost controls set in policy. We recommend a mobile link on a different network from the site's fibre.

Compare MPLS and SD-WAN before you renew

Send us your site list and current WAN contracts, and we will set out MPLS vs SD-WAN for your estate, with costs over the term.

Talk to us